Edit tour

Linux Analysis Report
wind.m68k.elf

Overview

General Information

Sample name:	wind.m68k.elf
Analysis ID:	1584694
MD5:	57223a70e1e592ef5459a4490b94b7e4
SHA1:	cd50e82f2b209fbc778341f96c23cf7095514006
SHA256:	568b01ecf9436a963df2d7d9bc307606ec29edfbbdec7aea75a23d17d3415106
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584694
Start date and time:	2025-01-06 08:21:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wind.m68k.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/1@2/0

Runtime Messages

Command:	/tmp/wind.m68k.elf
PID:	5827
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

wind.m68k.elf (PID: 5827, Parent: 5753, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/wind.m68k.elf

wind.m68k.elf New Fork (PID: 5829, Parent: 5827)

wind.m68k.elf New Fork (PID: 5830, Parent: 5827)

wind.m68k.elf New Fork (PID: 5831, Parent: 5827)

xfce4-panel New Fork (PID: 5839, Parent: 3235)

wrapper-2.0 (PID: 5839, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5840, Parent: 3235)

wrapper-2.0 (PID: 5840, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5841, Parent: 3235)

wrapper-2.0 (PID: 5841, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5842, Parent: 3235)

wrapper-2.0 (PID: 5842, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5861, Parent: 5842)

xfpm-power-backlight-helper (PID: 5861, Parent: 5842, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5843, Parent: 3235)

wrapper-2.0 (PID: 5843, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5844, Parent: 3235)

wrapper-2.0 (PID: 5844, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5860, Parent: 5859)

xfconfd (PID: 5860, Parent: 5859, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5869, Parent: 3044)

xfce4-notifyd (PID: 5869, Parent: 3044, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wind.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wind.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe60f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe623:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe637:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe64b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe673:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe687:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe69b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe713:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe727:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe73b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe763:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe777:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe78b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
wind.m68k.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeb60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5830.1.00007fe814001000.00007fe814011000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5830.1.00007fe814001000.00007fe814011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe60f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe623:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe637:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe64b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe673:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe687:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe69b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe713:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe727:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe73b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe763:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe777:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe78b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5830.1.00007fe814001000.00007fe814011000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeb60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5827.1.00007fe814001000.00007fe814011000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5827.1.00007fe814001000.00007fe814011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe60f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe623:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe637:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe64b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe673:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe687:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe69b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe713:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe727:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe73b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe763:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe777:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe78b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5827.1.00007fe814001000.00007fe814011000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeb60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: wind.m68k.elf PID: 5830	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: wind.m68k.elf PID: 5830	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wind.m68k.elf PID: 5830	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wind.m68k.elf PID: 5830	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1489:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 5 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wind.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: wind.m68k.elf	Virustotal: Detection: 63%			Perma Link
Source: wind.m68k.elf	ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.15:37204 -> 154.216.17.34:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.34

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5830.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5830.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5827.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5827.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wind.m68k.elf PID: 5830, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wind.m68k.elf PID: 5830, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3298, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5840, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5841, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5842, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5844, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5860, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5869, result: successful	Jump to behavior

Source: xfce4-panel.xml.new.29.dr

OLE indicator, VBA macros: true

Source: xfce4-panel.xml.new.29.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 3298, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5840, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5841, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5842, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5844, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5860, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	SIGKILL sent: pid: 5869, result: successful	Jump to behavior

Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5830.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5830.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5827.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5827.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wind.m68k.elf PID: 5830, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wind.m68k.elf PID: 5830, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/1@2/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5839)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5860)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5860)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5860)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5860)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5869)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5869)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5869)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5869)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1185/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3241/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3483/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1732/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1730/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3234/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5775/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/515/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5810/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1617/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1615/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5670/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3255/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3253/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3252/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3251/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3250/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3249/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/764/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3368/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3488/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/766/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1509/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3800/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1867/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5840/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1514/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1634/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5839/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3379/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/779/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5831/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5970/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3275/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3274/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3273/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3394/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3272/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3948/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1762/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3027/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5841/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5842/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5843/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5844/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5860/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/5983/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1660/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3316/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/796/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/675/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/676/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1498/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1497/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/1496/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3157/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3278/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3399/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3797/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3798/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5829)	File opened: /proc/3799/cmdline	Jump to behavior

Source: /tmp/wind.m68k.elf (PID: 5827)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5839)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5840)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5841)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5842)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5843)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5844)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5869)	Queries kernel information via 'uname':	Jump to behavior

Source: wind.m68k.elf, 5827.1.00007fff728a4000.00007fff728c5000.rw-.sdmp, wind.m68k.elf, 5830.1.00007fff728a4000.00007fff728c5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/wind.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wind.m68k.elf
Source: wind.m68k.elf, 5827.1.000055c0be66f000.000055c0be6f4000.rw-.sdmp, wind.m68k.elf, 5830.1.000055c0be66f000.000055c0be6f4000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: wind.m68k.elf, 5827.1.00007fff728a4000.00007fff728c5000.rw-.sdmp, wind.m68k.elf, 5830.1.00007fff728a4000.00007fff728c5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: wind.m68k.elf, 5827.1.000055c0be66f000.000055c0be6f4000.rw-.sdmp, wind.m68k.elf, 5830.1.000055c0be66f000.000055c0be6f4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: wind.m68k.elf PID: 5830, type: MEMORYSTR
Source: Yara match	File source: wind.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5830.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5827.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: wind.m68k.elf PID: 5830, type: MEMORYSTR
Source: Yara match	File source: wind.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5830.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5827.1.00007fe814001000.00007fe814011000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wind.m68k.elf	63%	Virustotal		Browse
wind.m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
wind.m68k.elf	100%	Avira	EXP/ELF.Gafgyt.Z.F

