Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
boatnet.sh4.elf

Overview

General Information

Sample name:boatnet.sh4.elf
Analysis ID:1582471
MD5:ac9f79ebb02ef6e893608530021c5fd2
SHA1:d8d6cc98c6e73e01714f9a5cca8a3f8b5d2b8411
SHA256:3d9bd6fbe589741a32a08bd9068e0b40245b7c43b90ae9f108a7ea0de0bf5850
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1582471
Start date and time:2024-12-30 17:43:09 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 5s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.sh4.elf
Detection:MAL
Classification:mal76.spre.troj.linELF@0/1@2/0
  • VT rate limit hit for: boatnet.sh4.elf
Command:/tmp/boatnet.sh4.elf
PID:5438
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 5416, Parent: 3579)
  • rm (PID: 5416, Parent: 3579, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.H8diMwwaUH /tmp/tmp.hW8QZZa0nD /tmp/tmp.UEYc5XnOiL
  • dash New Fork (PID: 5417, Parent: 3579)
  • cat (PID: 5417, Parent: 3579, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.H8diMwwaUH
  • dash New Fork (PID: 5418, Parent: 3579)
  • head (PID: 5418, Parent: 3579, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5419, Parent: 3579)
  • tr (PID: 5419, Parent: 3579, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5420, Parent: 3579)
  • cut (PID: 5420, Parent: 3579, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5423, Parent: 3579)
  • cat (PID: 5423, Parent: 3579, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.H8diMwwaUH
  • dash New Fork (PID: 5424, Parent: 3579)
  • head (PID: 5424, Parent: 3579, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5425, Parent: 3579)
  • tr (PID: 5425, Parent: 3579, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5426, Parent: 3579)
  • cut (PID: 5426, Parent: 3579, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5427, Parent: 3579)
  • rm (PID: 5427, Parent: 3579, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.H8diMwwaUH /tmp/tmp.hW8QZZa0nD /tmp/tmp.UEYc5XnOiL
  • wrapper-2.0 (PID: 5450, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5451, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5452, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5453, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 5472, Parent: 5453, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 5454, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5455, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 5471, Parent: 5470, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • systemd New Fork (PID: 5480, Parent: 2935)
  • xfce4-notifyd (PID: 5480, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
boatnet.sh4.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    boatnet.sh4.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xce78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xce8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xceb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcedc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcf90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcfa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcfb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcfcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcfe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xd008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    boatnet.sh4.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xd454:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    SourceRuleDescriptionAuthorStrings
    5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xce78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xce8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xceb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcedc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcf90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcfa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcfb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcfcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcfe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xd454:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xce78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xce8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xceb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcedc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcf90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcfa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcfb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcfcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcfe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xd008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        Click to see the 13 entries
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: boatnet.sh4.elfAvira: detected
        Source: boatnet.sh4.elfReversingLabs: Detection: 65%
        Source: global trafficTCP traffic: 192.168.2.13:35354 -> 154.216.17.216:3778
        Source: global trafficTCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.216
        Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
        Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: unknownNetwork traffic detected: HTTP traffic on port 48202 -> 443

