Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
boatnet.ppc.elf

Overview

General Information

Sample name:boatnet.ppc.elf
Analysis ID:1634970
MD5:2c6d273ee61765affd37338faa8c1c53
SHA1:27125fde695795bd1893b838458bc22ce470f120
SHA256:1429db302f8cd79c39c066040677fa3ca0829847ee117e7ed98864bf870f59fd
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:80
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1634970
Start date and time:2025-03-11 08:47:30 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 7s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.ppc.elf
Detection:MAL
Classification:mal80.spre.troj.evad.linELF@0/1@2/0

Runtime Messages

Command:/tmp/boatnet.ppc.elf
PID:5430
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5449, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5450, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5451, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5452, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 5469, Parent: 5452, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 5453, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5454, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 5471, Parent: 5470, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • systemd New Fork (PID: 5478, Parent: 2935)
  • xfce4-notifyd (PID: 5478, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
5436.1.00007fd66c007000.00007fd66c00d000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x5a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5436.1.00007fd66c007000.00007fd66c00d000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
  • 0x5fac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5434.1.00007fd66c007000.00007fd66c00d000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x5a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5434.1.00007fd66c007000.00007fd66c00d000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
  • 0x5fac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5430.1.00007fd66c007000.00007fd66c00d000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x5a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x5be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Data Obfuscation
  • • Persistence and Installation Behavior
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion
  • • Stealing of Sensitive Information
  • • Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: boatnet.ppc.elfAvira: detected
Source: boatnet.ppc.elfVirustotal: Detection: 52%Perma Link
Source: boatnet.ppc.elfReversingLabs: Detection: 63%
Source: global trafficTCP traffic: 192.168.2.13:58048 -> 87.121.84.183:3778
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: boatnet.ppc.elfString found in binary or memory: http://upx.sf.net

System Summary

barindex
Source: 5436.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5436.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5434.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5434.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5430.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5430.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.ppc.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.ppc.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.ppc.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.ppc.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3104, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3161, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3162, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3163, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3164, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3165, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3170, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3182, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3208, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3212, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5436, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5449, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5450, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5451, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5452, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5453, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5454, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5471, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5478, result: successfulJump to behavior
Source: xfce4-panel.xml.new.31.drOLE indicator, VBA macros: true
Source: xfce4-panel.xml.new.31.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: LOAD without section mappingsProgram segment: 0x100000
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3104, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3161, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3162, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3163, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3164, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3165, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3170, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3182, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3208, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 3212, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5436, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5449, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5450, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5451, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5452, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5453, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5454, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5471, result: successfulJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)SIGKILL sent: pid: 5478, result: successfulJump to behavior
Source: 5436.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5436.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5434.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5434.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5430.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5430.1.00007fd66c007000.00007fd66c00d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.ppc.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.ppc.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.ppc.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.ppc.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engineClassification label: mal80.spre.troj.evad.linELF@0/1@2/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /home/saturnino/.fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.cacheJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.localJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.configJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.cacheJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.localJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.configJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.configJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.cacheJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.localJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.configJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3122/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3117/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3114/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5379/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5414/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5415/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/914/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/518/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/519/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5274/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3771/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3134/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3375/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3132/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3095/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1745/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1866/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/884/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1982/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/765/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/767/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1906/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/802/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1748/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3646/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3420/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1482/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1480/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1755/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1238/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1875/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/2964/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3413/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1751/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1872/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/2961/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1475/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/656/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/778/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/657/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/658/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/659/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5436/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/418/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/936/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/419/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/816/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1879/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3658/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5570/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5450/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5451/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5452/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5453/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5454/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1891/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3310/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3153/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/780/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/660/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1921/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/783/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1765/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/2974/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1400/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1884/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3424/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/2972/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3147/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/2970/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1881/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3146/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3300/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1805/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1925/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1804/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/5449/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1648/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1922/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3429/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3442/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3165/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3164/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3163/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3162/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/790/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3161/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/792/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/793/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/672/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1930/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/795/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/674/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/3315/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1411/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/2984/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/1410/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/797/cmdlineJump to behavior
Source: /tmp/boatnet.ppc.elf (PID: 5432)File opened: /proc/676/cmdlineJump to behavior
Source: boatnet.ppc.elfSubmission file: segment LOAD with 7.9091 entropy (max. 8.0)
Source: /tmp/boatnet.ppc.elf (PID: 5430)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Queries kernel information via 'uname': Jump to behavior
Source: boatnet.ppc.elf, 5430.1.00005574b590b000.00005574b59bb000.rw-.sdmp, boatnet.ppc.elf, 5436.1.00005574b590b000.00005574b59bb000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: boatnet.ppc.elf, 5434.1.00005574b590b000.00005574b59bb000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: boatnet.ppc.elf, 5430.1.00005574b590b000.00005574b59bb000.rw-.sdmp, boatnet.ppc.elf, 5434.1.00005574b590b000.00005574b59bb000.rw-.sdmp, boatnet.ppc.elf, 5436.1.00005574b590b000.00005574b59bb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: boatnet.ppc.elf, 5430.1.00007ffcad9a4000.00007ffcad9c5000.rw-.sdmp, boatnet.ppc.elf, 5434.1.00007ffcad9a4000.00007ffcad9c5000.rw-.sdmp, boatnet.ppc.elf, 5436.1.00007ffcad9a4000.00007ffcad9c5000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: boatnet.ppc.elf, 5430.1.00007ffcad9a4000.00007ffcad9c5000.rw-.sdmp, boatnet.ppc.elf, 5434.1.00007ffcad9a4000.00007ffcad9c5000.rw-.sdmp, boatnet.ppc.elf, 5436.1.00007ffcad9a4000.00007ffcad9c5000.rw-.sdmpBinary or memory string: Z!x86_64/usr/bin/qemu-ppc/tmp/boatnet.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.ppc.elf

