Edit tour

Linux Analysis Report
boatnet.m68k.elf

Overview

General Information

Sample name:	boatnet.m68k.elf
Analysis ID:	1585708
MD5:	11c696082cce841927834214330e47f3
SHA1:	973cb70ee60c31f1e81a4b6bef9b9e7b385120f8
SHA256:	938cfd1f961c22ad76ad2961f05bbde0dcdb64294e520a054a5c9990d8eab6ea
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585708
Start date and time:	2025-01-08 04:40:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	boatnet.m68k.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/1@2/0

Runtime Messages

Command:	/tmp/boatnet.m68k.elf
PID:	5814
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

boatnet.m68k.elf (PID: 5814, Parent: 5739, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/boatnet.m68k.elf

boatnet.m68k.elf New Fork (PID: 5816, Parent: 5814)

boatnet.m68k.elf New Fork (PID: 5818, Parent: 5814)

boatnet.m68k.elf New Fork (PID: 5820, Parent: 5814)

xfce4-panel New Fork (PID: 5825, Parent: 3235)

wrapper-2.0 (PID: 5825, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5826, Parent: 3235)

wrapper-2.0 (PID: 5826, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5827, Parent: 3235)

wrapper-2.0 (PID: 5827, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5828, Parent: 3235)

wrapper-2.0 (PID: 5828, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5848, Parent: 5828)

xfpm-power-backlight-helper (PID: 5848, Parent: 5828, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5829, Parent: 3235)

wrapper-2.0 (PID: 5829, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5830, Parent: 3235)

wrapper-2.0 (PID: 5830, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5847, Parent: 5846)

xfconfd (PID: 5847, Parent: 5846, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5856, Parent: 3044)

xfce4-notifyd (PID: 5856, Parent: 3044, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
boatnet.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
boatnet.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
boatnet.m68k.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5818.1.00007f8040001000.00007f804000f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5818.1.00007f8040001000.00007f804000f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5818.1.00007f8040001000.00007f804000f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5814.1.00007f8040001000.00007f804000f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5814.1.00007f8040001000.00007f804000f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5814.1.00007f8040001000.00007f804000f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.m68k.elf PID: 5814	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.m68k.elf PID: 5814	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x885:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x899:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x94d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x99d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.m68k.elf PID: 5814	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd43:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 4 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: boatnet.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: boatnet.m68k.elf	ReversingLabs: Detection: 65%
Source: boatnet.m68k.elf	Virustotal: Detection: 62%			Perma Link

Source: global traffic

TCP traffic: 192.168.2.15:42286 -> 154.127.56.84:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84
Source: unknown	TCP traffic detected without corresponding DNS query: 154.127.56.84

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5818.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5818.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5814.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5814.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 5814, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.m68k.elf PID: 5814, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3298, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5825, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5826, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5827, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5828, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5829, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5830, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5847, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5856, result: successful	Jump to behavior

Source: xfce4-panel.xml.new.30.dr

OLE indicator, VBA macros: true

Source: xfce4-panel.xml.new.30.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 3298, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5825, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5826, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5827, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5828, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5829, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5830, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5847, result: successful	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	SIGKILL sent: pid: 5856, result: successful	Jump to behavior

Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: boatnet.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5818.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5818.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5814.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5814.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 5814, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.m68k.elf PID: 5814, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/1@2/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5825)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5847)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5847)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5847)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5847)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5856)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5856)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5856)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5856)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1185/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3241/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3483/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1732/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1730/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3234/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/515/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5656/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1617/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1615/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3255/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3253/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3252/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3251/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3250/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5827/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5828/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5829/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3249/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/764/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3368/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3488/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/766/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5820/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1509/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3800/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3801/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5825/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1867/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5826/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1514/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1634/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3379/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5830/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/779/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5799/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3931/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5971/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3275/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3274/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3273/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3394/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3272/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3706/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1762/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3027/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5847/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1660/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3316/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/796/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/675/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/676/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1498/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1497/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/1496/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3157/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3278/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3399/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3798/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/3799/cmdline	Jump to behavior
Source: /tmp/boatnet.m68k.elf (PID: 5816)	File opened: /proc/5856/cmdline	Jump to behavior

Source: /tmp/boatnet.m68k.elf (PID: 5814)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5825)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5826)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5827)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5828)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5829)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5830)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5856)	Queries kernel information via 'uname':	Jump to behavior

