Edit tour

Linux Analysis Report
boatnet.m68k.elf

Overview

General Information

Sample name:	boatnet.m68k.elf
Analysis ID:	1579160
MD5:	0e1206df9c7f87c0ec86cf885816d434
SHA1:	991eb6d8db4f302ed5d47f523bebc8f6d4e96978
SHA256:	c7ab8cb4f88c4b8e36363477f6d7c0cffc4edf8bddbdbec94155bf4963417196
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579160
Start date and time:	2024-12-20 23:15:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	boatnet.m68k.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: boatnet.m68k.elf

Runtime Messages

Command:	/tmp/boatnet.m68k.elf
PID:	6261
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

boatnet.m68k.elf (PID: 6261, Parent: 6184, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/boatnet.m68k.elf

boatnet.m68k.elf New Fork (PID: 6263, Parent: 6261)

boatnet.m68k.elf New Fork (PID: 6264, Parent: 6261)

boatnet.m68k.elf New Fork (PID: 6266, Parent: 6261)

xfce4-panel New Fork (PID: 6273, Parent: 2063)

wrapper-2.0 (PID: 6273, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6274, Parent: 2063)

wrapper-2.0 (PID: 6274, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6275, Parent: 2063)

wrapper-2.0 (PID: 6275, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6276, Parent: 2063)

wrapper-2.0 (PID: 6276, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6291, Parent: 6276)

xfpm-power-backlight-helper (PID: 6291, Parent: 6276, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6277, Parent: 2063)

wrapper-2.0 (PID: 6277, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6278, Parent: 2063)

wrapper-2.0 (PID: 6278, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 6290, Parent: 6289)

xfconfd (PID: 6290, Parent: 6289, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6297, Parent: 1860)

xfce4-notifyd (PID: 6297, Parent: 1860, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
boatnet.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
boatnet.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1083c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1088c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1092c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1097c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
boatnet.m68k.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10d79:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1083c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1088c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1092c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1097c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10d79:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1083c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1088c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1092c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1097c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10d79:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.m68k.elf PID: 6261	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.m68k.elf PID: 6261	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x339a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3412:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3426:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x343a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x344e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3462:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3476:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x348a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x349e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3502:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3516:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x352a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.m68k.elf PID: 6261	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3858:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.m68k.elf PID: 6264	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.m68k.elf PID: 6264	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2033:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2047:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x205b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2083:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2097:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2123:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2137:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x214b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x215f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2173:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2187:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x219b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.m68k.elf PID: 6264	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x24f1:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 7 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: boatnet.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: boatnet.m68k.elf

ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.23:46318 -> 178.215.238.74:3778

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 178.215.238.74
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6297, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	SIGKILL sent: pid: 6297, result: successful	Jump to behavior

Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/0@0/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6297)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6297)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6297)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6297)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2275/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1612/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/3236/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2146/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4444/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4445/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4446/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/517/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/759/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4447/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2285/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2281/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/761/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1622/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1983/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2038/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2156/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6358/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1629/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1627/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/3021/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2294/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6093/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1877/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4508/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/772/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1632/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/774/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/896/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2048/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2289/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2180/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6266/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1890/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2063/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/2062/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1888/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4518/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1886/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/420/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1489/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/788/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/667/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4512/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/4514/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6274/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6273/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6276/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6275/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 6263)	File opened: /proc/6311/cmdline	Jump to behavior

Source: /tmp/boatnet.m68k.elf (PID: 6261)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6297)	Queries kernel information via 'uname':	Jump to behavior

Source: boatnet.m68k.elf, 6261.1.00007ffc1aed9000.00007ffc1aefa000.rw-.sdmp, boatnet.m68k.elf, 6264.1.00007ffc1aed9000.00007ffc1aefa000.rw-.sdmp	Binary or memory string: 7x86_64/usr/bin/qemu-m68k/tmp/boatnet.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.m68k.elf
Source: boatnet.m68k.elf, 6261.1.00007ffc1aed9000.00007ffc1aefa000.rw-.sdmp, boatnet.m68k.elf, 6264.1.00007ffc1aed9000.00007ffc1aefa000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: boatnet.m68k.elf, 6261.1.0000555c65649000.0000555c656cf000.rw-.sdmp, boatnet.m68k.elf, 6264.1.0000555c65649000.0000555c656cf000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: boatnet.m68k.elf, 6261.1.0000555c65649000.0000555c656cf000.rw-.sdmp, boatnet.m68k.elf, 6264.1.0000555c65649000.0000555c656cf000.rw-.sdmp	Binary or memory string: de\U!/etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: boatnet.m68k.elf, type: SAMPLE
Source: Yara match	File source: 6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 6264, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: boatnet.m68k.elf, type: SAMPLE
Source: Yara match	File source: 6261.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.00007f57ec001000.00007f57ec013000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 6264, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
boatnet.m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
boatnet.m68k.elf	100%	Avira	EXP/ELF.Gafgyt.D