Stealing of Sensitive Information

barindex
Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 5434, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 5436, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 5434, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 5436, type: MEMORYSTR

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception1
Hidden Files and Directories		1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network Medium1
Service Stop
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
Obfuscated Files or Information		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1634970 Sample: boatnet.ppc.elf Startdate: 11/03/2025 Architecture: LINUX Score: 80 24 87.121.84.183, 3778, 58048, 58050 SKATTV-ASBG Bulgaria 2->24 26 daisy.ubuntu.com 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Antivirus / Scanner detection for submitted sample 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 2 other signatures 2->34 7 boatnet.ppc.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 6 other processes 2->13 signatures3 process4 process5 15 boatnet.ppc.elf 7->15         started        18 boatnet.ppc.elf 7->18         started        20 boatnet.ppc.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 36 Sample tries to kill multiple processes (SIGKILL) 15->36

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
boatnet.ppc.elf52%VirustotalBrowse
boatnet.ppc.elf63%ReversingLabsLinux.Trojan.Mirai
boatnet.ppc.elf100%AviraEXP/ELF.Agent.F.118

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    		high
    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netboatnet.ppc.elffalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      87.121.84.183
      		unknownBulgaria
      		34577SKATTV-ASBGfalse

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      87.121.84.183boatnet.spc.elfGet hashmaliciousMiraiBrowse
        boatnet.m68k.elfGet hashmaliciousMiraiBrowse

          Domains

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          daisy.ubuntu.comcbr.arm6.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          cbr.sh4.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          cbr.arm7.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.24
          cbr.mips.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          cbr.m68k.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.24
          sshd.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25
          cbr.arc.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          cbr.x86.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          cbr.mpsl.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          .i.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25

          ASNs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          SKATTV-ASBGboatnet.spc.elfGet hashmaliciousMiraiBrowse
          • 87.121.84.183
          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
          • 87.121.84.183
          yakov.mips.elfGet hashmaliciousMiraiBrowse
          • 87.120.53.122
          tftp.elfGet hashmaliciousUnknownBrowse
          • 87.121.84.89
          apache2.elfGet hashmaliciousUnknownBrowse
          • 87.121.84.89
          sshd.elfGet hashmaliciousUnknownBrowse
          • 87.121.84.89
          ftp.elfGet hashmaliciousUnknownBrowse
          • 87.121.84.89
          wget.elfGet hashmaliciousUnknownBrowse
          • 87.121.84.89
          openssh.elfGet hashmaliciousUnknownBrowse
          • 87.121.84.89
          pftp.elfGet hashmaliciousUnknownBrowse
          • 87.121.84.89

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          Process:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
          File Type:XML 1.0 document, ASCII text
          Category:dropped
          Size (bytes):5128
          Entropy (8bit):4.457618060812407
          Encrypted:false
          SSDEEP:96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
          MD5:2A2A7C34B585CDAE5E123F3C5100C253
          SHA1:E814B1B1531B25581DB76CB813C85E53E1390BA4
          SHA-256:BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
          SHA-512:CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
          Malicious:false
          Reputation:moderate, very likely benign file
          Preview:<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in