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.17.34	unknown	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.216.17.34	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWorm	Browse	154.216.17.34/XC.exe
154.216.17.34	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	154.216.17.34/configuredInstallerEXE.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	wind.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wind.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wind.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wind.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	wind.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	147.45.124.49-boatnet.ppc-2025-01-06T05_00_23.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	wind.sh4.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.spc.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.arm.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.mips.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.ppc.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.x86.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	arm7.elf	Get hash	malicious	Mirai	Browse	154.216.17.162
	jaTDEkWCbs.exe	Get hash	malicious	Quasar	Browse	154.216.19.144
	z0r0.i686.elf	Get hash	malicious	Mirai	Browse	156.230.19.138

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Download File

Process:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5128
Entropy (8bit):	4.457618060812407
Encrypted:	false
SSDEEP:	96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
MD5:	2A2A7C34B585CDAE5E123F3C5100C253
SHA1:	E814B1B1531B25581DB76CB813C85E53E1390BA4
SHA-256:	BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
SHA-512:	CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.358664788334039
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wind.m68k.elf
File size:	65'068 bytes
MD5:	57223a70e1e592ef5459a4490b94b7e4
SHA1:	cd50e82f2b209fbc778341f96c23cf7095514006
SHA256:	568b01ecf9436a963df2d7d9bc307606ec29edfbbdec7aea75a23d17d3415106
SHA512:	feea854972edade0ba4e9998d2fc47dcd70cf4aac94553f7a88bca2420458f0143ab912df4279f2c02182960040c2e08619ba74d2da4331dde251efc117ff3c2
SSDEEP:	1536:LO76X79SYAcOQRrlRTNXUjRvQQxwLyd2yU8E6MAU/8X9VyBEB:6rYAcOQRrlRTNXUjRvQQmLK19MA9oBQ
TLSH:	2E532B99B8029E3CF90B9ABA94164E0ABD2177C152830F27677BFDD37C721A59D03C85
File Content Preview:	.ELF.......................D...4.........4. ...(.......................0...0...... ........4...4...4...(.......... .dt.Q............................NV..a....da.....N^NuNV..J9...\f>"y...L QJ.g.X.#....LN."y...L QJ.f.A.....J.g.Hy...0N.X........\N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	64668
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xe502	0x0	0x6	AX	4
.fini	PROGBITS	0x8000e5aa	0xe5aa	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000e5b8	0xe5b8	0x1478	0x0	0x2	A	2
.ctors	PROGBITS	0x80011a34	0xfa34	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80011a3c	0xfa3c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80011a48	0xfa48	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x80011c5c	0xfc5c	0x2e8	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xfc5c	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0xfa30	0xfa30	6.3894	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0xfa34	0x80011a34	0x80011a34	0x228	0x510	3.0689	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 08:22:18.723465919 CET	37204	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:18.728319883 CET	3778	37204	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:18.728369951 CET	37204	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:18.730478048 CET	37204	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:18.735258102 CET	3778	37204	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:18.735307932 CET	37204	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:18.740040064 CET	3778	37204	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:21.237796068 CET	3778	37204	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:21.237822056 CET	3778	37204	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:21.237835884 CET	3778	37204	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:21.237943888 CET	37204	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:21.237945080 CET	37204	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:21.238115072 CET	37204	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:21.242889881 CET	3778	37204	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:22.239748001 CET	37206	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:22.244654894 CET	3778	37206	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:22.244723082 CET	37206	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:22.245312929 CET	37206	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:22.250081062 CET	3778	37206	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:22.250123978 CET	37206	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:22.254925013 CET	3778	37206	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:24.030718088 CET	3778	37206	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:24.030818939 CET	37206	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:24.035682917 CET	3778	37206	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:25.122175932 CET	37208	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:25.127104998 CET	3778	37208	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:25.127165079 CET	37208	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:25.134152889 CET	37208	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:25.138978958 CET	3778	37208	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:25.139041901 CET	37208	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:25.143824100 CET	3778	37208	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:26.936043978 CET	3778	37208	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:26.936132908 CET	37208	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:26.940960884 CET	3778	37208	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:27.946976900 CET	37210	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:27.951936007 CET	3778	37210	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:27.952008963 CET	37210	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:27.959367990 CET	37210	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:27.964189053 CET	3778	37210	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:27.964250088 CET	37210	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:27.968986034 CET	3778	37210	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:29.697132111 CET	3778	37210	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:29.697254896 CET	37210	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:29.702080965 CET	3778	37210	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:30.707716942 CET	37212	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:30.712580919 CET	3778	37212	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:30.712652922 CET	37212	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:30.720161915 CET	37212	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:30.724967003 CET	3778	37212	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:30.725013018 CET	37212	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:30.729870081 CET	3778	37212	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:32.506573915 CET	3778	37212	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:32.506671906 CET	37212	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:32.512667894 CET	3778	37212	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:33.513295889 CET	37214	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:33.518171072 CET	3778	37214	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:33.518253088 CET	37214	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:33.523132086 CET	37214	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:33.527878046 CET	3778	37214	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:33.527928114 CET	37214	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:33.532690048 CET	3778	37214	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:35.336977005 CET	3778	37214	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:35.337081909 CET	37214	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:35.342236042 CET	3778	37214	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:36.344280005 CET	37216	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:36.349107027 CET	3778	37216	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:36.349173069 CET	37216	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:36.354696989 CET	37216	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:36.359503984 CET	3778	37216	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:36.359602928 CET	37216	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:36.364360094 CET	3778	37216	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:38.177014112 CET	3778	37216	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:38.177181005 CET	37216	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:38.181991100 CET	3778	37216	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:39.178675890 CET	37218	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:39.183593035 CET	3778	37218	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:39.183644056 CET	37218	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:39.184262037 CET	37218	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:39.189017057 CET	3778	37218	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:39.189086914 CET	37218	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:39.193900108 CET	3778	37218	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:40.979842901 CET	3778	37218	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:40.979991913 CET	37218	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:40.984838009 CET	3778	37218	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:41.981266022 CET	37220	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:41.987696886 CET	3778	37220	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:41.987802982 CET	37220	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:41.988339901 CET	37220	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:41.993524075 CET	3778	37220	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:41.993586063 CET	37220	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:41.998419046 CET	3778	37220	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:43.806165934 CET	3778	37220	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:43.806332111 CET	37220	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:43.811177015 CET	3778	37220	