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
178.215.238.74	unknown	Germany	10753	LVLT-10753US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	arm6.elf	Get hash	malicious	Mirai	Browse
	dbus.elf	Get hash	malicious	Unknown	Browse
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	CONSTANT_STRATEGY.elf	Get hash	malicious	Sliver	Browse
	10000.elf	Get hash	malicious	Unknown	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse
	wiewa64.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dbus.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	CONSTANT_STRATEGY.elf	Get hash	malicious	Sliver	Browse	91.189.91.42
	10000.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse	91.189.91.42
	wiewa64.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dbus.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	CONSTANT_STRATEGY.elf	Get hash	malicious	Sliver	Browse	109.202.202.202
	10000.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse	109.202.202.202
	wiewa64.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.235787697093049
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	boatnet.m68k.elf
File size:	73'084 bytes
MD5:	0e1206df9c7f87c0ec86cf885816d434
SHA1:	991eb6d8db4f302ed5d47f523bebc8f6d4e96978
SHA256:	c7ab8cb4f88c4b8e36363477f6d7c0cffc4edf8bddbdbec94155bf4963417196
SHA512:	a8b2d6eeac2772c638f14d5281a92a3fd9595a98836d86b8a3ebfccd805c7511a7929faec0cedd80a6ccf213244220acfd4866bd6312dcda8833bae7927c49da
SSDEEP:	1536:23Z8R8M1OQkn+i8QDralQeuacWjcW0JcWcBASqh2R5ykNQJBR:23Z8R82OQk+lQeuacWjcW0JcWcBLqhmW
TLSH:	6C632BCAF401DE7DF84BD6774C560E1CBA71B3D016831A2B67A7BEA7AD72158180AC81
File Content Preview:	.ELF.......................D...4.........4. ...(.......................4...4...... ........8..98..98...t..'....... .dt.Q............................NV..a....da....HN^NuNV..J9..;.f>"y..9P QJ.g.X.#...9PN."y..9P QJ.f.A.....J.g.Hy..94N.X.......;.N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	72684
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x10772	0x0	0x6	AX	4
.fini	PROGBITS	0x8001081a	0x1081a	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x80010828	0x10828	0x110c	0x0	0x2	A	2
.ctors	PROGBITS	0x80013938	0x11938	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80013940	0x11940	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8001394c	0x1194c	0x260	0x0	0x3	WA	4
.bss	NOBITS	0x80013bac	0x11bac	0x2574	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x11bac	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x11934	0x11934	6.2570	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x11938	0x80013938	0x80013938	0x274	0x27e8	3.6780	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 23:16:41.006284952 CET	42516	80	192.168.2.23	109.202.202.202
Dec 20, 2024 23:16:41.774139881 CET	43928	443	192.168.2.23	91.189.91.42
Dec 20, 2024 23:16:41.882577896 CET	46318	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:42.002177000 CET	3778	46318	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:42.002286911 CET	46318	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:42.007491112 CET	46318	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:42.127456903 CET	3778	46318	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:42.127511024 CET	46318	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:42.247004986 CET	3778	46318	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:44.178683043 CET	3778	46318	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:44.179114103 CET	46318	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:44.298702955 CET	3778	46318	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:45.181468010 CET	46320	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:45.301235914 CET	3778	46320	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:45.301321030 CET	46320	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:45.302270889 CET	46320	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:45.421863079 CET	3778	46320	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:45.422025919 CET	46320	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:45.541913033 CET	3778	46320	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:47.149382114 CET	42836	443	192.168.2.23	91.189.91.43
Dec 20, 2024 23:16:47.476831913 CET	3778	46320	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:47.476948023 CET	46320	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:47.596482992 CET	3778	46320	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:48.486789942 CET	46322	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:48.606538057 CET	3778	46322	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:48.606616020 CET	46322	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:48.613668919 CET	46322	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:48.733127117 CET	3778	46322	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:48.733184099 CET	46322	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:48.852700949 CET	3778	46322	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:50.788114071 CET	3778	46322	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:50.788229942 CET	46322	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:50.907772064 CET	3778	46322	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:51.795557976 CET	46324	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:51.965056896 CET	3778	46324	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:51.965135098 CET	46324	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:51.976236105 CET	46324	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:52.095793962 CET	3778	46324	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:52.095846891 CET	46324	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:52.215326071 CET	3778	46324	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:54.147629023 CET	3778	46324	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:54.147727966 CET	46324	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:54.267381907 CET	3778	46324	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:55.155601025 CET	46326	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:55.275171995 CET	3778	46326	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:55.275248051 CET	46326	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:55.280922890 CET	46326	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:55.400465012 CET	3778	46326	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:55.400517941 CET	46326	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:55.519980907 CET	3778	46326	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:57.444783926 CET	3778	46326	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:57.444902897 CET	46326	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:57.564512968 CET	3778	46326	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:58.451116085 CET	46328	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:58.570719004 CET	3778	46328	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:58.570795059 CET	46328	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:58.574177980 CET	46328	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:58.693653107 CET	3778	46328	178.215.238.74	192.168.2.23
Dec 20, 2024 23:16:58.693700075 CET	46328	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:16:58.813211918 CET	3778	46328	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:00.741589069 CET	3778	46328	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:00.741728067 CET	46328	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:00.861674070 CET	3778	46328	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:01.743650913 CET	46330	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:01.863230944 CET	3778	46330	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:01.863339901 CET	46330	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:01.864311934 CET	46330	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:01.983834982 CET	3778	46330	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:01.983982086 CET	46330	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:02.103471041 CET	3778	46330	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:02.763366938 CET	43928	443	192.168.2.23	91.189.91.42