        System Summary

        barindex
        Source: boatnet.sh4.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: boatnet.sh4.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5438.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5438.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.sh4.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.sh4.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.sh4.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.sh4.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.sh4.elf PID: 5444, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.sh4.elf PID: 5444, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3104, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3161, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3162, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3164, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5444, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5450, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5451, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5452, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5453, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5454, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5455, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5471, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5480, result: successfulJump to behavior
        Source: xfce4-panel.xml.new.49.drOLE indicator, VBA macros: true
        Source: xfce4-panel.xml.new.49.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3104, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3161, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3162, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3164, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5444, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5450, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5451, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5452, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5453, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5454, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5455, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5471, result: successfulJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)SIGKILL sent: pid: 5480, result: successfulJump to behavior
        Source: boatnet.sh4.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: boatnet.sh4.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5438.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5438.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.sh4.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.sh4.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.sh4.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.sh4.elf PID: 5442, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.sh4.elf PID: 5444, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.sh4.elf PID: 5444, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: classification engineClassification label: mal76.spre.troj.linELF@0/1@2/0
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.cacheJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.localJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.cacheJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.localJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5471)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5480)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5480)Directory: /home/saturnino/.cacheJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5480)Directory: /home/saturnino/.localJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5480)Directory: /home/saturnino/.configJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3122/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3117/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3114/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5412/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/518/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/519/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3635/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3134/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3375/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3132/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3095/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5270/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1745/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1866/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/884/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1982/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/765/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3246/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/767/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1906/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3766/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1748/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5444/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1482/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1480/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1755/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1238/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1875/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/2964/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3413/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1751/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1872/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/2961/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/656/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/778/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/657/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/658/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/659/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/418/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/419/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/816/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1879/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5450/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5451/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5452/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5453/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5574/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5454/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5455/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1891/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3310/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3153/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/780/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/660/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1921/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/783/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1765/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/2974/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1400/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1884/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3424/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/2972/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3147/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/2970/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1881/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3146/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3300/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1805/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1925/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1804/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1648/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1922/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3429/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/5063/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3681/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3682/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3683/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3684/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3442/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3165/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3164/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3163/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3162/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/790/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3161/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/792/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/793/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/672/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1930/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/795/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/674/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/3315/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1411/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/2984/cmdlineJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5440)File opened: /proc/1410/cmdlineJump to behavior
        Source: /usr/bin/dash (PID: 5416)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.H8diMwwaUH /tmp/tmp.hW8QZZa0nD /tmp/tmp.UEYc5XnOiLJump to behavior
        Source: /usr/bin/dash (PID: 5427)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.H8diMwwaUH /tmp/tmp.hW8QZZa0nD /tmp/tmp.UEYc5XnOiLJump to behavior
        Source: /tmp/boatnet.sh4.elf (PID: 5438)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5453)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5480)Queries kernel information via 'uname': Jump to behavior
        Source: boatnet.sh4.elf, 5438.1.00007fff62a69000.00007fff62a8a000.rw-.sdmp, boatnet.sh4.elf, 5442.1.00007fff62a69000.00007fff62a8a000.rw-.sdmp, boatnet.sh4.elf, 5444.1.00007fff62a69000.00007fff62a8a000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sh4/tmp/boatnet.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.sh4.elf
        Source: boatnet.sh4.elf, 5438.1.00007fff62a69000.00007fff62a8a000.rw-.sdmp, boatnet.sh4.elf, 5442.1.00007fff62a69000.00007fff62a8a000.rw-.sdmp, boatnet.sh4.elf, 5444.1.00007fff62a69000.00007fff62a8a000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
        Source: boatnet.sh4.elf, 5438.1.0000560400dcb000.0000560400e2e000.rw-.sdmp, boatnet.sh4.elf, 5442.1.0000560400dcb000.0000560400e2e000.rw-.sdmp, boatnet.sh4.elf, 5444.1.0000560400dcb000.0000560400e2e000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
        Source: boatnet.sh4.elf, 5438.1.0000560400dcb000.0000560400e2e000.rw-.sdmp, boatnet.sh4.elf, 5442.1.0000560400dcb000.0000560400e2e000.rw-.sdmp, boatnet.sh4.elf, 5444.1.0000560400dcb000.0000560400e2e000.rw-.sdmpBinary or memory string: V5!/etc/qemu-binfmt/sh4

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: boatnet.sh4.elf, type: SAMPLE
        Source: Yara matchFile source: 5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5438.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.sh4.elf PID: 5438, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.sh4.elf PID: 5442, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.sh4.elf PID: 5444, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: boatnet.sh4.elf, type: SAMPLE
        Source: Yara matchFile source: 5442.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5444.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5438.1.00007f0f4c400000.00007f0f4c40f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.sh4.elf PID: 5438, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.sh4.elf PID: 5442, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.sh4.elf PID: 5444, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting
        Valid AccountsWindows Management Instrumentation1
        Scripting
        Path Interception1
        Hidden Files and Directories
        1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network Medium1
        Service Stop
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
        File Deletion
        LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Standard Port
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Non-Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
        Application Layer Protocol
        Traffic DuplicationData Destruction
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1582471 Sample: boatnet.sh4.elf Startdate: 30/12/2024 Architecture: LINUX Score: 76 24 154.216.17.216, 35354, 35356, 35358 SKHT-ASShenzhenKatherineHengTechnologyInformationCo Seychelles 2->24 26 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->26 28 daisy.ubuntu.com 2->28 30 Malicious sample detected (through community Yara rule) 2->30 32 Antivirus / Scanner detection for submitted sample 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected Mirai 2->36 7 dash rm boatnet.sh4.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 dash rm 2->11         started        13 15 other processes 2->13 signatures3 process4 process5 15 boatnet.sh4.elf 7->15         started        18 boatnet.sh4.elf 7->18         started        20 boatnet.sh4.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 38 Sample tries to kill multiple processes (SIGKILL) 15->38