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:44.807626009 CET	37222	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:44.812876940 CET	3778	37222	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:44.812958002 CET	37222	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:44.813530922 CET	37222	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:44.818330050 CET	3778	37222	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:44.818378925 CET	37222	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:44.823167086 CET	3778	37222	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:46.582997084 CET	3778	37222	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:46.583164930 CET	37222	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:46.588017941 CET	3778	37222	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:47.584611893 CET	37224	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:47.589607000 CET	3778	37224	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:47.589663982 CET	37224	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:47.590264082 CET	37224	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:47.595014095 CET	3778	37224	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:47.595055103 CET	37224	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:47.599847078 CET	3778	37224	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:49.395488977 CET	3778	37224	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:49.395739079 CET	37224	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:49.400511980 CET	3778	37224	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:50.397094011 CET	37226	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:50.401930094 CET	3778	37226	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:50.401984930 CET	37226	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:50.402589083 CET	37226	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:50.407306910 CET	3778	37226	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:50.407356024 CET	37226	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:50.412144899 CET	3778	37226	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:52.194560051 CET	3778	37226	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:52.194798946 CET	37226	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:52.199557066 CET	3778	37226	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:53.196084976 CET	37228	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:53.200967073 CET	3778	37228	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:53.201083899 CET	37228	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:53.201658010 CET	37228	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:53.206511974 CET	3778	37228	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:53.206597090 CET	37228	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:53.211429119 CET	3778	37228	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:55.011255980 CET	3778	37228	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:55.011501074 CET	37228	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:55.016411066 CET	3778	37228	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:56.013112068 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:56.018321037 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:56.018399954 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:56.018951893 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:56.226834059 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:56.434859991 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:56.862759113 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:57.053358078 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:57.053446054 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:57.054296017 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:57.054306984 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:57.054316044 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:57.054326057 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:58.845207930 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:58.845366955 CET	37230	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:58.850157976 CET	3778	37230	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:59.846497059 CET	37232	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:59.851425886 CET	3778	37232	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:59.851476908 CET	37232	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:59.852103949 CET	37232	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:59.856920958 CET	3778	37232	154.216.17.34	192.168.2.15
Jan 6, 2025 08:22:59.856988907 CET	37232	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:22:59.861725092 CET	3778	37232	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:01.635483980 CET	3778	37232	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:01.635628939 CET	37232	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:01.640436888 CET	3778	37232	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:02.637037992 CET	37234	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:02.641998053 CET	3778	37234	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:02.642047882 CET	37234	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:02.642596006 CET	37234	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:02.647367001 CET	3778	37234	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:02.647423983 CET	37234	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:02.652282953 CET	3778	37234	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:04.432099104 CET	3778	37234	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:04.432277918 CET	37234	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:04.437112093 CET	3778	37234	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:05.433491945 CET	37236	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:05.438373089 CET	3778	37236	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:05.438446045 CET	37236	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:05.439029932 CET	37236	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:05.443773031 CET	3778	37236	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:05.443814039 CET	37236	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:05.448564053 CET	3778	37236	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:07.213593960 CET	3778	37236	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:07.213773966 CET	37236	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:07.218668938 CET	3778	37236	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:08.214951038 CET	37238	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:08.219865084 CET	3778	37238	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:08.219949961 CET	37238	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:08.220474958 CET	37238	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:08.225327015 CET	3778	37238	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:08.225379944 CET	37238	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:08.230115891 CET	3778	37238	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:10.037916899 CET	3778	37238	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:10.038191080 CET	37238	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:10.042973995 CET	3778	37238	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:11.039652109 CET	37240	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:11.083244085 CET	3778	37240	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:11.083296061 CET	37240	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:11.083786011 CET	37240	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:11.088577032 CET	3778	37240	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:11.088618040 CET	37240	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:11.093389034 CET	3778	37240	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:12.877294064 CET	3778	37240	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:12.877388000 CET	37240	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:12.882230997 CET	3778	37240	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:13.878240108 CET	37242	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:13.883192062 CET	3778	37242	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:13.883263111 CET	37242	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:13.884047985 CET	37242	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:13.888874054 CET	3778	37242	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:13.888915062 CET	37242	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:13.893767118 CET	3778	37242	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:15.678092957 CET	3778	37242	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:15.678235054 CET	37242	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:15.683063030 CET	3778	37242	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:16.679373026 CET	37244	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:16.684236050 CET	3778	37244	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:16.684322119 CET	37244	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:16.684776068 CET	37244	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:16.689587116 CET	3778	37244	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:16.689646959 CET	37244	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:16.694456100 CET	3778	37244	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:18.498950005 CET	3778	37244	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:18.499222994 CET	37244	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:18.504060984 CET	3778	37244	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:19.501136065 CET	37246	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:19.506026983 CET	3778	37246	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:19.506114006 CET	37246	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:19.506628036 CET	37246	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:19.511482954 CET	3778	37246	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:19.511555910 CET	37246	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:19.516354084 CET	3778	37246	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:21.309082031 CET	3778	37246	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:21.309539080 CET	37246	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:21.314332008 CET	3778	37246	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:22.311568975 CET	37248	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:22.316473961 CET	3778	37248	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:22.316531897 