Dec 20, 2024 23:17:04.038367987 CET	3778	46330	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:04.038634062 CET	46330	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:04.158216953 CET	3778	46330	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:05.040134907 CET	46332	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:05.161286116 CET	3778	46332	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:05.161417007 CET	46332	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:05.162523031 CET	46332	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:05.282062054 CET	3778	46332	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:05.282195091 CET	46332	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:05.401808023 CET	3778	46332	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:07.335639954 CET	3778	46332	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:07.335864067 CET	46332	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:07.455602884 CET	3778	46332	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:08.337430954 CET	46334	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:08.457199097 CET	3778	46334	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:08.457314014 CET	46334	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:08.458369017 CET	46334	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:08.577907085 CET	3778	46334	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:08.578027964 CET	46334	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:08.697717905 CET	3778	46334	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:10.651839018 CET	3778	46334	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:10.652062893 CET	46334	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:10.771797895 CET	3778	46334	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:10.954150915 CET	42516	80	192.168.2.23	109.202.202.202
Dec 20, 2024 23:17:11.653696060 CET	46336	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:11.773572922 CET	3778	46336	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:11.773802996 CET	46336	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:11.774630070 CET	46336	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:11.894232988 CET	3778	46336	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:11.894397974 CET	46336	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:12.015163898 CET	3778	46336	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:13.001910925 CET	42836	443	192.168.2.23	91.189.91.43
Dec 20, 2024 23:17:13.944787979 CET	3778	46336	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:13.945207119 CET	46336	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:14.064832926 CET	3778	46336	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:14.947725058 CET	46338	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:15.067493916 CET	3778	46338	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:15.067780018 CET	46338	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:15.068947077 CET	46338	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:15.188421965 CET	3778	46338	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:15.188697100 CET	46338	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:15.308259964 CET	3778	46338	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:17.242567062 CET	3778	46338	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:17.242959976 CET	46338	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:17.362529993 CET	3778	46338	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:18.245234013 CET	46340	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:18.365005016 CET	3778	46340	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:18.365106106 CET	46340	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:18.366189957 CET	46340	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:18.485708952 CET	3778	46340	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:18.485888004 CET	46340	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:18.605422020 CET	3778	46340	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:20.554117918 CET	3778	46340	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:20.554431915 CET	46340	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:20.674035072 CET	3778	46340	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:21.556277990 CET	46342	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:21.676105022 CET	3778	46342	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:21.676223040 CET	46342	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:21.677495003 CET	46342	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:21.797014952 CET	3778	46342	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:21.797135115 CET	46342	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:21.917759895 CET	3778	46342	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:23.851746082 CET	3778	46342	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:23.851963997 CET	46342	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:23.972045898 CET	3778	46342	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:24.854671001 CET	46344	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:24.974683046 CET	3778	46344	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:24.974960089 CET	46344	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:24.976970911 CET	46344	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:25.096508026 CET	3778	46344	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:25.096782923 CET	46344	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:25.216346025 CET	3778	46344	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:27.149918079 CET	3778	46344	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:27.150154114 CET	46344	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:27.269963980 CET	3778	46344	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:28.153248072 CET	46346	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:28.272959948 CET	3778	46346	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:28.273173094 CET	46346	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:28.274954081 CET	46346	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:28.394726992 CET	3778	46346	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:28.394865036 CET	46346	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:28.514662027 CET	3778	46346	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:30.445458889 CET	3778	46346	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:30.445673943 CET	46346	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:30.565308094 CET	3778	46346	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:31.447652102 CET	46348	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:31.569221020 CET	3778	46348	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:31.569447041 CET	46348	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:31.571997881 CET	46348	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:31.692800999 CET	3778	46348	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:31.693056107 CET	46348	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:31.813905954 CET	3778	46348	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:33.742228031 CET	3778	46348	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:33.742595911 CET	46348	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:33.862257957 CET	3778	46348	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:34.745260000 CET	46350	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:34.865147114 CET	3778	46350	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:34.865288973 CET	46350	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:34.866544962 CET	46350	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:34.986233950 CET	3778	46350	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:34.986479044 CET	46350	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:35.106225014 CET	3778	46350	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:37.039453983 CET	3778	46350	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:37.039887905 CET	46350	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:37.160018921 CET	3778	46350	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:38.042170048 CET	46352	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:38.162247896 CET	3778	46352	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:38.162406921 CET	46352	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:38.163856983 CET	46352	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:38.283371925 CET	3778	46352	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:38.283489943 CET	46352	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:38.403294086 CET	3778	46352	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:40.382843971 CET	3778	46352	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:40.383069992 CET	46352	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:40.502913952 CET	3778	46352	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:41.385608912 CET	46354	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:41.505362034 CET	3778	46354	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:41.505654097 CET	46354	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:41.507204056 CET	46354	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:41.626835108 CET	3778	46354	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:41.627115965 CET	46354	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:41.746695995 CET	3778	46354	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:43.717626095 CET	43928	443	192.168.2.23	91.189.91.42
