Edit tour

Linux Analysis Report
boatnet.m68k.elf

Overview

General Information

Sample name:	boatnet.m68k.elf
Analysis ID:	1570542
MD5:	a05602ec77a6fafe8b5c2441d7a5870e
SHA1:	b304074091f184e4846d096dfc83ff25d67b65f7
SHA256:	f35ff8be3da236cb6ea6d8c1982444854ae8b2fc66e2f36f83d9e6b2cce4370b
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570542
Start date and time:	2024-12-07 08:59:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	boatnet.m68k.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/boatnet.m68k.elf
PID:	5509
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

boatnet.m68k.elf (PID: 5509, Parent: 5432, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/boatnet.m68k.elf

boatnet.m68k.elf New Fork (PID: 5511, Parent: 5509)

boatnet.m68k.elf New Fork (PID: 5512, Parent: 5509)

boatnet.m68k.elf New Fork (PID: 5513, Parent: 5509)

xfce4-panel New Fork (PID: 5521, Parent: 3172)

wrapper-2.0 (PID: 5521, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5522, Parent: 3172)

wrapper-2.0 (PID: 5522, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5523, Parent: 3172)

wrapper-2.0 (PID: 5523, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5524, Parent: 3172)

wrapper-2.0 (PID: 5524, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5543, Parent: 5524)

xfpm-power-backlight-helper (PID: 5543, Parent: 5524, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5525, Parent: 3172)

wrapper-2.0 (PID: 5525, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5526, Parent: 3172)

wrapper-2.0 (PID: 5526, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5542, Parent: 5541)

xfconfd (PID: 5542, Parent: 5541, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5550, Parent: 2955)

xfce4-notifyd (PID: 5550, Parent: 2955, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
boatnet.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
boatnet.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
boatnet.m68k.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.m68k.elf PID: 5509	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.m68k.elf PID: 5509	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1353:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1367:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x137b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x138f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1407:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1443:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1457:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.m68k.elf PID: 5509	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1799:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 4 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: boatnet.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: boatnet.m68k.elf	ReversingLabs: Detection: 65%
Source: boatnet.m68k.elf	Virustotal: Detection: 61%			Perma Link

Source: global traffic

TCP traffic: 192.168.2.14:41288 -> 160.191.86.209:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209
Source: unknown	TCP traffic detected without corresponding DNS query: 160.191.86.209

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 5509, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 5509, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5521, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5522, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5523, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5524, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5525, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5526, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5542, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5521, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5522, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5523, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5524, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5525, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5526, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5542, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior

Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 5509, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 5509, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/0@2/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5521)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5522)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5542)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5542)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5542)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5542)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5550)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5550)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5550)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5550)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/5542/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3244/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3120/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3361/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3239/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1610/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/512/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/514/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/2946/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/5550/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3011/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3129/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3125/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3245/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3763/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/769/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3764/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/2956/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3142/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1635/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3139/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3817/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1873/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1630/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3398/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3392/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/661/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1369/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3304/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3425/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/940/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/941/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1640/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3268/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1364/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/548/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1647/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/2991/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1383/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1382/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1381/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/791/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/671/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1655/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/2986/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1653/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/797/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/2983/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3159/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/678/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1650/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3157/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/679/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/5456/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/1659/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3319/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/5351/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5511)	File opened: /proc/3178/cmdline	Jump to behavior

Source: /tmp/boatnet.m68k.elf (PID: 5509)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5521)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5522)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5523)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5524)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5525)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5526)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5550)	Queries kernel information via 'uname':	Jump to behavior