CET	37248	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:22.317034006 CET	37248	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:22.321813107 CET	3778	37248	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:22.321861029 CET	37248	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:22.326649904 CET	3778	37248	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:24.117484093 CET	3778	37248	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:24.117945910 CET	37248	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:24.122770071 CET	3778	37248	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:25.119240999 CET	37250	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:25.124072075 CET	3778	37250	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:25.124124050 CET	37250	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:25.124661922 CET	37250	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:25.129422903 CET	3778	37250	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:25.129463911 CET	37250	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:25.134255886 CET	3778	37250	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:26.908220053 CET	3778	37250	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:26.908421993 CET	37250	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:26.913458109 CET	3778	37250	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:27.909979105 CET	37252	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:27.914782047 CET	3778	37252	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:27.914880037 CET	37252	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:27.915364981 CET	37252	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:27.920101881 CET	3778	37252	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:27.920164108 CET	37252	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:27.925254107 CET	3778	37252	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:29.691643000 CET	3778	37252	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:29.691844940 CET	37252	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:29.696655035 CET	3778	37252	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:30.693106890 CET	37254	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:30.698000908 CET	3778	37254	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:30.698108912 CET	37254	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:30.698707104 CET	37254	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:30.703525066 CET	3778	37254	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:30.703583002 CET	37254	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:30.708334923 CET	3778	37254	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:32.492598057 CET	3778	37254	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:32.492779016 CET	37254	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:32.497589111 CET	3778	37254	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:33.494062901 CET	37256	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:33.499010086 CET	3778	37256	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:33.499063015 CET	37256	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:33.499573946 CET	37256	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:33.504340887 CET	3778	37256	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:33.504381895 CET	37256	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:33.509213924 CET	3778	37256	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:35.295283079 CET	3778	37256	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:35.295509100 CET	37256	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:35.300297976 CET	3778	37256	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:36.297272921 CET	37258	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:36.302180052 CET	3778	37258	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:36.302254915 CET	37258	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:36.303145885 CET	37258	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:36.307941914 CET	3778	37258	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:36.307996988 CET	37258	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:36.312804937 CET	3778	37258	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:38.115287066 CET	3778	37258	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:38.115518093 CET	37258	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:38.122477055 CET	3778	37258	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:39.117130041 CET	37260	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:39.121982098 CET	3778	37260	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:39.122050047 CET	37260	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:39.122927904 CET	37260	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:39.127676010 CET	3778	37260	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:39.127723932 CET	37260	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:39.132564068 CET	3778	37260	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:40.907505989 CET	3778	37260	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:40.907664061 CET	37260	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:40.912514925 CET	3778	37260	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:41.908983946 CET	37262	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:41.913765907 CET	3778	37262	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:41.913831949 CET	37262	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:41.914726019 CET	37262	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:41.919502020 CET	3778	37262	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:41.919543982 CET	37262	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:41.924348116 CET	3778	37262	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:43.689763069 CET	3778	37262	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:43.689943075 CET	37262	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:43.698172092 CET	3778	37262	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:44.691133976 CET	37264	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:44.696002960 CET	3778	37264	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:44.696048975 CET	37264	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:44.696547985 CET	37264	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:44.701266050 CET	3778	37264	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:44.701309919 CET	37264	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:44.706120968 CET	3778	37264	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:46.502885103 CET	3778	37264	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:46.503030062 CET	37264	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:46.507858992 CET	3778	37264	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:47.504693985 CET	37266	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:47.509670973 CET	3778	37266	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:47.509742022 CET	37266	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:47.510601044 CET	37266	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:47.515391111 CET	3778	37266	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:47.515454054 CET	37266	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:47.520298004 CET	3778	37266	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:49.317480087 CET	3778	37266	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:49.317636967 CET	37266	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:49.325097084 CET	3778	37266	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:50.319017887 CET	37268	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:50.323883057 CET	3778	37268	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:50.323975086 CET	37268	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:50.324503899 CET	37268	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:50.329287052 CET	3778	37268	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:50.329325914 CET	37268	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:50.334167004 CET	3778	37268	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:52.081445932 CET	3778	37268	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:52.081670046 CET	37268	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:52.086479902 CET	3778	37268	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:53.082772017 CET	37270	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:53.087627888 CET	3778	37270	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:53.087723017 CET	37270	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:53.088193893 CET	37270	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:53.092995882 CET	3778	37270	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:53.093064070 CET	37270	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:53.097834110 CET	3778	37270	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:54.897200108 CET	3778	37270	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:54.897346020 CET	37270	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:54.902120113 CET	3778	37270	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:55.898591042 CET	37272	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:55.903456926 CET	3778	37272	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:55.903501987 CET	37272	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:55.904064894 CET	37272	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:55.908875942 CET	3778	37272	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:55.908914089 CET	37272	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:55.913703918 CET	3778	37272	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:57.685853004 CET	3778	37272	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:57.686060905 CET	37272	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:57.690855980 CET	3778	37272	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:58.687274933 CET	37274	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:58.692116022 CET	3778	37274	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:58.692163944 CET	37274	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:58.692683935 CET	37274	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:58.697500944 CET	3778	37274	154.216.17.34	192.168.2.15