Source: boatnet.m68k.elf, 5814.1.00007ffd21147000.00007ffd21168000.rw-.sdmp, boatnet.m68k.elf, 5818.1.00007ffd21147000.00007ffd21168000.rw-.sdmp	Binary or memory string: ux86_64/usr/bin/qemu-m68k/tmp/boatnet.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.m68k.elf
Source: boatnet.m68k.elf, 5814.1.0000564ee0831000.0000564ee08b6000.rw-.sdmp, boatnet.m68k.elf, 5818.1.0000564ee0831000.0000564ee08b6000.rw-.sdmp	Binary or memory string: NV!/etc/qemu-binfmt/m68k
Source: boatnet.m68k.elf, 5814.1.00007ffd21147000.00007ffd21168000.rw-.sdmp, boatnet.m68k.elf, 5818.1.00007ffd21147000.00007ffd21168000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: boatnet.m68k.elf, 5814.1.0000564ee0831000.0000564ee08b6000.rw-.sdmp, boatnet.m68k.elf, 5818.1.0000564ee0831000.0000564ee08b6000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: boatnet.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5818.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5814.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 5814, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: boatnet.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5818.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5814.1.00007f8040001000.00007f804000f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.m68k.elf PID: 5814, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
boatnet.m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
boatnet.m68k.elf	63%	Virustotal		Browse
boatnet.m68k.elf	100%	Avira	EXP/ELF.Gafgyt.D

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.127.56.84	unknown	South Africa		61317	ASDETUKhttpwwwheficedcomGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.127.56.84	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	bin.sh.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASDETUKhttpwwwheficedcomGB	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	154.127.56.84
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	154.127.56.84
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	154.127.56.84
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	154.127.56.84
	https://g248jqtc.r.ap-south-1.awstrack.me/L0/https:%2F%2Ffub.direct%2F1%2Fwpcpz2KV6CJLjr9Ku5V9crqS4vRSbleRYVQVlbRDO0VhTlcqWS8eK4WwWGYEcIFo0NTTfcu_ywSiT_-hMwRGjBfgg1rcvHOcCbgDl1KQiWE%2Fhttps%2Fwestcommerce.com.br%2Fe63i%2F7286520054%2FMackietransportation%2F%23%3Fnl=ZGVhbi5tYWNraWVAbWFja2lldHJhbnNwb3J0YXRpb24uY29t/1/010901943411f671-14b57a2c-4586-496c-a061-2f25bd5eed26-000000/5tAc1I97hb2OTOUlpCX6bWWJ9hY=188	Get hash	malicious	ScreenConnect Tool	Browse	185.143.228.176
	E-Deposit.exe	Get hash	malicious	ScreenConnect Tool	Browse	185.143.228.176
	E-Deposit.exe	Get hash	malicious	ScreenConnect Tool	Browse	185.143.228.176
	armv5l.elf	Get hash	malicious	Unknown	Browse	134.203.202.155
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	191.108.204.217
	Hilix.mpsl.elf	Get hash	malicious	Mirai	Browse	173.239.228.7