Dec 20, 2024 23:17:43.852859974 CET	3778	46354	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:43.853125095 CET	46354	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:43.972776890 CET	3778	46354	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:44.855829000 CET	46356	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:44.976162910 CET	3778	46356	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:44.976321936 CET	46356	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:44.977958918 CET	46356	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:45.097775936 CET	3778	46356	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:45.097919941 CET	46356	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:45.217602968 CET	3778	46356	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:47.149240971 CET	3778	46356	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:47.149455070 CET	46356	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:47.269154072 CET	3778	46356	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:48.152126074 CET	46358	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:48.273474932 CET	3778	46358	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:48.273891926 CET	46358	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:48.275248051 CET	46358	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:48.397277117 CET	3778	46358	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:48.397372007 CET	46358	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:48.517066002 CET	3778	46358	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:50.445807934 CET	3778	46358	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:50.446043015 CET	46358	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:50.565787077 CET	3778	46358	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:51.448144913 CET	46360	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:51.568037987 CET	3778	46360	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:51.568208933 CET	46360	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:51.569786072 CET	46360	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:51.689410925 CET	3778	46360	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:51.689640045 CET	46360	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:51.809385061 CET	3778	46360	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:53.742908955 CET	3778	46360	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:53.743138075 CET	46360	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:53.863066912 CET	3778	46360	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:54.745234966 CET	46362	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:54.864917040 CET	3778	46362	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:54.865183115 CET	46362	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:54.866605043 CET	46362	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:54.986932993 CET	3778	46362	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:54.987190962 CET	46362	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:55.107425928 CET	3778	46362	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:57.041034937 CET	3778	46362	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:57.041291952 CET	46362	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:57.161549091 CET	3778	46362	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:58.043870926 CET	46364	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:58.166140079 CET	3778	46364	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:58.166412115 CET	46364	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:58.168457985 CET	46364	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:58.288290024 CET	3778	46364	178.215.238.74	192.168.2.23
Dec 20, 2024 23:17:58.288461924 CET	46364	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:17:58.408277035 CET	3778	46364	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:00.367906094 CET	3778	46364	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:00.368172884 CET	46364	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:00.487911940 CET	3778	46364	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:01.371093988 CET	46366	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:01.490895987 CET	3778	46366	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:01.491002083 CET	46366	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:01.491880894 CET	46366	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:01.611525059 CET	3778	46366	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:01.611706972 CET	46366	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:01.731388092 CET	3778	46366	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:03.680628061 CET	3778	46366	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:03.681050062 CET	46366	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:03.803415060 CET	3778	46366	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:04.194938898 CET	42836	443	192.168.2.23	91.189.91.43
Dec 20, 2024 23:18:04.683558941 CET	46368	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:04.803498983 CET	3778	46368	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:04.803829908 CET	46368	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:04.805327892 CET	46368	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:04.925173044 CET	3778	46368	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:04.925400019 CET	46368	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:05.045277119 CET	3778	46368	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:06.978718996 CET	3778	46368	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:06.978986025 CET	46368	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:07.099462986 CET	3778	46368	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:07.981547117 CET	46370	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:08.101438046 CET	3778	46370	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:08.101596117 CET	46370	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:08.103585958 CET	46370	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:08.223275900 CET	3778	46370	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:08.223551989 CET	46370	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:08.343439102 CET	3778	46370	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:10.275681973 CET	3778	46370	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:10.275950909 CET	46370	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:10.395945072 CET	3778	46370	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:11.278361082 CET	46372	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:11.398623943 CET	3778	46372	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:11.398888111 CET	46372	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:11.400224924 CET	46372	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:11.520030975 CET	3778	46372	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:11.520217896 CET	46372	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:11.639970064 CET	3778	46372	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:13.633865118 CET	3778	46372	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:13.634089947 CET	46372	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:13.754262924 CET	3778	46372	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:14.635849953 CET	46374	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:14.755964041 CET	3778	46374	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:14.756264925 CET	46374	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:14.757375002 CET	46374	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:14.877307892 CET	3778	46374	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:14.877610922 CET	46374	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:14.997469902 CET	3778	46374	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:16.931164980 CET	3778	46374	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:16.931482077 CET	46374	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:17.051568985 CET	3778	46374	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:17.933423996 CET	46376	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:18.053396940 CET	3778	46376	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:18.053592920 CET	46376	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:18.054794073 CET	46376	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:18.174380064 CET	3778	46376	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:18.174531937 CET	46376	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:18.294397116 CET	3778	46376	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:20.260571957 CET	3778	46376	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:20.260926008 CET	46376	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:20.380773067 CET	3778	46376	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:21.262844086 CET	46378	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:21.382921934 CET	3778	46378	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:21.383274078 CET	46378	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:21.384619951 CET	46378	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:21.504539967 CET	3778	46378	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:21.504770994 CET	46378	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:21.625103951 CET	3778	46378	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:23.556159019 