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        boatnet.sh4.elf66%ReversingLabsLinux.Trojan.Mirai
        boatnet.sh4.elf100%AviraEXP/ELF.Mirai.Z.A
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.25
        truefalse
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          185.125.190.26
          unknownUnited Kingdom
          41231CANONICAL-ASGBfalse
          154.216.17.216
          unknownSeychelles
          135357SKHT-ASShenzhenKatherineHengTechnologyInformationCofalse
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          185.125.190.26dlr.ppc.elfGet hashmaliciousUnknownBrowse
            wkb86.elfGet hashmaliciousMiraiBrowse
              dlr.mpsl.elfGet hashmaliciousUnknownBrowse
                debug.dbg.elfGet hashmaliciousMirai, MoobotBrowse
                  x86.elfGet hashmaliciousUnknownBrowse
                    dlr.arm6.elfGet hashmaliciousUnknownBrowse
                      Aqua.arm6.elfGet hashmaliciousUnknownBrowse
                        Aqua.arm4.elfGet hashmaliciousUnknownBrowse
                          Aqua.ppc.elfGet hashmaliciousUnknownBrowse
                            arm5.elfGet hashmaliciousUnknownBrowse
                              154.216.17.216154.216.17.216-boatnet.mips-2024-12-29T22_41_29.elfGet hashmaliciousMiraiBrowse
                                g082Q9DajU.exeGet hashmaliciousPureCrypter, LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, PureLog StealerBrowse
                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  daisy.ubuntu.comfenty.arm6.elfGet hashmaliciousMiraiBrowse
                                  • 162.213.35.25
                                  vcimanagement.i586.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.25
                                  vcimanagement.armv4l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.25
                                  vcimanagement.armv7l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.24
                                  bin.sh.elfGet hashmaliciousMiraiBrowse
                                  • 162.213.35.25
                                  vcimanagement.powerpc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.25
                                  vcimanagement.armv6l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 162.213.35.25
                                  vcimanagement.arm.elfGet hashmaliciousMiraiBrowse
                                  • 162.213.35.24
                                  vcimanagement.arm6.elfGet hashmaliciousMiraiBrowse
                                  • 162.213.35.24
                                  vcimanagement.ppc.elfGet hashmaliciousMiraiBrowse
                                  • 162.213.35.25
                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  SKHT-ASShenzhenKatherineHengTechnologyInformationCo154.216.17.216-boatnet.mips-2024-12-29T22_41_29.elfGet hashmaliciousMiraiBrowse
                                  • 154.216.17.216
                                  vcimanagement.armv4l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 156.226.9.167
                                  vcimanagement.mips.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  • 156.254.70.178
                                  db0fa4b8db0333367e9bda3ab68b8042.spc.elfGet hashmaliciousMirai, GafgytBrowse
                                  • 156.230.19.172
                                  byte.arm.elfGet hashmaliciousMirai, OkiruBrowse
                                  • 154.216.19.138
                                  byte.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                  • 154.216.19.138
                                  byte.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                  • 154.216.19.138
                                  byte.sh4.elfGet hashmaliciousMirai, OkiruBrowse
                                  • 154.216.19.138