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Download File

Process:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5128
Entropy (8bit):	4.457618060812407
Encrypted:	false
SSDEEP:	96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
MD5:	2A2A7C34B585CDAE5E123F3C5100C253
SHA1:	E814B1B1531B25581DB76CB813C85E53E1390BA4
SHA-256:	BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
SHA-512:	CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.255056633354299
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	boatnet.m68k.elf
File size:	54'932 bytes
MD5:	11c696082cce841927834214330e47f3
SHA1:	973cb70ee60c31f1e81a4b6bef9b9e7b385120f8
SHA256:	938cfd1f961c22ad76ad2961f05bbde0dcdb64294e520a054a5c9990d8eab6ea
SHA512:	ab386e5cc405c599f224aaa92c536f4c0f0d32483905731a0abdf57ab018e7f52db95f1bfdba3fd6ff6c5e49cc18d96d224d12d1a2bf50cfed8a9d83f2a6ee97
SSDEEP:	768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGX:r/hqaJMDg9eqK806MHdkfQX6HuCX
TLSH:	37330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85
File Content Preview:	.ELF.......................D...4.........4. ...(.................................. ....................(.......... .dt.Q............................NV..a....da.....N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	54532
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xc12e	0x0	0x6	AX	4
.fini	PROGBITS	0x8000c1d6	0xc1d6	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000c1e4	0xc1e4	0x10b2	0x0	0x2	A	2
.ctors	PROGBITS	0x8000f29c	0xd29c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8000f2a4	0xd2a4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8000f2b0	0xd2b0	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x8000f4c4	0xd4c4	0x2a0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xd4c4	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0xd296	0xd296	6.2906	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0xd29c	0x8000f29c	0x8000f29c	0x228	0x4c8	3.0346	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 04:42:03.423034906 CET	42286	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.427942038 CET	3778	42286	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:03.428002119 CET	42286	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.471002102 CET	42286	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.475759029 CET	3778	42286	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:03.475797892 CET	42286	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.480602026 CET	3778	42286	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:03.908221960 CET	3778	42286	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:03.908493042 CET	42286	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.908541918 CET	42286	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.909035921 CET	42288	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.913815975 CET	3778	42288	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:03.913908958 CET	42288	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.914561033 CET	42288	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.919341087 CET	3778	42288	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:03.919393063 CET	42288	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:03.924145937 CET	3778	42288	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.389852047 CET	3778	42288	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.389971972 CET	42288	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.390064955 CET	42288	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.390446901 CET	42290	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.395241976 CET	3778	42290	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.395330906 CET	42290	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.395970106 CET	42290	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.400757074 CET	3778	42290	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.400823116 CET	42290	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.405631065 CET	3778	42290	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.871144056 CET	3778	42290	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.871330023 CET	42290	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.871330023 CET	42290	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.871831894 CET	42292	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.876666069 CET	3778	42292	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.876760006 CET	42292	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.877513885 CET	42292	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.882355928 CET	3778	42292	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:04.882420063 CET	42292	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:04.887166023 CET	3778	42292	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.363842964 CET	3778	42292	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.364022970 CET	42292	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.364166021 CET	42292	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.364705086 CET	42294	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.369513035 CET	3778	42294	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.369618893 CET	42294	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.370378017 CET	42294	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.375247955 CET	3778	42294	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.375349998 CET	42294	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.380232096 CET	3778	42294	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.847028017 CET	3778	42294	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.847218037 CET	42294	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.847353935 CET	42294	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.847898960 CET	42296	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.852802992 CET	3778	42296	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.852873087 CET	42296	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.853467941 CET	42296	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.858326912 CET	3778	42296	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:05.858392000 CET	42296	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:05.863246918 CET	3778	42296	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.319953918 CET	3778	42296	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.320260048 CET	42296	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.320260048 CET	42296	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.320719957 CET	42298	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.325634956 CET	3778	42298	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.325716972 CET	42298	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.326493025 CET	42298	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.331267118 CET	3778	42298	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.331316948 CET	42298	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.336122036 CET	3778	42298	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.792712927 CET	3778	42298	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.792850971 CET	42298	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.792943954 CET	42298	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.793518066 CET	42300	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.798402071 CET	3778	42300	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.798465967 CET	42300	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.799029112 CET	42300	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.803812981 CET	3778	42300	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:06.803869963 CET	42300	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:06.808702946 CET	3778	42300	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.274540901 CET	3778	42300	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.274684906 CET	42300	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.274818897 CET	42300	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.275316954 CET	42302	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.280133963 CET	3778	42302	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.280200958 CET	42302	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.280770063 CET	42302	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.285526037 CET	3778	42302	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.285572052 CET	42302	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.290354013 CET	3778	42302	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.775089025 CET	3778	42302	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.775291920 CET	42302	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.775330067 CET	42302	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.775784016 CET	42304	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.780638933 CET	3778	42304	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.780689955 CET	42304	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.781299114 CET	42304	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.786099911 CET	3778	42304	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:07.786151886 CET	42304	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:07.790967941 CET	3778	42304	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.256347895 CET	3778	42304	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.256484032 CET	42304	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.256624937 CET	42304	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.257145882 CET	42306	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.261919975 CET	3778	42306	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.261976004 CET	42306	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.262567043 CET	42306	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.267369986 CET	3778	42306	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.267424107 CET	42306	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.272277117 CET	3778	42306	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.729441881 CET	3778	42306	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.729495049 CET	42306	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.729533911 CET	42306	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.730065107 CET	42308	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.734865904 CET	3778	42308	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.734920025 CET	42308	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.738296032 CET	42308	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.743036032 CET	3778	42308	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:08.743082047 CET	42308	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:08.747896910 CET	3778	42308	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.229512930 CET	3778	42308	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.229641914 CET	42308	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.229641914 CET	42308	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.231942892 CET	42310	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.236721039 CET	3778	42310	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.236768961 CET	42310	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.241776943 CET	42310	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.246551991 CET	3778	42310	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.246593952 CET	42310	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.251365900 CET	3778	42310	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.716490030 CET	3778	42310	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.716588020 CET	42310	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.716588020 CET	42310	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.813520908 CET	42312	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.818373919 CET	3778	42312	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.818500996 CET	42312	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.836808920 CET	42312	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.841634989 