          Static File Info

          General

          File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
          Entropy (8bit):7.9046482475868665
          TrID:
          • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
          • ELF Executable and Linkable format (generic) (4004/1) 49.84%
          File name:boatnet.ppc.elf
          File size:21'884 bytes
          MD5:2c6d273ee61765affd37338faa8c1c53
          SHA1:27125fde695795bd1893b838458bc22ce470f120
          SHA256:1429db302f8cd79c39c066040677fa3ca0829847ee117e7ed98864bf870f59fd
          SHA512:572569a63dc9abca47584f07b55ec55c2f8f7aa90e30dfb42da15fa65daa601abe49fbb4f30febf1a7848b6af2fd5e34b3c379bb2239677e563c48fbf307aaac
          SSDEEP:384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5WM4uVcqgw05VxJJ:9RxsSVsMD6xiJJE5zRWN74uVcqgw09/
          TLSH:B0A2D029D345AEF4DFAF9CA453C1C2C27BE547C6278AC8E340EEAF012516046FB89D49
          File Content Preview:.ELF......................B....4.........4. ...(......................Tx..Tx...............D...D...D................dt.Q................................UPX!...........\...\.......R.......?.E.h4...@b............./.}....D*aN.........t.w..X.^6>....d........+

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, big endian
          Version:1 (current)
          Machine:PowerPC
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - Linux
          ABI Version:0
          Entry Point Address:0x104290
          Flags:0x0
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:0
          Section Header Size:40
          Number of Section Headers:0
          Header String Table Index:0

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x1000000x1000000x54780x54787.90910x5R E0x10000
          LOAD0xd5440x1001d5440x1001d5440x00x00.00000x6RW 0x10000
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

          Network Behavior

          Download Network PCAP: filtered – full

          Network Port Distribution

          • Total Packets: 56
          • • 3778 undefined
          • • 53 (DNS)
          TimestampSource PortDest PortSource IPDest IP
          Mar 11, 2025 08:48:21.639043093 CET580483778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:21.643949986 CET37785804887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:21.644025087 CET580483778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:21.660022020 CET580483778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:21.664776087 CET37785804887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:21.664824963 CET580483778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:21.669595003 CET37785804887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.273168087 CET37785804887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.273271084 CET580483778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.273657084 CET580483778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.274255037 CET580503778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.279067039 CET37785805087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.279119015 CET580503778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.279743910 CET580503778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.284487009 CET37785805087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.284579039 CET580503778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.289442062 CET37785805087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.899264097 CET37785805087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.899418116 CET580503778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.899470091 CET580503778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.900284052 CET580523778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.905165911 CET37785805287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.905256987 CET580523778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.906080008 CET580523778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.910844088 CET37785805287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:22.910898924 CET580523778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:22.915713072 CET37785805287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:23.554582119 CET37785805287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:23.554847956 CET580523778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:23.554847956 CET580523778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:23.555605888 CET580543778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:23.560466051 CET37785805487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:23.560534000 CET580543778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:23.561544895 CET580543778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:23.566518068 CET37785805487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:23.566606045 CET580543778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:23.571743011 CET37785805487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.172766924 CET37785805487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.172990084 CET580543778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.173053026 CET580543778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.173679113 CET580563778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.178554058 CET37785805687.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.178608894 CET580563778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.179441929 CET580563778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.184266090 CET37785805687.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.184317112 CET580563778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.189208031 CET37785805687.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.832766056 CET37785805687.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.832931042 CET580563778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.832990885 CET580563778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.833496094 CET580583778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.838481903 CET37785805887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.838562965 CET580583778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.839235067 CET580583778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.844101906 CET37785805887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:24.844151974 CET580583778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:24.849004984 CET37785805887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:25.534738064 CET37785805887.121.84.183192.168.2.13
          Mar 11, 2025 08:48:25.534992933 CET580583778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:25.534993887 CET580583778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:25.535741091 CET580603778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:25.540600061 CET37785806087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:25.540709019 CET580603778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:25.541358948 CET580603778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:25.546195984 CET37785806087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:25.546248913 CET580603778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:25.551018000 CET37785806087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.298285007 CET37785806087.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.298458099 CET580603778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.298506975 CET580603778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.299144983 CET580623778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.304064035 CET37785806287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.304138899 CET580623778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.304982901 CET580623778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.309847116 CET37785806287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.309923887 CET580623778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.314826965 CET37785806287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.929500103 CET37785806287.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.929559946 CET580623778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.929609060 CET580623778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.930233002 CET580643778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.935147047 CET37785806487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.935209990 CET580643778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.936784029 CET580643778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.941576004 CET37785806487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:26.941643000 CET580643778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:26.946460009 CET37785806487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:27.180918932 CET580643778192.168.2.1387.121.84.183
          Mar 11, 2025 08:48:27.231276035 CET37785806487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:27.374308109 CET37785806487.121.84.183192.168.2.13
          Mar 11, 2025 08:48:27.374393940 CET580643778192.168.2.1387.121.84.183
          TimestampSource PortDest PortSource IPDest IP
          Mar 11, 2025 08:51:07.169907093 CET5880553192.168.2.131.1.1.1
          Mar 11, 2025 08:51:07.170006990 CET5465453192.168.2.131.1.1.1
          Mar 11, 2025 08:51:07.176938057 CET53546541.1.1.1192.168.2.13
          Mar 11, 2025 08:51:07.178015947 CET53588051.1.1.1192.168.2.13