Source: boatnet.m68k.elf, 5509.1.000055c9e09af000.000055c9e0a34000.rw-.sdmp, boatnet.m68k.elf, 5512.1.000055c9e09af000.000055c9e0a34000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: boatnet.m68k.elf, 5509.1.00007ffc23d17000.00007ffc23d38000.rw-.sdmp, boatnet.m68k.elf, 5512.1.00007ffc23d17000.00007ffc23d38000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: boatnet.m68k.elf, 5509.1.000055c9e09af000.000055c9e0a34000.rw-.sdmp, boatnet.m68k.elf, 5512.1.000055c9e09af000.000055c9e0a34000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: boatnet.m68k.elf, 5509.1.00007ffc23d17000.00007ffc23d38000.rw-.sdmp, boatnet.m68k.elf, 5512.1.00007ffc23d17000.00007ffc23d38000.rw-.sdmp	Binary or memory string: wZx86_64/usr/bin/qemu-m68k/tmp/boatnet.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.m68k.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: boatnet.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 5509, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: boatnet.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5509.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.00007ff748001000.00007ff74800f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 5509, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
boatnet.m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
boatnet.m68k.elf	62%	Virustotal		Browse
boatnet.m68k.elf	100%	Avira	EXP/ELF.Gafgyt.D

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
160.191.86.209	unknown	unknown		2907	SINET-ASResearchOrganizationofInformationandSystemsN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
160.191.86.209	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	jew.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	iwir64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINET-ASResearchOrganizationofInformationandSystemsN	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	160.191.86.209
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	160.191.86.209
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	160.191.86.209
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	160.191.86.209
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	160.191.86.209
	jew.mips.elf	Get hash	malicious	Unknown	Browse	133.85.229.167
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	192.244.254.94
	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	133.78.26.128
	main_spc.elf	Get hash	malicious	Mirai	Browse	160.29.132.5
	main_mips.elf	Get hash	malicious	Mirai	Browse	163.143.138.185