CET	3778	42312	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:09.841697931 CET	42312	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:09.846455097 CET	3778	42312	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.285295010 CET	3778	42312	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.285418987 CET	42312	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.285418987 CET	42312	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.288211107 CET	42314	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.292987108 CET	3778	42314	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.293049097 CET	42314	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.299079895 CET	42314	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.303864002 CET	3778	42314	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.303973913 CET	42314	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.308824062 CET	3778	42314	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.780668020 CET	3778	42314	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.780738115 CET	42314	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.780785084 CET	42314	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.784013987 CET	42316	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.788913965 CET	3778	42316	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.788989067 CET	42316	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.793802977 CET	42316	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.798827887 CET	3778	42316	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:10.798876047 CET	42316	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:10.803652048 CET	3778	42316	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.255996943 CET	3778	42316	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.256108999 CET	42316	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.256109953 CET	42316	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.259098053 CET	42318	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.263868093 CET	3778	42318	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.263962984 CET	42318	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.270798922 CET	42318	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.275621891 CET	3778	42318	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.275671959 CET	42318	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.280425072 CET	3778	42318	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.759267092 CET	3778	42318	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.759386063 CET	42318	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.759386063 CET	42318	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.762666941 CET	42320	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.768430948 CET	3778	42320	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.768482924 CET	42320	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.775248051 CET	42320	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.780045033 CET	3778	42320	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:11.780092001 CET	42320	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:11.784837008 CET	3778	42320	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.235482931 CET	3778	42320	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.235548973 CET	42320	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.235589981 CET	42320	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.239026070 CET	42322	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.243819952 CET	3778	42322	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.243899107 CET	42322	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.251522064 CET	42322	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.256414890 CET	3778	42322	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.256511927 CET	42322	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.261291027 CET	3778	42322	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.790507078 CET	3778	42322	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.790611982 CET	42322	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.790611982 CET	42322	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.794337988 CET	42324	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.799216032 CET	3778	42324	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.799283981 CET	42324	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.806549072 CET	42324	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.811358929 CET	3778	42324	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:12.811398983 CET	42324	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:12.816464901 CET	3778	42324	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.270354986 CET	3778	42324	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.270462990 CET	42324	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.270462990 CET	42324	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.273601055 CET	42326	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.278466940 CET	3778	42326	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.278512001 CET	42326	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.285254955 CET	42326	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.290031910 CET	3778	42326	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.290074110 CET	42326	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.294871092 CET	3778	42326	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.753748894 CET	3778	42326	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.753837109 CET	42326	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.753874063 CET	42326	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.757361889 CET	42328	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.762238026 CET	3778	42328	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.762310982 CET	42328	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.767227888 CET	42328	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.771977901 CET	3778	42328	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:13.772056103 CET	42328	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:13.776812077 CET	3778	42328	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.232925892 CET	3778	42328	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.233030081 CET	42328	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.233030081 CET	42328	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.237838984 CET	42330	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.242676973 CET	3778	42330	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.242821932 CET	42330	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.250567913 CET	42330	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.255366087 CET	3778	42330	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.255409002 CET	42330	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.260276079 CET	3778	42330	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.709444046 CET	3778	42330	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.709494114 CET	42330	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.709557056 CET	42330	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.711131096 CET	42332	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.716012001 CET	3778	42332	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.716067076 CET	42332	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.720671892 CET	42332	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.725481987 CET	3778	42332	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:14.725529909 CET	42332	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:14.730341911 CET	3778	42332	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.194231987 CET	3778	42332	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.194313049 CET	42332	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.194359064 CET	42332	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.196628094 CET	42334	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.204252958 CET	3778	42334	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.204366922 CET	42334	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.211055040 CET	42334	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.215846062 CET	3778	42334	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.215888023 CET	42334	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.220705986 CET	3778	42334	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.680195093 CET	3778	42334	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.680285931 CET	42334	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.680285931 CET	42334	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.683303118 CET	42336	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.688158989 CET	3778	42336	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.688216925 CET	42336	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.693905115 CET	42336	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.698704958 CET	3778	42336	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:15.698760033 CET	42336	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:15.703614950 CET	3778	42336	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.159049988 CET	3778	42336	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.163084984 CET	42336	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.163130999 CET	42336	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.230468035 CET	42338	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.235311031 CET	3778	42338	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.235372066 CET	42338	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.244704962 CET	42338	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.249522924 CET	3778	42338	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.249569893 CET	42338	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.254365921 CET	3778	42338	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.729566097 CET	3778	42338	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.729674101 CET	42338	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.729674101 CET	42338	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.732340097 CET	42340	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.737153053 CET	3778	42340	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.737238884 CET	42340	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.743432999 CET	42340	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.748258114 CET	3778	42340	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:16.748301983 CET	42340	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:16.753145933 CET	3778	42340	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.212412119 CET	3778	42340	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.212459087 CET	42340	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.212496996 CET	42340	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.215186119 CET	42342	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.219993114 CET	3778	42342	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.220046043 CET	42342	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.225589991 CET	42342	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.230379105 CET	3778	42342	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.230423927 CET	42342	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.235172987 CET	3778	42342	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.691210032 CET	3778	42342	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.691271067 CET	42342	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.691303968 CET	42342	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.694247961 CET	42344	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.699083090 CET	3778	42344	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.699146032 CET	42344	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.705106974 CET	42344	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.709903002 CET	3778	42344	