Jan 6, 2025 08:23:58.697546959 CET	37274	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:23:58.702339888 CET	3778	37274	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:00.505223989 CET	3778	37274	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:00.505434990 CET	37274	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:00.510255098 CET	3778	37274	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:01.507209063 CET	37276	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:01.512128115 CET	3778	37276	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:01.512233019 CET	37276	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:01.513128996 CET	37276	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:01.517882109 CET	3778	37276	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:01.517944098 CET	37276	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:01.522763014 CET	3778	37276	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:03.295401096 CET	3778	37276	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:03.295620918 CET	37276	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:03.300424099 CET	3778	37276	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:04.296797991 CET	37278	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:04.301704884 CET	3778	37278	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:04.301841021 CET	37278	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:04.302321911 CET	37278	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:04.307137966 CET	3778	37278	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:04.307204962 CET	37278	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:04.312036037 CET	3778	37278	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:06.103554964 CET	3778	37278	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:06.103825092 CET	37278	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:06.108685017 CET	3778	37278	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:07.105036974 CET	37280	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:07.110044956 CET	3778	37280	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:07.110151052 CET	37280	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:07.110681057 CET	37280	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:07.115509987 CET	3778	37280	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:07.115572929 CET	37280	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:07.120444059 CET	3778	37280	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:08.905539989 CET	3778	37280	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:08.905715942 CET	37280	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:08.910501003 CET	3778	37280	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:09.907123089 CET	37282	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:09.912067890 CET	3778	37282	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:09.912132025 CET	37282	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:09.912667036 CET	37282	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:09.917453051 CET	3778	37282	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:09.917493105 CET	37282	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:09.922313929 CET	3778	37282	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:11.895112038 CET	3778	37282	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:11.895400047 CET	37282	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:11.900244951 CET	3778	37282	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:12.896862030 CET	37284	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:12.901763916 CET	3778	37284	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:12.901813984 CET	37284	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:12.902436018 CET	37284	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:12.907223940 CET	3778	37284	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:12.907289028 CET	37284	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:12.912100077 CET	3778	37284	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:14.668585062 CET	3778	37284	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:14.668773890 CET	37284	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:14.668773890 CET	37284	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:14.673572063 CET	3778	37284	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:15.669930935 CET	37286	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:15.674890041 CET	3778	37286	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:15.674968004 CET	37286	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:15.675879955 CET	37286	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:15.680716991 CET	3778	37286	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:15.680782080 CET	37286	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:15.685586929 CET	3778	37286	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:17.459669113 CET	3778	37286	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:17.459913015 CET	37286	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:17.464776039 CET	3778	37286	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:18.461885929 CET	37288	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:18.466794968 CET	3778	37288	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:18.466917038 CET	37288	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:18.467840910 CET	37288	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:18.472595930 CET	3778	37288	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:18.472671986 CET	37288	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:18.477382898 CET	3778	37288	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:20.269206047 CET	3778	37288	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:20.269437075 CET	37288	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:20.274236917 CET	3778	37288	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:21.271087885 CET	37290	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:21.279664040 CET	3778	37290	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:21.279779911 CET	37290	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:21.280436039 CET	37290	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:21.285181999 CET	3778	37290	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:21.285254955 CET	37290	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:21.292258024 CET	3778	37290	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:23.056847095 CET	3778	37290	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:23.057075024 CET	37290	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:23.061835051 CET	3778	37290	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:24.059181929 CET	37292	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:24.064133883 CET	3778	37292	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:24.064233065 CET	37292	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:24.065319061 CET	37292	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:24.070087910 CET	3778	37292	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:24.070178986 CET	37292	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:24.074969053 CET	3778	37292	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:25.877976894 CET	3778	37292	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:25.878500938 CET	37292	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:25.883346081 CET	3778	37292	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:26.881091118 CET	37294	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:26.886394024 CET	3778	37294	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:26.886481047 CET	37294	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:26.887351990 CET	37294	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:26.892172098 CET	3778	37294	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:26.892231941 CET	37294	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:26.897011042 CET	3778	37294	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:28.694103003 CET	3778	37294	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:28.694505930 CET	37294	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:28.699348927 CET	3778	37294	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:29.696460009 CET	37296	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:29.701339960 CET	3778	37296	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:29.701412916 CET	37296	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:29.702358961 CET	37296	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:29.707099915 CET	3778	37296	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:29.707165956 CET	37296	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:29.711977005 CET	3778	37296	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:31.486234903 CET	3778	37296	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:31.486373901 CET	37296	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:31.491254091 CET	3778	37296	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:32.488513947 CET	37298	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:32.493441105 CET	3778	37298	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:32.493501902 CET	37298	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:32.494340897 CET	37298	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:32.499131918 CET	3778	37298	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:32.499176025 CET	37298	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:32.504004955 CET	3778	37298	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:34.285923004 CET	3778	37298	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:34.286055088 CET	37298	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:34.290899038 CET	3778	37298	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:35.287370920 CET	37300	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:35.292273045 CET	3778	37300	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:35.292334080 CET	37300	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:35.293021917 CET	37300	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:35.297769070 CET	3778	37300	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:35.297816038 CET	37300	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:35.302655935 CET	3778	37300	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:37.120361090 CET	3778	37300	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:37.120491982 CET	37300	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:37.125330925 CET	3778	37300	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:38.121774912 CET	37302	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:38.126773119 CET	3778	37302	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:38.126831055 CET	37302	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:38.127481937 CET	37302	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:38.132261038 