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.255153295626506
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	boatnet.m68k.elf
File size:	54'932 bytes
MD5:	a05602ec77a6fafe8b5c2441d7a5870e
SHA1:	b304074091f184e4846d096dfc83ff25d67b65f7
SHA256:	f35ff8be3da236cb6ea6d8c1982444854ae8b2fc66e2f36f83d9e6b2cce4370b
SHA512:	3f6f0f477f499e1893c5561ad03a9970507ae359b51755a8e52da15ce432e4f4319f3526e1f3ed9fefa73b51c22a1fa9a8b66e87534c0a068b7ee710f1d90f00
SSDEEP:	768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGh:r/hqaJMcjeqK806MHdMfQXoHuCh
TLSH:	38330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85
File Content Preview:	.ELF.......................D...4.........4. ...(.................................. ....................(.......... .dt.Q............................NV..a....da.....N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	54532
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xc12e	0x0	0x6	AX	4
.fini	PROGBITS	0x8000c1d6	0xc1d6	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000c1e4	0xc1e4	0x10b4	0x0	0x2	A	2
.ctors	PROGBITS	0x8000f29c	0xd29c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8000f2a4	0xd2a4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8000f2b0	0xd2b0	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x8000f4c4	0xd4c4	0x2a0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xd4c4	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0xd298	0xd298	6.2905	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0xd29c	0x8000f29c	0x8000f29c	0x228	0x4c8	3.0346	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 09:00:12.458934069 CET	41288	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:12.579510927 CET	3778	41288	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:12.579596996 CET	41288	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:12.581444025 CET	41288	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:12.705161095 CET	3778	41288	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:12.705368042 CET	41288	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:12.829153061 CET	3778	41288	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:15.260871887 CET	3778	41288	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:15.261420012 CET	41288	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:15.381228924 CET	3778	41288	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:16.263499022 CET	41290	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:16.383363962 CET	3778	41290	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:16.383502960 CET	41290	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:16.384641886 CET	41290	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:16.504369020 CET	3778	41290	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:16.504606009 CET	41290	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:16.624468088 CET	3778	41290	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:19.057792902 CET	3778	41290	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:19.057943106 CET	41290	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:19.177947998 CET	3778	41290	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:20.066063881 CET	41292	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:20.186489105 CET	3778	41292	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:20.186572075 CET	41292	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:20.193265915 CET	41292	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:20.313163996 CET	3778	41292	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:20.313219070 CET	41292	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:20.433172941 CET	3778	41292	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:22.849252939 CET	3778	41292	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:22.849345922 CET	41292	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:22.969432116 CET	3778	41292	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:23.856249094 CET	41294	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:23.976227999 CET	3778	41294	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:23.976298094 CET	41294	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:23.982575893 CET	41294	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:24.102510929 CET	3778	41294	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:24.102565050 CET	41294	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:24.222254992 CET	3778	41294	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:26.651243925 CET	3778	41294	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:26.651348114 CET	41294	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:26.771367073 CET	3778	41294	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:27.658529997 CET	41296	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:27.778748035 CET	3778	41296	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:27.778876066 CET	41296	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:27.783303022 CET	41296	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:27.903306961 CET	3778	41296	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:27.903381109 CET	41296	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:28.023277044 CET	3778	41296	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:30.445065975 CET	3778	41296	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:30.445198059 CET	41296	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:30.565082073 CET	3778	41296	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:31.447356939 CET	41298	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:31.567388058 CET	3778	41298	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:31.567604065 CET	41298	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:31.568485975 CET	41298	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:31.688247919 CET	3778	41298	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:31.693123102 CET	41298	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:31.813045025 CET	3778	41298	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:34.242990971 CET	3778	41298	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:34.243247032 CET	41298	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:34.363033056 CET	3778	41298	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:35.244680882 CET	41300	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:35.364455938 CET	3778	41300	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:35.364650965 CET	41300	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:35.365504980 CET	41300	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:35.485187054 CET	3778	41300	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:35.485369921 CET	41300	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:35.605314016 CET	3778	41300	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:38.041641951 CET	3778	41300	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:38.041878939 CET	41300	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:38.161689043 CET	3778	41300	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:39.043248892 CET	41302	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:39.163086891 CET	3778	41302	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:39.163336039 CET	41302	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:39.163970947 CET	41302	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:39.283709049 CET	3778	41302	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:39.283916950 CET	41302	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:39.403690100 CET	3778	41302	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:41.842183113 CET	3778	41302	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:41.842370033 CET	41302	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:41.962156057 CET	3778	41302	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:42.843333960 CET	41304	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:42.963227987 CET	3778	41304	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:42.963318110 CET	41304	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:42.963953018 CET	41304	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:43.083761930 CET	3778	41304	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:43.083934069 CET	41304	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:43.203893900 CET	3778	41304	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:45.634337902 CET	3778	41304	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:45.634769917 CET	41304	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:45.754622936 CET	3778	41304	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:46.636641026 CET	41306	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:46.756489992 CET	3778	41306	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:46.756633043 CET	41306	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:46.757478952 CET	41306	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:46.877094030 CET	3778	41306	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:46.877321959 CET	41306	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:46.997056961 CET	3778	41306	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:49.433054924 CET	3778	41306	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:49.433504105 CET	41306	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:49.553203106 CET	3778	41306	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:50.435539007 