CET	3778	46378	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:23.556500912 CET	46378	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:23.676652908 CET	3778	46378	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:24.558162928 CET	46380	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:24.679510117 CET	3778	46380	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:24.679959059 CET	46380	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:24.680902958 CET	46380	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:24.801285982 CET	3778	46380	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:24.801562071 CET	46380	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:24.921796083 CET	3778	46380	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:26.852816105 CET	3778	46380	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:26.853084087 CET	46380	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:26.973170996 CET	3778	46380	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:27.855223894 CET	46382	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:27.975351095 CET	3778	46382	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:27.975521088 CET	46382	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:27.977577925 CET	46382	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:28.097394943 CET	3778	46382	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:28.097676992 CET	46382	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:28.217601061 CET	3778	46382	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:30.150109053 CET	3778	46382	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:30.150324106 CET	46382	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:30.270649910 CET	3778	46382	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:31.152813911 CET	46384	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:31.274549007 CET	3778	46384	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:31.274936914 CET	46384	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:31.275998116 CET	46384	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:31.396611929 CET	3778	46384	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:31.397026062 CET	46384	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:31.517178059 CET	3778	46384	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:33.446846962 CET	3778	46384	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:33.447300911 CET	46384	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:33.567147017 CET	3778	46384	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:34.449238062 CET	46386	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:34.570344925 CET	3778	46386	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:34.570518017 CET	46386	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:34.571562052 CET	46386	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:34.691781044 CET	3778	46386	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:34.692054033 CET	46386	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:34.812122107 CET	3778	46386	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:36.747179031 CET	3778	46386	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:36.747684956 CET	46386	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:36.867728949 CET	3778	46386	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:37.749115944 CET	46388	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:37.869374037 CET	3778	46388	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:37.869530916 CET	46388	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:37.870918036 CET	46388	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:37.990706921 CET	3778	46388	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:37.991013050 CET	46388	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:38.111524105 CET	3778	46388	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:40.056157112 CET	3778	46388	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:40.056375027 CET	46388	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:40.176294088 CET	3778	46388	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:41.057898045 CET	46390	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:41.177896023 CET	3778	46390	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:41.177997112 CET	46390	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:41.178674936 CET	46390	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:41.298665047 CET	3778	46390	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:41.298779964 CET	46390	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:41.418698072 CET	3778	46390	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:43.353090048 CET	3778	46390	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:43.353262901 CET	46390	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:43.473139048 CET	3778	46390	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:44.355134964 CET	46392	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:44.477653980 CET	3778	46392	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:44.477893114 CET	46392	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:44.479231119 CET	46392	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:44.599443913 CET	3778	46392	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:44.599694014 CET	46392	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:44.719779015 CET	3778	46392	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:46.650274038 CET	3778	46392	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:46.650779963 CET	46392	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:46.770823956 CET	3778	46392	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:47.652394056 CET	46394	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:47.772665024 CET	3778	46394	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:47.772794962 CET	46394	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:47.774034977 CET	46394	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:47.893696070 CET	3778	46394	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:47.893961906 CET	46394	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:48.016616106 CET	3778	46394	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:49.947134972 CET	3778	46394	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:49.947679043 CET	46394	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:50.068238020 CET	3778	46394	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:50.949848890 CET	46396	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:51.070091009 CET	3778	46396	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:51.070213079 CET	46396	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:51.071466923 CET	46396	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:51.191579103 CET	3778	46396	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:51.191822052 CET	46396	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:51.312001944 CET	3778	46396	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:53.243830919 CET	3778	46396	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:53.244249105 CET	46396	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:53.364466906 CET	3778	46396	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:54.246550083 CET	46398	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:54.366661072 CET	3778	46398	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:54.366811991 CET	46398	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:54.368318081 CET	46398	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:54.488555908 CET	3778	46398	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:54.488671064 CET	46398	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:54.608588934 CET	3778	46398	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:56.603610992 CET	3778	46398	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:56.603967905 CET	46398	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:56.724013090 CET	3778	46398	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:57.606122017 CET	46400	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:57.726427078 CET	3778	46400	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:57.726893902 CET	46400	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:57.728168011 CET	46400	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:57.849030018 CET	3778	46400	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:57.849395037 CET	46400	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:18:57.969434023 CET	3778	46400	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:59.900460958 CET	3778	46400	178.215.238.74	192.168.2.23