CET	3778	37302	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:38.132302046 CET	37302	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:38.137137890 CET	3778	37302	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:39.937659979 CET	3778	37302	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:39.937868118 CET	37302	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:39.942696095 CET	3778	37302	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:40.939574957 CET	37304	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:40.944598913 CET	3778	37304	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:40.944693089 CET	37304	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:40.945388079 CET	37304	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:40.950452089 CET	3778	37304	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:40.950553894 CET	37304	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:40.955758095 CET	3778	37304	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:42.745762110 CET	3778	37304	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:42.746113062 CET	37304	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:42.751036882 CET	3778	37304	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:43.748078108 CET	37306	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:43.753038883 CET	3778	37306	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:43.753144979 CET	37306	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:43.754272938 CET	37306	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:43.759052038 CET	3778	37306	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:43.759109974 CET	37306	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:43.763942957 CET	3778	37306	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:45.533962965 CET	3778	37306	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:45.534250975 CET	37306	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:45.539196014 CET	3778	37306	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:46.536439896 CET	37308	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:46.542079926 CET	3778	37308	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:46.542148113 CET	37308	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:46.543040037 CET	37308	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:46.548737049 CET	3778	37308	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:46.548798084 CET	37308	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:46.554322004 CET	3778	37308	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:48.302122116 CET	3778	37308	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:48.302561998 CET	37308	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:48.307331085 CET	3778	37308	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:49.304254055 CET	37310	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:49.309042931 CET	3778	37310	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:49.309094906 CET	37310	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:49.309967041 CET	37310	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:49.314682961 CET	3778	37310	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:49.314723015 CET	37310	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:49.319505930 CET	3778	37310	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:51.129029036 CET	3778	37310	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:51.129518032 CET	37310	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:51.134319067 CET	3778	37310	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:52.131644011 CET	37312	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:52.136540890 CET	3778	37312	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:52.136760950 CET	37312	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:52.137558937 CET	37312	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:52.142293930 CET	3778	37312	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:52.142352104 CET	37312	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:52.147169113 CET	3778	37312	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:53.931565046 CET	3778	37312	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:53.932089090 CET	37312	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:53.936913013 CET	3778	37312	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:54.934251070 CET	37314	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:54.939136028 CET	3778	37314	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:54.939188957 CET	37314	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:54.939827919 CET	37314	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:54.944650888 CET	3778	37314	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:54.944693089 CET	37314	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:54.949429035 CET	3778	37314	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:56.762916088 CET	3778	37314	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:56.763288021 CET	37314	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:56.768141031 CET	3778	37314	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:57.765394926 CET	37316	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:57.770370960 CET	3778	37316	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:57.770430088 CET	37316	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:57.771331072 CET	37316	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:57.776091099 CET	3778	37316	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:57.776140928 CET	37316	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:57.780915022 CET	3778	37316	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:59.546120882 CET	3778	37316	154.216.17.34	192.168.2.15
Jan 6, 2025 08:24:59.546490908 CET	37316	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:24:59.551386118 CET	3778	37316	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:00.548554897 CET	37318	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:00.553522110 CET	3778	37318	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:00.553591013 CET	37318	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:00.554522991 CET	37318	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:00.559350967 CET	3778	37318	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:00.559412956 CET	37318	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:00.564271927 CET	3778	37318	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:02.436944008 CET	3778	37318	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:02.437536001 CET	37318	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:02.442357063 CET	3778	37318	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:03.440030098 CET	37320	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:03.445076942 CET	3778	37320	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:03.445142984 CET	37320	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:03.445969105 CET	37320	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:03.450741053 CET	3778	37320	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:03.450809956 CET	37320	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:03.455681086 CET	3778	37320	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:05.238389969 CET	3778	37320	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:05.238493919 CET	37320	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:05.243391991 CET	3778	37320	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:06.241349936 CET	37322	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:06.247025967 CET	3778	37322	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:06.247112989 CET	37322	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:06.247901917 CET	37322	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:06.253492117 CET	3778	37322	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:06.253541946 CET	37322	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:06.259090900 CET	3778	37322	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:08.035347939 CET	3778	37322	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:08.035684109 CET	37322	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:08.040508032 CET	3778	37322	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:09.037646055 CET	37324	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:09.042638063 CET	3778	37324	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:09.042701960 CET	37324	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:09.043514013 CET	37324	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:09.048329115 CET	3778	37324	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:09.048382044 CET	37324	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:09.053200960 CET	3778	37324	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:10.866492987 CET	3778	37324	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:10.866780043 CET	37324	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:10.871659040 CET	3778	37324	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:11.868607044 CET	37326	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:11.873523951 CET	3778	37326	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:11.873605967 CET	37326	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:11.874425888 CET	37326	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:11.879225016 CET	3778	37326	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:11.879286051 CET	37326	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:11.884223938 CET	3778	37326	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:13.672275066 CET	3778	37326	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:13.672700882 CET	37326	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:13.677589893 CET	3778	37326	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:14.674890041 CET	37328	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:14.679963112 CET	3778	37328	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:14.680058002 CET	37328	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:14.680769920 CET	37328	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:14.685611010 CET	3778	37328	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:14.685689926 CET	37328	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:14.690562010 CET	3778	37328	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:16.463037014 CET	3778	37328	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:16.463429928 CET	37328	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:16.468282938 CET	3778	37328	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:17.466139078 CET	