                                  INV-#0020242312.docGet hashmaliciousAsyncRAT, DarkTortilla, VenomRATBrowse
                                  • 154.216.18.37
                                  Space.x86.elfGet hashmaliciousUnknownBrowse
                                  • 154.216.20.216
                                  CANONICAL-ASGBboatnet.arc.elfGet hashmaliciousMiraiBrowse
                                  • 91.189.91.42
                                  dlr.ppc.elfGet hashmaliciousUnknownBrowse
                                  • 185.125.190.26
                                  dlr.arm7.elfGet hashmaliciousUnknownBrowse
                                  • 91.189.91.42
                                  154.216.17.216-boatnet.mips-2024-12-29T22_41_29.elfGet hashmaliciousMiraiBrowse
                                  • 91.189.91.42
                                  i.elfGet hashmaliciousUnknownBrowse
                                  • 91.189.91.42
                                  fenty.arm5.elfGet hashmaliciousMiraiBrowse
                                  • 91.189.91.42
                                  fs_elf_64.elfGet hashmaliciousUnknownBrowse
                                  • 91.189.91.42
                                  arm5.elfGet hashmaliciousUnknownBrowse
                                  • 91.189.91.42
                                  tftp.elfGet hashmaliciousUnknownBrowse
                                  • 91.189.91.42
                                  i.elfGet hashmaliciousUnknownBrowse
                                  • 91.189.91.42
                                  No context
                                  No context
                                  Process:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                  File Type:XML 1.0 document, ASCII text
                                  Category:dropped
                                  Size (bytes):5128
                                  Entropy (8bit):4.457618060812407
                                  Encrypted:false
                                  SSDEEP:96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
                                  MD5:2A2A7C34B585CDAE5E123F3C5100C253
                                  SHA1:E814B1B1531B25581DB76CB813C85E53E1390BA4
                                  SHA-256:BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
                                  SHA-512:CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
                                  Malicious:false
                                  Reputation:moderate, very likely benign file
                                  Preview:<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in
                                  File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
                                  Entropy (8bit):6.825557135490595
                                  TrID:
                                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                  File name:boatnet.sh4.elf
                                  File size:62'772 bytes
                                  MD5:ac9f79ebb02ef6e893608530021c5fd2
                                  SHA1:d8d6cc98c6e73e01714f9a5cca8a3f8b5d2b8411
                                  SHA256:3d9bd6fbe589741a32a08bd9068e0b40245b7c43b90ae9f108a7ea0de0bf5850
                                  SHA512:1088242f80ff4642c5a4215653c23586c458904aede1c5009f650cd952b431ce6f4feeb05f03d03bd02d9b631e9ecce232c73472f9a4e7f42bef30a393ae5e58
                                  SSDEEP:1536:KaC0m76KhqnMfL13x4ecBK9FTJ58WxCnFjzl:KKmGKzL13HcI9l8Wxkzl
                                  TLSH:EA538C36E4296D84C157417474AC8F751F53F2C853036EBB19E682BA6843CACFA06FE4
                                  File Content Preview:.ELF..............*.......@.4...........4. ...(...............@...@...........................A...A.d....&..........Q.td............................././"O.n........#.*@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