Dec 20, 2024 23:18:59.900949955 CET	46400	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:00.021234989 CET	3778	46400	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:00.902895927 CET	46402	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:01.023139954 CET	3778	46402	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:01.023332119 CET	46402	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:01.024544954 CET	46402	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:01.144645929 CET	3778	46402	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:01.145131111 CET	46402	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:01.265146017 CET	3778	46402	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:03.213227034 CET	3778	46402	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:03.213521004 CET	46402	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:03.333748102 CET	3778	46402	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:04.215689898 CET	46404	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:04.335948944 CET	3778	46404	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:04.336026907 CET	46404	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:04.337023973 CET	46404	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:04.456794024 CET	3778	46404	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:04.457005024 CET	46404	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:04.576992035 CET	3778	46404	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:06.509696007 CET	3778	46404	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:06.509959936 CET	46404	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:06.629945993 CET	3778	46404	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:07.512123108 CET	46406	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:07.631922007 CET	3778	46406	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:07.632066965 CET	46406	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:07.633354902 CET	46406	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:07.752933025 CET	3778	46406	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:07.753087044 CET	46406	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:07.872800112 CET	3778	46406	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:09.806967020 CET	3778	46406	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:09.807121038 CET	46406	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:09.927064896 CET	3778	46406	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:10.809042931 CET	46408	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:10.929358006 CET	3778	46408	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:10.929583073 CET	46408	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:10.930480003 CET	46408	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:11.050354958 CET	3778	46408	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:11.050622940 CET	46408	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:11.170865059 CET	3778	46408	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:13.104188919 CET	3778	46408	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:13.104381084 CET	46408	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:13.224371910 CET	3778	46408	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:14.106955051 CET	46410	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:14.227422953 CET	3778	46410	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:14.227622986 CET	46410	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:14.228682995 CET	46410	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:14.348671913 CET	3778	46410	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:14.348958969 CET	46410	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:14.469372034 CET	3778	46410	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:16.401102066 CET	3778	46410	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:16.401416063 CET	46410	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:16.521822929 CET	3778	46410	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:17.403328896 CET	46412	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:17.523828983 CET	3778	46412	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:17.524002075 CET	46412	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:17.525134087 CET	46412	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:17.645308971 CET	3778	46412	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:17.645390987 CET	46412	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:17.765506983 CET	3778	46412	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:19.697968960 CET	3778	46412	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:19.698290110 CET	46412	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:19.818109035 CET	3778	46412	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:20.700184107 CET	46414	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:20.820167065 CET	3778	46414	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:20.820322990 CET	46414	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:20.821448088 CET	46414	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:20.941050053 CET	3778	46414	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:20.941272974 CET	46414	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:21.061245918 CET	3778	46414	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:22.994539976 CET	3778	46414	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:22.994935989 CET	46414	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:23.114830971 CET	3778	46414	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:23.996752024 CET	46416	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:24.116472960 CET	3778	46416	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:24.116700888 CET	46416	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:24.117917061 CET	46416	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:24.237497091 CET	3778	46416	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:24.237683058 CET	46416	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:24.357203960 CET	3778	46416	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:26.291229010 CET	3778	46416	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:26.291332960 CET	46416	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:26.411648989 CET	3778	46416	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:27.293407917 CET	46418	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:27.413427114 CET	3778	46418	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:27.413513899 CET	46418	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:27.415327072 CET	46418	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:27.535546064 CET	3778	46418	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:27.535717964 CET	46418	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:27.655899048 CET	3778	46418	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:29.604079008 CET	3778	46418	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:29.604314089 CET	46418	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:29.724380016 CET	3778	46418	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:30.605752945 CET	46420	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:30.725724936 CET	3778	46420	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:30.726106882 CET	46420	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:30.726809025 CET	46420	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:30.846774101 CET	3778	46420	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:30.846972942 CET	46420	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:30.967103004 CET	3778	46420	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:32.900774002 CET	3778	46420	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:32.901194096 CET	46420	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:33.021291971 CET	3778	46420	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:33.902661085 CET	46422	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:34.022747993 CET	3778	46422	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:34.022830009 CET	46422	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:34.023746967 CET	46422	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:34.143552065 CET	3778	46422	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:34.143757105 CET	46422	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:34.263946056 CET	3778	46422	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:36.229085922 CET	3778	46422	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:36.229207039 CET	46422	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:36.349112034 CET	3778	46422	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:37.230748892 CET	46424	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:37.350949049 CET	3778	46424	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:37.351233959 CET	46424	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:37.352041960 CET	46424	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:37.471915960 CET	3778	46424	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:37.472007036 CET	46424	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:37.591932058 CET	3778	46424	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:39.527894020 CET	3778	46424	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:39.528431892 CET	46424	