37330	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:17.471116066 CET	3778	37330	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:17.471203089 CET	37330	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:17.472333908 CET	37330	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:17.477133989 CET	3778	37330	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:17.477214098 CET	37330	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:17.482043028 CET	3778	37330	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:19.291696072 CET	3778	37330	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:19.292046070 CET	37330	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:19.296879053 CET	3778	37330	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:20.294364929 CET	37332	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:20.299258947 CET	3778	37332	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:20.299350977 CET	37332	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:20.300493002 CET	37332	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:20.305212021 CET	3778	37332	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:20.305274963 CET	37332	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:20.310040951 CET	3778	37332	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:22.072567940 CET	3778	37332	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:22.072978973 CET	37332	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:22.077888966 CET	3778	37332	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:23.075400114 CET	37334	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:23.080406904 CET	3778	37334	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:23.080502987 CET	37334	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:23.081650972 CET	37334	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:23.086426020 CET	3778	37334	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:23.086473942 CET	37334	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:23.091320038 CET	3778	37334	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:24.900456905 CET	3778	37334	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:24.900722027 CET	37334	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:24.905661106 CET	3778	37334	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:25.902808905 CET	37336	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:25.907699108 CET	3778	37336	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:25.907763004 CET	37336	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:25.908670902 CET	37336	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:25.913469076 CET	3778	37336	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:25.913536072 CET	37336	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:25.918389082 CET	3778	37336	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:27.696588993 CET	3778	37336	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:27.696897030 CET	37336	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:27.701785088 CET	3778	37336	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:28.699305058 CET	37338	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:28.704258919 CET	3778	37338	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:28.704341888 CET	37338	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:28.705487967 CET	37338	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:28.710433960 CET	3778	37338	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:28.710516930 CET	37338	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:28.715833902 CET	3778	37338	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:30.527070999 CET	3778	37338	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:30.527473927 CET	37338	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:30.532279968 CET	3778	37338	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:31.530019045 CET	37340	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:31.534912109 CET	3778	37340	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:31.535007000 CET	37340	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:31.535983086 CET	37340	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:31.540740013 CET	3778	37340	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:31.540803909 CET	37340	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:31.545620918 CET	3778	37340	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:33.334402084 CET	3778	37340	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:33.334702015 CET	37340	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:33.339551926 CET	3778	37340	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:34.337271929 CET	37342	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:34.342242956 CET	3778	37342	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:34.342336893 CET	37342	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:34.343576908 CET	37342	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:34.348326921 CET	3778	37342	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:34.348393917 CET	37342	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:34.353199959 CET	3778	37342	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:36.156649113 CET	3778	37342	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:36.157035112 CET	37342	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:36.161921024 CET	3778	37342	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:37.159722090 CET	37344	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:37.164758921 CET	3778	37344	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:37.164850950 CET	37344	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:37.166129112 CET	37344	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:37.170923948 CET	3778	37344	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:37.170983076 CET	37344	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:37.175823927 CET	3778	37344	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:38.960062027 CET	3778	37344	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:38.960650921 CET	37344	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:38.966142893 CET	3778	37344	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:39.963232040 CET	37346	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:39.968152046 CET	3778	37346	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:39.968236923 CET	37346	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:39.969439983 CET	37346	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:39.974198103 CET	3778	37346	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:39.974257946 CET	37346	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:39.979026079 CET	3778	37346	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:41.768482924 CET	3778	37346	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:41.768676043 CET	37346	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:41.773551941 CET	3778	37346	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:42.771570921 CET	37348	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:42.777658939 CET	3778	37348	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:42.777729988 CET	37348	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:42.778702021 CET	37348	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:42.784578085 CET	3778	37348	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:42.784622908 CET	37348	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:42.790513992 CET	3778	37348	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:44.593220949 CET	3778	37348	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:44.593427896 CET	37348	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:44.598278046 CET	3778	37348	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:45.595480919 CET	37350	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:45.600430965 CET	3778	37350	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:45.600518942 CET	37350	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:45.601548910 CET	37350	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:45.606291056 CET	3778	37350	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:45.606352091 CET	37350	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:45.611120939 CET	3778	37350	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:47.391700029 CET	3778	37350	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:47.391944885 CET	37350	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:47.396826029 CET	3778	37350	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:48.393951893 CET	37352	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:48.398885965 CET	3778	37352	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:48.398942947 CET	37352	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:48.399971962 CET	37352	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:48.404786110 CET	3778	37352	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:48.404831886 CET	37352	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:48.409599066 CET	3778	37352	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:50.193228006 CET	3778	37352	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:50.193517923 CET	37352	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:50.198375940 CET	3778	37352	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:51.195945024 CET	37354	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:51.200861931 CET	3778	37354	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:51.200947046 CET	37354	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:51.202083111 CET	37354	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:51.206893921 CET	3778	37354	154.216.17.34	192.168.2.15
Jan 6, 2025 08:25:51.206955910 CET	37354	3778	192.168.2.15	154.216.17.34
Jan 6, 2025 08:25:51.211736917 CET	3778	37354	154.216.17.34	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 08:25:04.241894960 CET	50340	53	192.168.2.15	1.1.1.1
Jan 6, 2025 08:25:04.241950989 CET	57711	53	192.168.2.15	1.1.1.1
Jan 6, 2025 08:25:04.248783112 CET	53	57711	1.1.1.1	192.168.2.15
Jan 6, 2025 08:25:04.249253035 CET	53	50340	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 08:25:04.241894960 CET	192.168.2.15	1.1.1.1	0x7939	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 6, 2025 08:25:04.241950989 CET	192.168.2.15	1.1.1.1	0xf10	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 08:25:04.249253035 CET	1.1.1.1	192.168.2.15	0x7939	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 6, 2025 08:25:04.249253035 CET	1.1.1.1	192.168.2.15	0x7939	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: wind.m68k.elf PID: 5827, Parent PID: 5753