CET	41308	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:50.555450916 CET	3778	41308	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:50.555541992 CET	41308	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:50.557029963 CET	41308	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:50.676758051 CET	3778	41308	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:50.676964045 CET	41308	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:50.797146082 CET	3778	41308	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:53.226603985 CET	3778	41308	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:53.227035999 CET	41308	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:53.349817991 CET	3778	41308	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:54.228895903 CET	41310	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:54.348779917 CET	3778	41310	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:54.348964930 CET	41310	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:54.350022078 CET	41310	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:54.469842911 CET	3778	41310	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:54.470063925 CET	41310	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:54.589879990 CET	3778	41310	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:57.023056030 CET	3778	41310	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:57.023358107 CET	41310	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:57.143142939 CET	3778	41310	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:58.025249004 CET	41312	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:58.145221949 CET	3778	41312	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:58.145596027 CET	41312	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:58.146590948 CET	41312	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:58.266561985 CET	3778	41312	160.191.86.209	192.168.2.14
Dec 7, 2024 09:00:58.266863108 CET	41312	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:00:58.387208939 CET	3778	41312	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:00.819268942 CET	3778	41312	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:00.819725990 CET	41312	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:00.939584017 CET	3778	41312	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:01.821064949 CET	41314	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:01.940903902 CET	3778	41314	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:01.941066980 CET	41314	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:01.942131996 CET	41314	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:02.062141895 CET	3778	41314	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:02.062441111 CET	41314	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:02.182281017 CET	3778	41314	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:04.621675014 CET	3778	41314	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:04.621870995 CET	41314	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:04.742031097 CET	3778	41314	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:05.623503923 CET	41316	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:05.743293047 CET	3778	41316	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:05.743387938 CET	41316	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:05.744007111 CET	41316	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:05.863950014 CET	3778	41316	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:05.864187002 CET	41316	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:05.983882904 CET	3778	41316	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:08.418165922 CET	3778	41316	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:08.418330908 CET	41316	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:08.538187981 CET	3778	41316	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:09.419491053 CET	41318	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:09.539418936 CET	3778	41318	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:09.539586067 CET	41318	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:09.540168047 CET	41318	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:09.659962893 CET	3778	41318	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:09.660064936 CET	41318	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:09.779901981 CET	3778	41318	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:12.212124109 CET	3778	41318	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:12.212466002 CET	41318	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:12.332211018 CET	3778	41318	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:13.215651989 CET	41320	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:13.335582018 CET	3778	41320	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:13.335720062 CET	41320	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:13.336831093 CET	41320	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:13.456538916 CET	3778	41320	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:13.456789970 CET	41320	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:13.576556921 CET	3778	41320	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:16.043524027 CET	3778	41320	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:16.043745041 CET	41320	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:16.163523912 CET	3778	41320	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:17.045660973 CET	41322	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:17.165842056 CET	3778	41322	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:17.165919065 CET	41322	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:17.167228937 CET	41322	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:17.287019014 CET	3778	41322	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:17.287087917 CET	41322	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:17.406908035 CET	3778	41322	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:19.839534044 CET	3778	41322	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:19.839660883 CET	41322	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:19.959639072 CET	3778	41322	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:20.840615034 CET	41324	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:20.960442066 CET	3778	41324	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:20.960515976 CET	41324	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:20.961179972 CET	41324	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:21.081288099 CET	3778	41324	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:21.081373930 CET	41324	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:21.202218056 CET	3778	41324	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:23.638974905 CET	3778	41324	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:23.639153004 CET	41324	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:23.759031057 CET	3778	41324	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:24.640393972 CET	41326	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:24.760288954 CET	3778	41326	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:24.760365963 CET	41326	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:24.760947943 CET	41326	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:24.880889893 CET	3778	41326	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:24.881045103 CET	41326	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:25.003055096 CET	3778	41326	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:27.429462910 CET	3778	41326	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:27.429577112 CET	41326	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:27.549638033 CET	3778	41326	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:28.430784941 CET	41328	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:28.550873995 CET	3778	41328	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:28.550976038 CET	41328	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:28.551784992 CET	41328	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:28.671495914 CET	3778	41328	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:28.671596050 CET	41328	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:28.793348074 CET	3778	41328	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:31.227106094 CET	3778	41328	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:31.227277994 CET	41328	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:31.347062111 CET	3778	41328	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:32.228842974 CET	41330	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:32.348953009 CET	3778	41330	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:32.349139929 CET	41330	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:32.350198984 CET	41330	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:32.470056057 CET	3778	41330	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:32.470288992 CET	41330	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:32.590040922 CET	3778	41330	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:35.028465033 CET	3778	41330	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:35.028610945 CET	41330	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:35.148763895 CET	3778	41330	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:36.030280113 