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:39.648494959 CET	3778	46424	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:40.530457020 CET	46426	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:40.650651932 CET	3778	46426	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:40.650793076 CET	46426	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:40.651763916 CET	46426	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:40.771826982 CET	3778	46426	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:40.772325993 CET	46426	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:40.892447948 CET	3778	46426	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:42.823916912 CET	3778	46426	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:42.824132919 CET	46426	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:42.944118977 CET	3778	46426	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:43.826076984 CET	46428	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:43.946234941 CET	3778	46428	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:43.946542978 CET	46428	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:43.948272943 CET	46428	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:44.068253994 CET	3778	46428	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:44.068459034 CET	46428	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:44.188441038 CET	3778	46428	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:46.136666059 CET	3778	46428	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:46.137463093 CET	46428	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:46.257579088 CET	3778	46428	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:47.140094995 CET	46430	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:47.260338068 CET	3778	46430	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:47.260693073 CET	46430	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:47.262052059 CET	46430	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:47.382019043 CET	3778	46430	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:47.382392883 CET	46430	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:47.502306938 CET	3778	46430	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:49.433682919 CET	3778	46430	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:49.434011936 CET	46430	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:49.554032087 CET	3778	46430	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:50.436424017 CET	46432	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:50.556659937 CET	3778	46432	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:50.556839943 CET	46432	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:50.558202982 CET	46432	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:50.678015947 CET	3778	46432	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:50.678215027 CET	46432	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:50.797993898 CET	3778	46432	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:52.729258060 CET	3778	46432	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:52.729396105 CET	46432	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:52.849293947 CET	3778	46432	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:53.731029034 CET	46434	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:53.851032019 CET	3778	46434	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:53.851198912 CET	46434	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:53.852664948 CET	46434	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:53.972800016 CET	3778	46434	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:53.972929955 CET	46434	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:54.093101978 CET	3778	46434	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:56.026457071 CET	3778	46434	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:56.026644945 CET	46434	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:56.146644115 CET	3778	46434	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:57.028717995 CET	46436	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:57.149173021 CET	3778	46436	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:57.149343014 CET	46436	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:57.150631905 CET	46436	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:57.270600080 CET	3778	46436	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:57.270893097 CET	46436	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:57.391001940 CET	3778	46436	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:59.324528933 CET	3778	46436	178.215.238.74	192.168.2.23
Dec 20, 2024 23:19:59.324876070 CET	46436	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:19:59.445235968 CET	3778	46436	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:00.326674938 CET	46438	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:00.447084904 CET	3778	46438	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:00.447263956 CET	46438	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:00.448252916 CET	46438	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:00.568164110 CET	3778	46438	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:00.568444014 CET	46438	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:00.688539028 CET	3778	46438	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:02.620353937 CET	3778	46438	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:02.620819092 CET	46438	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:02.741122961 CET	3778	46438	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:03.622812033 CET	46440	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:03.742897034 CET	3778	46440	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:03.743094921 CET	46440	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:03.744291067 CET	46440	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:03.864005089 CET	3778	46440	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:03.864223957 CET	46440	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:03.984416962 CET	3778	46440	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:05.917510033 CET	3778	46440	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:05.917967081 CET	46440	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:06.037899971 CET	3778	46440	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:06.920089960 CET	46442	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:07.040158033 CET	3778	46442	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:07.040321112 CET	46442	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:07.041657925 CET	46442	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:07.161631107 CET	3778	46442	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:07.161726952 CET	46442	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:07.281626940 CET	3778	46442	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:09.245378017 CET	3778	46442	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:09.245572090 CET	46442	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:09.365549088 CET	3778	46442	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:10.248012066 CET	46444	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:10.368356943 CET	3778	46444	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:10.368616104 CET	46444	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:10.370709896 CET	46444	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:10.490458012 CET	3778	46444	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:10.490650892 CET	46444	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:10.610336065 CET	3778	46444	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:12.541943073 CET	3778	46444	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:12.542131901 CET	46444	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:12.661961079 CET	3778	46444	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:13.544878960 CET	46446	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:13.664752007 CET	3778	46446	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:13.664977074 CET	46446	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:13.665632963 CET	46446	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:13.785410881 CET	3778	46446	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:13.785667896 CET	46446	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:13.907711983 CET	3778	46446	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:15.854609013 CET	3778	46446	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:15.854753017 CET	46446	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:15.974596024 CET	3778	46446	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:16.856249094 CET	46448	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:16.976372957 CET	3778	46448	178.215.238.74	192.168.2.23
Dec 20, 2024 23:20:16.976455927 CET	46448	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:16.977521896 CET	46448	3778	192.168.2.23	178.215.238.74
Dec 20, 2024 23:20:17.097618103 CET	3778	46448	178.215.238.74	192.168.2.23