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:17.709945917 CET	42344	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:17.714767933 CET	3778	42344	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.165873051 CET	3778	42344	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.166069984 CET	42344	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.166069984 CET	42344	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.168977022 CET	42346	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.173813105 CET	3778	42346	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.173868895 CET	42346	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.179277897 CET	42346	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.184129953 CET	3778	42346	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.184189081 CET	42346	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.189023018 CET	3778	42346	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.668318033 CET	3778	42346	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.668394089 CET	42346	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.668575048 CET	42346	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.670666933 CET	42348	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.675512075 CET	3778	42348	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.675580978 CET	42348	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.679147959 CET	42348	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.683949947 CET	3778	42348	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:18.683989048 CET	42348	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:18.688827038 CET	3778	42348	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.161747932 CET	3778	42348	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.161822081 CET	42348	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.161886930 CET	42348	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.164239883 CET	42350	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.169025898 CET	3778	42350	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.169097900 CET	42350	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.173613071 CET	42350	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.178363085 CET	3778	42350	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.178437948 CET	42350	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.183223963 CET	3778	42350	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.644756079 CET	3778	42350	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.644824028 CET	42350	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.644896984 CET	42350	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.646924019 CET	42352	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.653456926 CET	3778	42352	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.653517008 CET	42352	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.657721043 CET	42352	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.662498951 CET	3778	42352	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:19.662559032 CET	42352	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:19.668937922 CET	3778	42352	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.145683050 CET	3778	42352	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.145744085 CET	42352	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.145813942 CET	42352	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.147633076 CET	42354	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.152518034 CET	3778	42354	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.152612925 CET	42354	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.156264067 CET	42354	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.161020041 CET	3778	42354	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.161077976 CET	42354	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.165940046 CET	3778	42354	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.647695065 CET	3778	42354	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.647766113 CET	42354	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.647857904 CET	42354	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.649466991 CET	42356	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.654336929 CET	3778	42356	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.654447079 CET	42356	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.658935070 CET	42356	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.663722038 CET	3778	42356	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:20.663786888 CET	42356	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:20.668605089 CET	3778	42356	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.138035059 CET	3778	42356	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.138205051 CET	42356	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.138205051 CET	42356	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.140141010 CET	42358	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.145003080 CET	3778	42358	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.145071983 CET	42358	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.148211956 CET	42358	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.153014898 CET	3778	42358	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.155153036 CET	42358	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.159948111 CET	3778	42358	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.647003889 CET	3778	42358	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.647093058 CET	42358	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.647124052 CET	42358	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.647610903 CET	42360	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.652461052 CET	3778	42360	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.652533054 CET	42360	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.653630018 CET	42360	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.658480883 CET	3778	42360	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:21.658529997 CET	42360	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:21.663306952 CET	3778	42360	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.119647026 CET	3778	42360	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.120502949 CET	42360	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.120502949 CET	42360	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.120959997 CET	42362	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.125839949 CET	3778	42362	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.125916004 CET	42362	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.127218962 CET	42362	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.131968021 CET	3778	42362	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.132006884 CET	42362	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.136759043 CET	3778	42362	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.612323999 CET	3778	42362	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.615098000 CET	42362	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.615142107 CET	42362	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.635459900 CET	42364	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.640341043 CET	3778	42364	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.640782118 CET	42364	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.645041943 CET	42364	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.649841070 CET	3778	42364	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:22.649889946 CET	42364	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:22.654712915 CET	3778	42364	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.117115974 CET	3778	42364	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.117289066 CET	42364	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.117317915 CET	42364	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.117847919 CET	42366	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.122715950 CET	3778	42366	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.122771025 CET	42366	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.123558998 CET	42366	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.128375053 CET	3778	42366	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.128463030 CET	42366	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.133265018 CET	3778	42366	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.613451004 CET	3778	42366	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.613503933 CET	42366	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.613540888 CET	42366	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.615859985 CET	42368	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.620690107 CET	3778	42368	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.620743990 CET	42368	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.623918056 CET	42368	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.628706932 CET	3778	42368	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:23.628755093 CET	42368	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:23.633541107 CET	3778	42368	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.117063046 CET	3778	42368	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.117274046 CET	42368	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.117294073 CET	42368	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.117777109 CET	42370	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.122519970 CET	3778	42370	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.122579098 CET	42370	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.123394966 CET	42370	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.128201962 CET	3778	42370	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.128249884 CET	42370	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.133014917 CET	3778	42370	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.608006001 CET	3778	42370	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.608138084 CET	42370	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.608163118 CET	42370	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.608620882 CET	42372	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.613483906 CET	3778	42372	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.613543034 CET	42372	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.614156008 CET	42372	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.618974924 CET	3778	42372	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:24.619045973 CET	42372	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:24.623859882 CET	3778	42372	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.083607912 CET	3778	42372	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.083825111 CET	42372	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.083868027 CET	42372	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.084366083 CET	42374	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.089150906 CET	3778	42374	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.089211941 CET	42374	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.089888096 CET	42374	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.094712019 CET	3778	42374	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.094777107 CET	42374	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.099612951 CET	3778	42374	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.556260109 CET	3778	42374	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.556463957 CET	42374	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.556531906 CET	42374	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.557059050 CET	42376	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.561883926 CET	3778	42376	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.561939955 CET	42376	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.562587023 CET	42376	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.567406893 CET	3778	42376	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:25.567480087 