CET	41332	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:36.150306940 CET	3778	41332	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:36.150398016 CET	41332	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:36.151427031 CET	41332	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:36.271131039 CET	3778	41332	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:36.271195889 CET	41332	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:36.390944958 CET	3778	41332	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:38.823518991 CET	3778	41332	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:38.823741913 CET	41332	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:38.944539070 CET	3778	41332	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:39.825565100 CET	41334	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:39.945627928 CET	3778	41334	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:39.945883989 CET	41334	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:39.947063923 CET	41334	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:40.066895008 CET	3778	41334	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:40.067130089 CET	41334	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:40.186995029 CET	3778	41334	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:42.623367071 CET	3778	41334	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:42.623464108 CET	41334	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:42.743280888 CET	3778	41334	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:43.624896049 CET	41336	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:43.744946003 CET	3778	41336	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:43.745016098 CET	41336	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:43.745759010 CET	41336	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:43.865469933 CET	3778	41336	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:43.865510941 CET	41336	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:43.985331059 CET	3778	41336	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:46.418021917 CET	3778	41336	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:46.418153048 CET	41336	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:46.418184996 CET	41336	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:46.538204908 CET	3778	41336	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:47.419358015 CET	41338	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:47.539227009 CET	3778	41338	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:47.539293051 CET	41338	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:47.539902925 CET	41338	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:47.659636021 CET	3778	41338	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:47.659701109 CET	41338	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:47.781246901 CET	3778	41338	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:50.216466904 CET	3778	41338	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:50.216587067 CET	41338	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:50.336361885 CET	3778	41338	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:51.217787981 CET	41340	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:51.337661982 CET	3778	41340	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:51.337892056 CET	41340	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:51.338427067 CET	41340	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:51.458085060 CET	3778	41340	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:51.458229065 CET	41340	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:51.577999115 CET	3778	41340	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:54.011259079 CET	3778	41340	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:54.011393070 CET	41340	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:54.131208897 CET	3778	41340	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:55.012454033 CET	41342	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:55.132283926 CET	3778	41342	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:55.132364035 CET	41342	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:55.132916927 CET	41342	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:55.252566099 CET	3778	41342	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:55.252624035 CET	41342	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:55.372385979 CET	3778	41342	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:57.823766947 CET	3778	41342	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:57.823884964 CET	41342	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:57.943619013 CET	3778	41342	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:58.825021029 CET	41344	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:58.945128918 CET	3778	41344	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:58.945250988 CET	41344	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:58.945810080 CET	41344	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:59.065562010 CET	3778	41344	160.191.86.209	192.168.2.14
Dec 7, 2024 09:01:59.065665960 CET	41344	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:01:59.185384989 CET	3778	41344	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:01.622881889 CET	3778	41344	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:01.623121977 CET	41344	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:01.742842913 CET	3778	41344	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:02.624625921 CET	41346	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:02.744426966 CET	3778	41346	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:02.744657040 CET	41346	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:02.745737076 CET	41346	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:02.865678072 CET	3778	41346	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:02.865916014 CET	41346	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:02.985724926 CET	3778	41346	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:05.416903973 CET	3778	41346	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:05.417110920 CET	41346	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:05.537039042 CET	3778	41346	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:06.418900013 CET	41348	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:06.538938999 CET	3778	41348	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:06.539016008 CET	41348	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:06.540081978 CET	41348	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:06.659775019 CET	3778	41348	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:06.659974098 CET	41348	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:06.779740095 CET	3778	41348	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:09.213074923 CET	3778	41348	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:09.213269949 CET	41348	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:09.213345051 CET	41348	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:09.334126949 CET	3778	41348	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:10.215029001 CET	41350	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:10.335669041 CET	3778	41350	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:10.335743904 CET	41350	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:10.336374998 CET	41350	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:10.456480980 CET	3778	41350	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:10.456547022 CET	41350	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:10.579957008 CET	3778	41350	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:13.007076979 CET	3778	41350	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:13.007169008 CET	41350	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:13.126929045 CET	3778	41350	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:14.008156061 CET	41352	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:14.128294945 CET	3778	41352	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:14.128492117 CET	41352	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:14.129053116 CET	41352	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:14.248927116 CET	3778	41352	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:14.249001026 CET	41352	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:14.368771076 CET	3778	41352	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:16.809919119 CET	3778	41352	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:16.810103893 CET	41352	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:16.929873943 CET	3778	41352	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:17.811484098 CET	41354	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:17.931380987 CET	3778	41354	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:17.931443930 CET	41354	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:17.932084084 CET	41354	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:18.052082062 CET	3778	41354	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:18.052252054 CET	41354	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:18.171941042 CET	3778	41354	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:20.605026960 CET	3778	41354	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:20.605145931 