                                  ELF header

                                  Class:ELF32
                                  Data:2's complement, little endian
                                  Version:1 (current)
                                  Machine:<unknown>
                                  Version Number:0x1
                                  Type:EXEC (Executable file)
                                  OS/ABI:UNIX - System V
                                  ABI Version:0
                                  Entry Point Address:0x4001a0
                                  Flags:0x9
                                  ELF Header Size:52
                                  Program Header Offset:52
                                  Program Header Size:32
                                  Number of Program Headers:3
                                  Section Header Offset:62372
                                  Section Header Size:40
                                  Number of Section Headers:10
                                  Header String Table Index:9
                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                  NULL0x00x00x00x00x0000
                                  .initPROGBITS0x4000940x940x300x00x6AX004
                                  .textPROGBITS0x4000e00xe00xcd200x00x6AX0032
                                  .finiPROGBITS0x40ce000xce000x240x00x6AX004
                                  .rodataPROGBITS0x40ce240xce240x1ed40x00x2A004
                                  .ctorsPROGBITS0x41f0000xf0000x80x00x3WA004
                                  .dtorsPROGBITS0x41f0080xf0080x80x00x3WA004
                                  .dataPROGBITS0x41f0140xf0140x3500x00x3WA004
                                  .bssNOBITS0x41f3640xf3640x231c0x00x3WA004
                                  .shstrtabSTRTAB0x00xf3640x3e0x00x0001
                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                  LOAD0x00x4000000x4000000xecf80xecf86.92380x5R E0x10000.init .text .fini .rodata
                                  LOAD0xf0000x41f0000x41f0000x3640x26802.72880x6RW 0x10000.ctors .dtors .data .bss
                                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                  TimestampSource PortDest PortSource IPDest IP
                                  Dec 30, 2024 17:43:55.622912884 CET353543778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:55.627859116 CET377835354154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:55.627918005 CET353543778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:55.682877064 CET353543778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:55.687761068 CET377835354154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:55.687827110 CET353543778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:55.692648888 CET377835354154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.307277918 CET377835354154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.307471037 CET353543778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.307607889 CET353543778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.308307886 CET353563778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.313122034 CET377835356154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.313174963 CET353563778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.314160109 CET353563778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.318905115 CET377835356154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.318974972 CET353563778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.323767900 CET377835356154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.966075897 CET377835356154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.966176987 CET353563778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.966207981 CET353563778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.966905117 CET353583778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.971715927 CET377835358154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.971790075 CET353583778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.972721100 CET353583778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.977468967 CET377835358154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:56.977516890 CET353583778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:56.982323885 CET377835358154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:57.649830103 CET377835358154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:57.649924040 CET353583778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:57.650053024 CET353583778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:57.650547981 CET353603778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:57.656255007 CET377835360154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:57.656316042 CET353603778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:57.657004118 CET353603778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:57.661750078 CET377835360154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:57.661811113 CET353603778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:57.666668892 CET377835360154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:58.332482100 CET377835360154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:58.332601070 CET353603778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.332804918 CET353603778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.333259106 CET353623778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.338104963 CET377835362154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:58.338154078 CET353623778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.338910103 CET353623778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.343686104 CET377835362154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:58.343750954 CET353623778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.348490000 CET377835362154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:58.994637012 CET377835362154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:58.994887114 CET353623778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.994923115 CET353623778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:58.995469093 CET353643778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.000251055 CET377835364154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:59.000329018 CET353643778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.001039982 CET353643778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.005860090 CET377835364154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:59.005918980 CET353643778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.010674953 CET377835364154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:59.682332039 CET377835364154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:59.682562113 CET353643778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.682580948 CET353643778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.683078051 CET353663778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.687856913 CET377835366154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:59.687906981 CET353663778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.688633919 CET353663778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.693413973 CET377835366154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:43:59.693461895 CET353663778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:43:59.698262930 CET377835366154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:44:00.347506046 CET377835366154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:44:00.347747087 CET353663778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:00.347747087 CET353663778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:00.348186016 CET353683778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:00.352936983 CET377835368154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:44:00.352986097 CET353683778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:00.353708982 CET353683778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:00.358525991 CET377835368154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:44:00.358575106 CET353683778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:00.363408089 CET377835368154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:44:01.015774965 CET377835368154.216.17.216192.168.2.13
                                  Dec 30, 2024 17:44:01.015822887 CET353683778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:01.054094076 CET353683778192.168.2.13154.216.17.216
                                  Dec 30, 2024 17:44:05.823996067 CET48202443192.168.2.13185.125.190.26
                                  Dec 30, 2024 17:44:36.800110102 CET48202443192.168.2.13185.125.190.26
                                  TimestampSource PortDest PortSource IPDest IP
                                  Dec 30, 2024 17:46:40.108098030 CET4082153192.168.2.131.1.1.1
                                  Dec 30, 2024 17:46:40.108167887 CET5919253192.168.2.131.1.1.1
                                  Dec 30, 2024 17:46:40.115325928 CET53591921.1.1.1192.168.2.13
                                  Dec 30, 2024 17:46:40.115345955 CET53408211.1.1.1192.168.2.13
                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Dec 30, 2024 17:46:40.108098030 CET192.168.2.131.1.1.10x16f1Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                  Dec 30, 2024 17:46:40.108167887 CET192.168.2.131.1.1.10x6ebaStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Dec 30, 2024 17:46:40.115345955 CET1.1.1.1192.168.2.130x16f1No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                  Dec 30, 2024 17:46:40.115345955 CET1.1.1.1192.168.2.130x16f1No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                                  System Behavior

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/rm
                                  Arguments:rm -f /tmp/tmp.H8diMwwaUH /tmp/tmp.hW8QZZa0nD /tmp/tmp.UEYc5XnOiL
                                  File size:72056 bytes
                                  MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/cat
                                  Arguments:cat /tmp/tmp.H8diMwwaUH
                                  File size:43416 bytes
                                  MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/head
                                  Arguments:head -n 10
                                  File size:47480 bytes
                                  MD5 hash:fd96a67145172477dd57131396fc9608