CET	42376	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:25.572348118 CET	3778	42376	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.038465023 CET	3778	42376	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.038712978 CET	42376	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.038712978 CET	42376	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.039345980 CET	42378	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.044089079 CET	3778	42378	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.044147015 CET	42378	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.044925928 CET	42378	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.049674034 CET	3778	42378	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.049726963 CET	42378	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.054512024 CET	3778	42378	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.535238028 CET	3778	42378	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.535506010 CET	42378	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.535506010 CET	42378	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.536075115 CET	42380	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.540893078 CET	3778	42380	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.540945053 CET	42380	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.541558027 CET	42380	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.546379089 CET	3778	42380	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:26.546439886 CET	42380	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:26.551255941 CET	3778	42380	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.027338028 CET	3778	42380	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.027543068 CET	42380	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.027543068 CET	42380	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.027961016 CET	42382	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.032771111 CET	3778	42382	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.032823086 CET	42382	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.033459902 CET	42382	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.038202047 CET	3778	42382	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.038264036 CET	42382	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.043025017 CET	3778	42382	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.518820047 CET	3778	42382	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.518929005 CET	42382	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.519054890 CET	42382	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.519470930 CET	42384	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.524261951 CET	3778	42384	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.524317980 CET	42384	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.524954081 CET	42384	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.529757977 CET	3778	42384	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:27.529825926 CET	42384	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:27.534646988 CET	3778	42384	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.010634899 CET	3778	42384	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.010735989 CET	42384	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.010766029 CET	42384	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.011188030 CET	42386	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.015994072 CET	3778	42386	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.016072035 CET	42386	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.016796112 CET	42386	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.021683931 CET	3778	42386	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.021801949 CET	42386	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.026590109 CET	3778	42386	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.511450052 CET	3778	42386	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.511670113 CET	42386	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.511670113 CET	42386	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.512042046 CET	42388	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.516906977 CET	3778	42388	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.517019033 CET	42388	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.517682076 CET	42388	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.522435904 CET	3778	42388	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:28.522489071 CET	42388	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:28.527333021 CET	3778	42388	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.012274027 CET	3778	42388	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.012367010 CET	42388	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.012393951 CET	42388	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.012732983 CET	42390	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.017554045 CET	3778	42390	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.017610073 CET	42390	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.018189907 CET	42390	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.022933006 CET	3778	42390	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.022977114 CET	42390	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.027838945 CET	3778	42390	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.504499912 CET	3778	42390	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.504626036 CET	42390	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.504815102 CET	42390	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.505357981 CET	42392	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.510220051 CET	3778	42392	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.510278940 CET	42392	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.510902882 CET	42392	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.515675068 CET	3778	42392	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.515729904 CET	42392	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.520529032 CET	3778	42392	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.979217052 CET	3778	42392	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.979404926 CET	42392	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.979434967 CET	42392	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.979933023 CET	42394	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.984755993 CET	3778	42394	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.984813929 CET	42394	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.985618114 CET	42394	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.990405083 CET	3778	42394	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:29.990451097 CET	42394	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:29.995277882 CET	3778	42394	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.461740971 CET	3778	42394	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.461838007 CET	42394	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.461869001 CET	42394	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.462264061 CET	42396	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.467118979 CET	3778	42396	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.467185974 CET	42396	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.467833042 CET	42396	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.472636938 CET	3778	42396	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.472682953 CET	42396	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.477471113 CET	3778	42396	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.934640884 CET	3778	42396	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.934782028 CET	42396	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.934812069 CET	42396	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.935302019 CET	42398	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.940088034 CET	3778	42398	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.940145969 CET	42398	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.940809965 CET	42398	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.945583105 CET	3778	42398	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:30.945630074 CET	42398	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:30.950479984 CET	3778	42398	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.426425934 CET	3778	42398	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.426621914 CET	42398	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.426621914 CET	42398	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.427018881 CET	42400	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.431866884 CET	3778	42400	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.431934118 CET	42400	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.432708979 CET	42400	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.437462091 CET	3778	42400	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.437531948 CET	42400	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.442362070 CET	3778	42400	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.899586916 CET	3778	42400	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.899745941 CET	42400	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.899781942 CET	42400	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.900264978 CET	42402	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.905539989 CET	3778	42402	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.905622959 CET	42402	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.906486988 CET	42402	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.912369967 CET	3778	42402	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:31.912425041 CET	42402	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:31.917201996 CET	3778	42402	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.373568058 CET	3778	42402	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.373761892 CET	42402	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.373761892 CET	42402	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.374209881 CET	42404	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.379101038 CET	3778	42404	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.379165888 CET	42404	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.379802942 CET	42404	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.384589911 CET	3778	42404	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.384639978 CET	42404	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.389389992 CET	3778	42404	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.874068975 CET	3778	42404	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.874203920 CET	42404	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.874203920 CET	42404	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.874720097 CET	42406	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.879477024 CET	3778	42406	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.879543066 CET	42406	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.880120993 CET	42406	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.884865046 CET	3778	42406	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:32.884917974 CET	42406	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:32.889671087 CET	3778	42406	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.362884998 CET	3778	42406	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.363137007 CET	42406	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.363137007 CET	42406	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.363476992 CET	42408	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.368282080 CET	3778	42408	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.368331909 CET	42408	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.368949890 CET	42408	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.373723030 CET	3778	42408	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.373770952 CET	42408	