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Mar 11, 2025 08:51:07.169907093 CET192.168.2.131.1.1.10x3780Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
          Mar 11, 2025 08:51:07.170006990 CET192.168.2.131.1.1.10xee7fStandard query (0)daisy.ubuntu.com28IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Mar 11, 2025 08:51:07.178015947 CET1.1.1.1192.168.2.130x3780No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
          Mar 11, 2025 08:51:07.178015947 CET1.1.1.1192.168.2.130x3780No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

          System Behavior

          General

          Start time (UTC):07:48:20
          Start date (UTC):11/03/2025
          Path:/tmp/boatnet.ppc.elf
          Arguments:/tmp/boatnet.ppc.elf
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          File Activities

          Process Activities

          System Activities

          Network Activities


          General

          Start time (UTC):07:48:20
          Start date (UTC):11/03/2025
          Path:/tmp/boatnet.ppc.elf
          Arguments:-
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          File Activities

          Process Activities


          General

          Start time (UTC):07:48:20
          Start date (UTC):11/03/2025
          Path:/tmp/boatnet.ppc.elf
          Arguments:-
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          File Activities

          Process Activities


          General

          Start time (UTC):07:48:20
          Start date (UTC):11/03/2025
          Path:/tmp/boatnet.ppc.elf
          Arguments:-
          File size:5388968 bytes
          MD5 hash:ae65271c943d3451b7f026d1fadccea6

          Process Activities

          Network Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Process Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          File Activities

          Process Activities

          System Activities

          Network Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Process Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          File Activities

          Process Activities

          System Activities

          Network Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Process Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          File Activities

          Process Activities

          System Activities

          Network Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Process Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          File Activities

          Process Activities

          System Activities

          Network Activities


          General

          Start time (UTC):07:48:31
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:-
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          File Activities

          Process Activities


          General

          Start time (UTC):07:48:31
          Start date (UTC):11/03/2025
          Path:/usr/sbin/xfpm-power-backlight-helper
          Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
          File size:14656 bytes
          MD5 hash:3d221ad23f28ca3259f599b1664e2427

          File Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Process Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          File Activities

          Process Activities

          System Activities

          Network Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Process Activities


          General

          Start time (UTC):07:48:26
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          File Activities

          Process Activities

          System Activities

          Network Activities


          General

          Start time (UTC):07:48:31
          Start date (UTC):11/03/2025
          Path:/usr/bin/dbus-daemon
          Arguments:-
          File size:249032 bytes
          MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

          Process Activities


          General

          Start time (UTC):07:48:31
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
          File size:112880 bytes
          MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9

          File Activities

          Process Activities

          Network Activities


          General

          Start time (UTC):07:48:35
          Start date (UTC):11/03/2025
          Path:/usr/lib/systemd/systemd
          Arguments:-
          File size:1620224 bytes
          MD5 hash:9b2bec7092a40488108543f9334aab75

          Process Activities


          General

          Start time (UTC):07:48:35
          Start date (UTC):11/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
          File size:112872 bytes
          MD5 hash:eee956f1b227c1d5031f9c61223255d1

          File Activities

          Process Activities

          System Activities

          Network Activities