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/tr
                                  Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                  File size:51544 bytes
                                  MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/cut
                                  Arguments:cut -c -80
                                  File size:47480 bytes
                                  MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/cat
                                  Arguments:cat /tmp/tmp.H8diMwwaUH
                                  File size:43416 bytes
                                  MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/head
                                  Arguments:head -n 10
                                  File size:47480 bytes
                                  MD5 hash:fd96a67145172477dd57131396fc9608

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/tr
                                  Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                  File size:51544 bytes
                                  MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/cut
                                  Arguments:cut -c -80
                                  File size:47480 bytes
                                  MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dash
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):16:43:46
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/rm
                                  Arguments:rm -f /tmp/tmp.H8diMwwaUH /tmp/tmp.hW8QZZa0nD /tmp/tmp.UEYc5XnOiL
                                  File size:72056 bytes
                                  MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                  Start time (UTC):16:43:55
                                  Start date (UTC):30/12/2024
                                  Path:/tmp/boatnet.sh4.elf
                                  Arguments:/tmp/boatnet.sh4.elf
                                  File size:4139976 bytes
                                  MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                                  Start time (UTC):16:43:55
                                  Start date (UTC):30/12/2024
                                  Path:/tmp/boatnet.sh4.elf
                                  Arguments:-
                                  File size:4139976 bytes
                                  MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                                  Start time (UTC):16:43:55
                                  Start date (UTC):30/12/2024
                                  Path:/tmp/boatnet.sh4.elf
                                  Arguments:-
                                  File size:4139976 bytes
                                  MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                                  Start time (UTC):16:43:55
                                  Start date (UTC):30/12/2024
                                  Path:/tmp/boatnet.sh4.elf
                                  Arguments:-
                                  File size:4139976 bytes
                                  MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/xfce4-panel
                                  Arguments:-
                                  File size:375768 bytes
                                  MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                                  File size:35136 bytes
                                  MD5 hash:ac0b8a906f359a8ae102244738682e76

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/xfce4-panel
                                  Arguments:-
                                  File size:375768 bytes
                                  MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                                  File size:35136 bytes
                                  MD5 hash:ac0b8a906f359a8ae102244738682e76

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/xfce4-panel
                                  Arguments:-
                                  File size:375768 bytes
                                  MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                                  File size:35136 bytes
                                  MD5 hash:ac0b8a906f359a8ae102244738682e76

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/xfce4-panel
                                  Arguments:-
                                  File size:375768 bytes
                                  MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                                  File size:35136 bytes
                                  MD5 hash:ac0b8a906f359a8ae102244738682e76

                                  Start time (UTC):16:44:06
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                  Arguments:-
                                  File size:35136 bytes
                                  MD5 hash:ac0b8a906f359a8ae102244738682e76

                                  Start time (UTC):16:44:06
                                  Start date (UTC):30/12/2024
                                  Path:/usr/sbin/xfpm-power-backlight-helper
                                  Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
                                  File size:14656 bytes
                                  MD5 hash:3d221ad23f28ca3259f599b1664e2427

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/xfce4-panel
                                  Arguments:-
                                  File size:375768 bytes
                                  MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                                  File size:35136 bytes
                                  MD5 hash:ac0b8a906f359a8ae102244738682e76

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/xfce4-panel
                                  Arguments:-
                                  File size:375768 bytes
                                  MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                  Start time (UTC):16:44:00
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                                  File size:35136 bytes
                                  MD5 hash:ac0b8a906f359a8ae102244738682e76

                                  Start time (UTC):16:44:06
                                  Start date (UTC):30/12/2024
                                  Path:/usr/bin/dbus-daemon
                                  Arguments:-
                                  File size:249032 bytes
                                  MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                                  Start time (UTC):16:44:06
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                  File size:112880 bytes
                                  MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9

                                  Start time (UTC):16:44:09
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/systemd/systemd
                                  Arguments:-
                                  File size:1620224 bytes
                                  MD5 hash:9b2bec7092a40488108543f9334aab75

                                  Start time (UTC):16:44:09
                                  Start date (UTC):30/12/2024
                                  Path:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                                  Arguments:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                                  File size:112872 bytes
                                  MD5 hash:eee956f1b227c1d5031f9c61223255d1