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.378645897 CET	3778	42408	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.854613066 CET	3778	42408	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.854732037 CET	42408	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.854787111 CET	42408	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.855273962 CET	42410	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.860119104 CET	3778	42410	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.860177040 CET	42410	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.860809088 CET	42410	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.865566969 CET	3778	42410	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:33.865613937 CET	42410	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:33.870464087 CET	3778	42410	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.493005037 CET	3778	42410	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.493056059 CET	3778	42410	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.493067980 CET	3778	42410	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.493221045 CET	42410	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.493297100 CET	42410	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.493927956 CET	42412	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.498783112 CET	3778	42412	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.498842001 CET	42412	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.499538898 CET	42412	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.504317999 CET	3778	42412	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.504364967 CET	42412	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.509099960 CET	3778	42412	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.982039928 CET	3778	42412	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.982130051 CET	42412	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.982170105 CET	42412	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.982611895 CET	42414	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.987365961 CET	3778	42414	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.987428904 CET	42414	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.988053083 CET	42414	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.992804050 CET	3778	42414	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:34.992855072 CET	42414	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:34.997697115 CET	3778	42414	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.458080053 CET	3778	42414	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.458287001 CET	42414	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.458287001 CET	42414	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.458661079 CET	42416	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.463507891 CET	3778	42416	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.463561058 CET	42416	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.464135885 CET	42416	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.468945980 CET	3778	42416	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.468991041 CET	42416	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.473772049 CET	3778	42416	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.930243969 CET	3778	42416	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.930346966 CET	42416	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.930346966 CET	42416	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.930720091 CET	42418	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.935544014 CET	3778	42418	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.935609102 CET	42418	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.936239004 CET	42418	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.941021919 CET	3778	42418	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:35.941072941 CET	42418	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:35.945817947 CET	3778	42418	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.403003931 CET	3778	42418	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.403105021 CET	42418	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.403105021 CET	42418	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.403525114 CET	42420	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.408286095 CET	3778	42420	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.408346891 CET	42420	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.408976078 CET	42420	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.413758039 CET	3778	42420	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.413852930 CET	42420	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.418673038 CET	3778	42420	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.875905037 CET	3778	42420	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.875996113 CET	42420	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.875996113 CET	42420	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.876406908 CET	42422	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.881242990 CET	3778	42422	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.881311893 CET	42422	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.881911039 CET	42422	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.886714935 CET	3778	42422	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:36.886766911 CET	42422	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:36.891566038 CET	3778	42422	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.351330996 CET	3778	42422	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.351413965 CET	42422	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.351413965 CET	42422	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.351808071 CET	42424	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.356625080 CET	3778	42424	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.356679916 CET	42424	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.357383013 CET	42424	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.362149000 CET	3778	42424	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.362198114 CET	42424	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.367046118 CET	3778	42424	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.845419884 CET	3778	42424	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.845638990 CET	42424	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.845664024 CET	42424	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.846313953 CET	42426	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.851128101 CET	3778	42426	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.851186037 CET	42426	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.852016926 CET	42426	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.856829882 CET	3778	42426	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:37.856878996 CET	42426	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:37.861737967 CET	3778	42426	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.453136921 CET	3778	42426	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.453243017 CET	42426	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.453329086 CET	42426	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.453960896 CET	42428	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.458802938 CET	3778	42428	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.458864927 CET	42428	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.459666014 CET	42428	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.464472055 CET	3778	42428	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.464526892 CET	42428	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.469347954 CET	3778	42428	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.928507090 CET	3778	42428	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.928596020 CET	42428	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.928834915 CET	42428	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.929390907 CET	42430	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.934221029 CET	3778	42430	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.934278011 CET	42430	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.935177088 CET	42430	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.939963102 CET	3778	42430	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:38.940007925 CET	42430	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:38.944782972 CET	3778	42430	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.429863930 CET	3778	42430	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.429948092 CET	42430	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.430141926 CET	42430	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.430705070 CET	42432	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.435591936 CET	3778	42432	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.435647011 CET	42432	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.436580896 CET	42432	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.441366911 CET	3778	42432	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.441423893 CET	42432	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.446239948 CET	3778	42432	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.912942886 CET	3778	42432	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.913188934 CET	42432	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.913188934 CET	42432	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.913656950 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.918456078 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.918534040 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.919245958 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.924077034 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:39.924139977 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:39.928888083 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:49.929160118 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:42:49.934139967 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:50.034226894 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:42:50.034425974 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:43:50.093470097 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:43:50.098475933 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:43:50.198683977 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:43:50.198793888 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:44:50.182964087 CET	55916	53	192.168.2.15	8.8.8.8
Jan 8, 2025 04:44:50.188014984 CET	53	55916	8.8.8.8	192.168.2.15
Jan 8, 2025 04:44:50.188097000 CET	55916	53	192.168.2.15	8.8.8.8
Jan 8, 2025 04:44:50.188112974 CET	55916	53	192.168.2.15	8.8.8.8
Jan 8, 2025 04:44:50.188134909 CET	55916	53	192.168.2.15	8.8.8.8
Jan 8, 2025 04:44:50.192887068 CET	53	55916	8.8.8.8	192.168.2.15
Jan 8, 2025 04:44:50.192898035 CET	53	55916	8.8.8.8	192.168.2.15
Jan 8, 2025 04:44:50.254044056 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:44:50.258899927 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:44:50.359225035 CET	3778	42434	154.127.56.84	192.168.2.15
Jan 8, 2025 04:44:50.359303951 CET	42434	3778	192.168.2.15	154.127.56.84
Jan 8, 2025 04:44:50.647109032 CET	53	55916	8.8.8.8	192.168.2.15
Jan 8, 2025 04:44:50.647221088 CET	55916	53	192.168.2.15	8.8.8.8
Jan 8, 2025 04:44:52.635616064 CET	53	55916	8.8.8.8	192.168.2.15
Jan 8, 2025 04:44:52.635963917 CET	55916	53	192.168.2.15	8.8.8.8
Jan 8, 2025 04:44:52.640777111 CET	53	55916	8.8.8.8	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 04:44:50.188112974 CET	192.168.2.15	8.8.8.8	0x8e1c	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 04:44:50.188134909 CET	192.168.2.15	8.8.8.8	0x1884	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 04:44:50.647109032 CET	8.8.8.8	192.168.2.15	0x8e1c	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 8, 2025 04:44:50.647109032 CET	8.8.8.8	192.168.2.15	0x8e1c	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: boatnet.m68k.elf PID: 5814, Parent PID: 5739