General

Start time (UTC):	07:22:18
Start date (UTC):	06/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	/tmp/wind.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5829, Parent PID: 5827

General

Start time (UTC):	07:22:18
Start date (UTC):	06/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5830, Parent PID: 5827

General

Start time (UTC):	07:22:18
Start date (UTC):	06/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5831, Parent PID: 5827

General

Start time (UTC):	07:22:18
Start date (UTC):	06/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: xfce4-panel PID: 5839, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5839, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5840, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5840, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5841, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5841, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5842, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5842, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5861, Parent PID: 5842

General

Start time (UTC):	07:22:28
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 5861, Parent PID: 5842

General

Start time (UTC):	07:22:28
Start date (UTC):	06/01/2025
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Chronological Activities

Analysis Process: xfce4-panel PID: 5843, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5843, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5844, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5844, Parent PID: 3235

General

Start time (UTC):	07:22:23
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: dbus-daemon PID: 5860, Parent PID: 5859

General

Start time (UTC):	07:22:28
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 5860, Parent PID: 5859

General

Start time (UTC):	07:22:28
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: systemd PID: 5869, Parent PID: 3044

General

Start time (UTC):	07:22:31
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: xfce4-notifyd PID: 5869, Parent PID: 3044

General

Start time (UTC):	07:22:31
Start date (UTC):	06/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wind.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: wind.m68k.elf PID: 5827, Parent PID: 5753

General

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5829, Parent PID: 5827

General

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5830, Parent PID: 5827

General

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5831, Parent PID: 5827

General

Chronological Activities

Analysis Process: xfce4-panel PID: 5839, Parent PID: 3235

General

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5839, Parent PID: 3235

Linux Analysis Report
wind.m68k.elf