CET	41354	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:20.724883080 CET	3778	41354	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:21.606698036 CET	41356	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:21.726499081 CET	3778	41356	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:21.726702929 CET	41356	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:21.727914095 CET	41356	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:21.847634077 CET	3778	41356	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:21.847843885 CET	41356	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:21.969672918 CET	3778	41356	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:24.404203892 CET	3778	41356	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:24.404556990 CET	41356	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:24.524290085 CET	3778	41356	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:25.406440020 CET	41358	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:25.526529074 CET	3778	41358	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:25.526774883 CET	41358	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:25.527879953 CET	41358	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:25.647950888 CET	3778	41358	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:25.648178101 CET	41358	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:25.767884016 CET	3778	41358	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:28.200784922 CET	3778	41358	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:28.201023102 CET	41358	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:28.320763111 CET	3778	41358	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:29.203046083 CET	41360	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:29.323014975 CET	3778	41360	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:29.323256969 CET	41360	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:29.324372053 CET	41360	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:29.444072962 CET	3778	41360	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:29.444228888 CET	41360	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:29.563999891 CET	3778	41360	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:32.001966000 CET	3778	41360	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:32.002260923 CET	41360	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:32.122365952 CET	3778	41360	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:33.003990889 CET	41362	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:33.124165058 CET	3778	41362	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:33.124409914 CET	41362	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:33.125659943 CET	41362	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:33.245415926 CET	3778	41362	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:33.245634079 CET	41362	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:33.365461111 CET	3778	41362	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:35.807209015 CET	3778	41362	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:35.807579994 CET	41362	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:35.927755117 CET	3778	41362	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:36.808882952 CET	41364	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:36.928816080 CET	3778	41364	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:36.928875923 CET	41364	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:36.929413080 CET	41364	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:37.049258947 CET	3778	41364	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:37.049415112 CET	41364	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:37.169399023 CET	3778	41364	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:39.604006052 CET	3778	41364	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:39.604247093 CET	41364	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:39.725128889 CET	3778	41364	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:40.605964899 CET	41366	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:40.725773096 CET	3778	41366	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:40.726166964 CET	41366	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:40.727505922 CET	41366	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:40.847290039 CET	3778	41366	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:40.847431898 CET	41366	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:40.967143059 CET	3778	41366	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:43.402642965 CET	3778	41366	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:43.403196096 CET	41366	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:43.522954941 CET	3778	41366	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:44.405041933 CET	41368	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:44.525127888 CET	3778	41368	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:44.525428057 CET	41368	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:44.526562929 CET	41368	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:44.646255016 CET	3778	41368	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:44.646709919 CET	41368	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:44.766514063 CET	3778	41368	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:47.198048115 CET	3778	41368	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:47.198276997 CET	41368	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:47.318651915 CET	3778	41368	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:48.199920893 CET	41370	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:48.319735050 CET	3778	41370	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:48.319996119 CET	41370	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:48.321197987 CET	41370	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:48.440886021 CET	3778	41370	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:48.440992117 CET	41370	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:48.560827017 CET	3778	41370	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:50.995440960 CET	3778	41370	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:50.995727062 CET	41370	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:50.995727062 CET	41370	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:51.115665913 CET	3778	41370	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:51.997469902 CET	41372	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:52.117326021 CET	3778	41372	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:52.117405891 CET	41372	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:52.118542910 CET	41372	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:52.238308907 CET	3778	41372	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:52.238522053 CET	41372	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:52.358238935 CET	3778	41372	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:54.793586016 CET	3778	41372	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:54.793883085 CET	41372	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:54.913680077 CET	3778	41372	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:55.795160055 CET	41374	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:55.915026903 CET	3778	41374	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:55.915276051 CET	41374	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:55.915941000 CET	41374	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:56.035684109 CET	3778	41374	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:56.035945892 CET	41374	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:56.156531096 CET	3778	41374	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:58.591392040 CET	3778	41374	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:58.591686010 CET	41374	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:58.711512089 CET	3778	41374	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:59.637413025 CET	41376	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:59.757270098 CET	3778	41376	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:59.757433891 CET	41376	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:59.758533001 CET	41376	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:59.878182888 CET	3778	41376	160.191.86.209	192.168.2.14