General

Start time (UTC):	03:42:02
Start date (UTC):	08/01/2025
Path:	/tmp/boatnet.m68k.elf
Arguments:	/tmp/boatnet.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5816, Parent PID: 5814

General

Start time (UTC):	03:42:02
Start date (UTC):	08/01/2025
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5818, Parent PID: 5814

General

Start time (UTC):	03:42:02
Start date (UTC):	08/01/2025
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5820, Parent PID: 5814

General

Start time (UTC):	03:42:02
Start date (UTC):	08/01/2025
Path:	/tmp/boatnet.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: xfce4-panel PID: 5825, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5825, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5826, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5826, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5827, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5827, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5828, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5828, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5848, Parent PID: 5828

General

Start time (UTC):	03:42:12
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 5848, Parent PID: 5828

General

Start time (UTC):	03:42:12
Start date (UTC):	08/01/2025
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Chronological Activities

Analysis Process: xfce4-panel PID: 5829, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5829, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5830, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5830, Parent PID: 3235

General

Start time (UTC):	03:42:08
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: dbus-daemon PID: 5847, Parent PID: 5846

General

Start time (UTC):	03:42:12
Start date (UTC):	08/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 5847, Parent PID: 5846

General

Start time (UTC):	03:42:12
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: systemd PID: 5856, Parent PID: 3044

General

Start time (UTC):	03:42:16
Start date (UTC):	08/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: xfce4-notifyd PID: 5856, Parent PID: 3044

General

Start time (UTC):	03:42:16
Start date (UTC):	08/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report boatnet.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: boatnet.m68k.elf PID: 5814, Parent PID: 5739

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5816, Parent PID: 5814

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5818, Parent PID: 5814

General

Chronological Activities

Analysis Process: boatnet.m68k.elf PID: 5820, Parent PID: 5814

General

Chronological Activities

Analysis Process: xfce4-panel PID: 5825, Parent PID: 3235

General

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5825, Parent PID: 3235

General

Linux Analysis Report
boatnet.m68k.elf