System Behavior

Analysis Process: boatnet.m68k.elf PID: 6261, Parent PID: 6184

General

Start time (UTC):	22:16:41
Start date (UTC):	20/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	/tmp/boatnet.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 6263, Parent PID: 6261

General

Start time (UTC):	22:16:41
Start date (UTC):	20/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 6264, Parent PID: 6261

General

Start time (UTC):	22:16:41
Start date (UTC):	20/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 6266, Parent PID: 6261

General

Start time (UTC):	22:16:41
Start date (UTC):	20/12/2024
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: xfce4-panel PID: 6273, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6273, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6274, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6274, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6275, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6275, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6276, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6276, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6291, Parent PID: 6276

General

Start time (UTC):	22:16:51
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 6291, Parent PID: 6276

General

Start time (UTC):	22:16:51
Start date (UTC):	20/12/2024
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Chronological Activities

Analysis Process: xfce4-panel PID: 6277, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6277, Parent PID: 2063

General

Start time (UTC):	22:16:46
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6278, Parent PID: 2063

General

Start time (UTC):	22:16:47
Start date (UTC):	20/12/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6278, Parent PID: 2063

General

Start time (UTC):	22:16:47
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: dbus-daemon PID: 6290, Parent PID: 6289

General

Start time (UTC):	22:16:51
Start date (UTC):	20/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 6290, Parent PID: 6289

General

Start time (UTC):	22:16:51
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: systemd PID: 6297, Parent PID: 1860

General

Start time (UTC):	22:16:53
Start date (UTC):	20/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: xfce4-notifyd PID: 6297, Parent PID: 1860

General

Start time (UTC):	22:16:53
Start date (UTC):	20/12/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report boatnet.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: boatnet.m68k.elf PID: 6261, Parent PID: 6184

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 6263, Parent PID: 6261

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 6264, Parent PID: 6261

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 6266, Parent PID: 6261

General

Chronological Activities

Analysis Process: xfce4-panel PID: 6273, Parent PID: 2063

General

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6273, Parent PID: 2063

General

Chronological Activities

Analysis Process: xfce4-panel PID: 6274, Parent PID: 2063

Linux Analysis Report
boatnet.m68k.elf