Dec 7, 2024 09:02:59.878341913 CET	41376	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:02:59.998045921 CET	3778	41376	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:02.452758074 CET	3778	41376	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:02.453083992 CET	41376	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:02.572890997 CET	3778	41376	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:03.454461098 CET	41378	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:03.574273109 CET	3778	41378	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:03.574503899 CET	41378	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:03.575633049 CET	41378	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:03.695307016 CET	3778	41378	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:03.695565939 CET	41378	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:03.815793037 CET	3778	41378	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:06.246316910 CET	3778	41378	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:06.246613979 CET	41378	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:06.366372108 CET	3778	41378	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:07.248265982 CET	41380	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:07.369198084 CET	3778	41380	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:07.369347095 CET	41380	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:07.370271921 CET	41380	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:07.490830898 CET	3778	41380	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:07.490962982 CET	41380	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:07.610933065 CET	3778	41380	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:10.040091991 CET	3778	41380	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:10.040393114 CET	41380	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:10.161482096 CET	3778	41380	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:11.042213917 CET	41382	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:11.162481070 CET	3778	41382	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:11.162561893 CET	41382	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:11.163490057 CET	41382	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:11.283257008 CET	3778	41382	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:11.283440113 CET	41382	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:11.403366089 CET	3778	41382	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:13.840066910 CET	3778	41382	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:13.840236902 CET	41382	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:13.960031986 CET	3778	41382	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:14.842185974 CET	41384	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:14.961985111 CET	3778	41384	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:14.962088108 CET	41384	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:14.963258028 CET	41384	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:15.083734035 CET	3778	41384	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:15.083816051 CET	41384	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:15.203583956 CET	3778	41384	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:17.639379025 CET	3778	41384	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:17.639484882 CET	41384	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:17.759274006 CET	3778	41384	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:18.641072989 CET	41386	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:18.760986090 CET	3778	41386	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:18.761065960 CET	41386	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:18.761898041 CET	41386	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:18.881727934 CET	3778	41386	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:18.881882906 CET	41386	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:19.001599073 CET	3778	41386	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:21.437875032 CET	3778	41386	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:21.438236952 CET	41386	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:21.557976961 CET	3778	41386	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:22.439923048 CET	41388	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:22.559787989 CET	3778	41388	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:22.560066938 CET	41388	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:22.561235905 CET	41388	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:22.681355000 CET	3778	41388	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:22.681653976 CET	41388	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:22.801454067 CET	3778	41388	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:25.248369932 CET	3778	41388	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:25.248774052 CET	41388	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:25.368566036 CET	3778	41388	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:26.250210047 CET	41390	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:26.370032072 CET	3778	41390	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:26.370208979 CET	41390	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:26.371289015 CET	41390	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:26.491436958 CET	3778	41390	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:26.491627932 CET	41390	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:26.611457109 CET	3778	41390	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:29.040144920 CET	3778	41390	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:29.040462017 CET	41390	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:29.160294056 CET	3778	41390	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:30.042536020 CET	41392	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:30.162291050 CET	3778	41392	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:30.162606001 CET	41392	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:30.163360119 CET	41392	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:30.283957958 CET	3778	41392	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:30.284301043 CET	41392	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:30.404244900 CET	3778	41392	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:32.840924025 CET	3778	41392	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:32.841281891 CET	41392	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:32.961056948 CET	3778	41392	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:33.843589067 CET	41394	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:33.963397026 CET	3778	41394	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:33.963582039 CET	41394	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:33.965079069 CET	41394	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:34.084800005 CET	3778	41394	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:34.084985018 CET	41394	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:34.205144882 CET	3778	41394	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:36.638792038 CET	3778	41394	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:36.638917923 CET	41394	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:36.758614063 CET	3778	41394	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:37.640496969 CET	41396	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:37.760356903 CET	3778	41396	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:37.760464907 CET	41396	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:37.761663914 CET	41396	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:37.881441116 CET	3778	41396	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:37.881505013 CET	41396	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:38.001281977 CET	3778	41396	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:40.450556993 CET	3778	41396	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:40.450757980 CET	41396	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:40.570585012 CET	3778	41396	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:41.452419043 CET	41398	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:41.572241068 CET	3778	41398	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:41.572341919 CET	41398	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:41.573276997 CET	41398	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:41.692944050 CET	3778	41398	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:41.693123102 CET	41398	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:41.812922955 CET	3778	41398	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:44.244134903 CET	3778	41398	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:44.244334936 CET	41398	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:44.364797115 CET	3778	41398	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:45.245839119 CET	41400	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:45.365636110 CET	3778	41400	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:45.365699053 CET	41400	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:45.366695881 CET	41400	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:45.486530066 CET	3778	41400	160.191.86.209	192.168.2.14
Dec 7, 2024 09:03:45.486604929 CET	41400	3778	192.168.2.14	160.191.86.209
Dec 7, 2024 09:03:45.606461048 CET	3778	41400	160.191.86.209	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 09:02:58.118808985 CET	35097	53	192.168.2.14	1.1.1.1
Dec 7, 2024 09:02:58.118855953 CET	38543	53	192.168.2.14	1.1.1.1
Dec 7, 2024 09:02:58.257999897 CET	53	38543	1.1.1.1	192.168.2.14
Dec 7, 2024 09:02:58.343105078 CET	53	35097	1.1.1.1	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2024 09:02:58.118808985 CET	192.168.2.14	1.1.1.1	0xe43d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 09:02:58.118855953 CET	192.168.2.14	1.1.1.1	0xf579	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 7, 2024 09:02:58.343105078 CET	1.1.1.1	192.168.2.14	0xe43d	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 7, 2024 09:02:58.343105078 CET	1.1.1.1	192.168.2.14	0xe43d	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: boatnet.m68k.elf PID: 5509, Parent PID: 5432

General

Start time (UTC):	08:00:11
Start date (UTC):	07/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	/tmp/boatnet.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5511, Parent PID: 5509

General

Start time (UTC):	08:00:11
Start date (UTC):	07/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5512, Parent PID: 5509

General

Start time (UTC):	08:00:11
Start date (UTC):	07/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5513, Parent PID: 5509

General

Start time (UTC):	08:00:11
Start date (UTC):	07/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: xfce4-panel PID: 5521, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5521, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5522, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5522, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5523, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5523, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5524, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5524, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5543, Parent PID: 5524

General

Start time (UTC):	08:00:21
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 5543, Parent PID: 5524

General

Start time (UTC):	08:00:21
Start date (UTC):	07/12/2024
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Chronological Activities

Analysis Process: xfce4-panel PID: 5525, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5525, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5526, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5526, Parent PID: 3172

General

Start time (UTC):	08:00:17
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: dbus-daemon PID: 5542, Parent PID: 5541

General

Start time (UTC):	08:00:21
Start date (UTC):	07/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 5542, Parent PID: 5541

General

Start time (UTC):	08:00:21
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: systemd PID: 5550, Parent PID: 2955

General

Start time (UTC):	08:00:24
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: xfce4-notifyd PID: 5550, Parent PID: 2955

General

Start time (UTC):	08:00:24
Start date (UTC):	07/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report boatnet.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: boatnet.m68k.elf PID: 5509, Parent PID: 5432

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5511, Parent PID: 5509

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5512, Parent PID: 5509

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5513, Parent PID: 5509

General

Chronological Activities

Analysis Process: xfce4-panel PID: 5521, Parent PID: 3172

General

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5521, Parent PID: 3172

General

Linux Analysis Report
boatnet.m68k.elf