Edit tour

Linux Analysis Report
boatnet.x86.elf

Overview

General Information

Sample name:boatnet.x86.elf
Analysis ID:1634974
MD5:d4e07ff0542f5183a06e57bf5f2f4a9f
SHA1:80de5bd0df449c15c321ce6275db806f025d6515
SHA256:976ab0137ae8871838459890d9924058f6ccbdff84bf26aa4bd8ec83496c5a82
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1634974
Start date and time:2025-03-11 08:52:25 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 1s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.x86.elf
Detection:MAL
Classification:mal72.spre.troj.evad.linELF@0/1@2/0
Command:/tmp/boatnet.x86.elf
PID:5433
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5447, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5448, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5449, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5450, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 5467, Parent: 5450, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 5451, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5452, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 5469, Parent: 5468, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • systemd New Fork (PID: 5478, Parent: 2935)
  • xfce4-notifyd (PID: 5478, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
boatnet.x86.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
  • 0x4417:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
SourceRuleDescriptionAuthorStrings
5433.1.0000000008048000.0000000008054000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    5433.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xa820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa85c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa870:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa884:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa898:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa8ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa8c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa974:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa99c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xa9b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    5433.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xad78:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    5433.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_b14f4c5dunknownunknown
    • 0x5990:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
    5433.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_88de437funknownunknown
    • 0x7d02:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
    Click to see the 22 entries
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: boatnet.x86.elfVirustotal: Detection: 51%Perma Link
    Source: boatnet.x86.elfReversingLabs: Detection: 63%
    Source: global trafficTCP traffic: 192.168.2.13:58058 -> 87.121.84.183:3778
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: unknownTCP traffic detected without corresponding DNS query: 87.121.84.183
    Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
    Source: boatnet.x86.elfString found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Source: boatnet.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3104, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3161, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3162, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3163, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3164, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3165, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3170, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3182, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3208, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3212, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5436, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5447, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5448, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5449, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5450, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5451, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5452, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5469, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5478, result: successfulJump to behavior
    Source: xfce4-panel.xml.new.31.drOLE indicator, VBA macros: true
    Source: xfce4-panel.xml.new.31.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
    Source: LOAD without section mappingsProgram segment: 0xc01000
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3104, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3161, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3162, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3163, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3164, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3165, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3170, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3182, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3208, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 3212, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5436, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5447, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5448, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5449, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5450, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5451, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5452, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5469, result: successfulJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)SIGKILL sent: pid: 5478, result: successfulJump to behavior
    Source: boatnet.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
    Source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
    Source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
    Source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
    Source: classification engineClassification label: mal72.spre.troj.evad.linELF@0/1@2/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5447)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /home/saturnino/.fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/X11/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.cacheJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.localJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Directory: /home/saturnino/.configJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /home/saturnino/.fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5469)Directory: /home/saturnino/.cacheJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5469)Directory: /home/saturnino/.localJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5469)Directory: /home/saturnino/.configJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5469)Directory: /home/saturnino/.configJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.cacheJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.localJump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Directory: /home/saturnino/.configJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3122/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5380/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3117/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3114/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/914/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/518/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/519/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5417/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5418/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/917/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5275/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3134/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3375/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3132/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3095/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1745/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1866/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1588/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/884/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1982/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/765/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3246/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/767/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/800/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1906/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/802/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/803/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1748/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3420/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1482/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/490/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1480/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1755/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1238/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1875/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/2964/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3413/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1751/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1872/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/2961/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1475/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/656/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/778/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/657/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/658/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/659/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3775/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5436/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/418/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/936/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/419/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/816/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1879/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5450/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5451/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5452/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1891/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3310/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3153/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/780/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/660/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1921/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/783/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1765/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/2974/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1400/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1884/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3424/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3708/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/2972/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3709/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3147/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/2970/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1881/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3146/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3300/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5447/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5568/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1805/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5448/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1925/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1804/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/5449/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1648/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1922/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3429/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3442/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3165/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3164/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3163/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3162/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/790/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3161/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/792/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/793/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/672/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1930/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/674/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/795/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/3315/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1411/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/2984/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/1410/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/797/cmdlineJump to behavior
    Source: /tmp/boatnet.x86.elf (PID: 5434)File opened: /proc/676/cmdlineJump to behavior
    Source: boatnet.x86.elfSubmission file: segment LOAD with 7.8483 entropy (max. 8.0)
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5447)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5451)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5452)Queries kernel information via 'uname': Jump to behavior
    Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5478)Queries kernel information via 'uname': Jump to behavior

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: 5433.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5435.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5436.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity Information1
    Scripting
    Valid AccountsWindows Management Instrumentation1
    Scripting
    Path Interception1
    Hidden Files and Directories
    1
    OS Credential Dumping
    1
    Security Software Discovery
    Remote ServicesData from Local System1
    Non-Standard Port
    Exfiltration Over Other Network Medium1
    Service Stop
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
    Obfuscated Files or Information
    LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
    Application Layer Protocol
    Automated ExfiltrationData Encrypted for Impact
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1634974 Sample: boatnet.x86.elf Startdate: 11/03/2025 Architecture: LINUX Score: 72 24 87.121.84.183, 3778, 58058, 58060 SKATTV-ASBG Bulgaria 2->24 26 daisy.ubuntu.com 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 34 Sample is packed with UPX 2->34 7 boatnet.x86.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 6 other processes 2->13 signatures3 process4 process5 15 boatnet.x86.elf 7->15         started        18 boatnet.x86.elf 7->18         started        20 boatnet.x86.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 36 Sample tries to kill multiple processes (SIGKILL) 15->36

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    boatnet.x86.elf52%VirustotalBrowse
    boatnet.x86.elf63%ReversingLabsLinux.Backdoor.Mirai
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches

    Download Network PCAP: filteredfull

    NameIPActiveMaliciousAntivirus DetectionReputation
    daisy.ubuntu.com
    162.213.35.24
    truefalse
      high
      NameSourceMaliciousAntivirus DetectionReputation
      http://upx.sf.netboatnet.x86.elffalse
        high
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        87.121.84.183
        unknownBulgaria
        34577SKATTV-ASBGfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        87.121.84.183boatnet.ppc.elfGet hashmaliciousMiraiBrowse
          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
            boatnet.spc.elfGet hashmaliciousMiraiBrowse
              boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                daisy.ubuntu.comboatnet.ppc.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                cbr.arm6.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                cbr.sh4.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                cbr.arm7.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                cbr.mips.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                cbr.m68k.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                sshd.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                cbr.arc.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                cbr.x86.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                SKATTV-ASBGboatnet.ppc.elfGet hashmaliciousMiraiBrowse
                • 87.121.84.183
                boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                • 87.121.84.183
                boatnet.spc.elfGet hashmaliciousMiraiBrowse
                • 87.121.84.183
                boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                • 87.121.84.183
                yakov.mips.elfGet hashmaliciousMiraiBrowse
                • 87.120.53.122
                tftp.elfGet hashmaliciousUnknownBrowse
                • 87.121.84.89
                apache2.elfGet hashmaliciousUnknownBrowse
                • 87.121.84.89
                sshd.elfGet hashmaliciousUnknownBrowse
                • 87.121.84.89
                ftp.elfGet hashmaliciousUnknownBrowse
                • 87.121.84.89
                wget.elfGet hashmaliciousUnknownBrowse
                • 87.121.84.89
                No context
                No context
                Process:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                File Type:XML 1.0 document, ASCII text
                Category:dropped
                Size (bytes):5128
                Entropy (8bit):4.457618060812407
                Encrypted:false
                SSDEEP:96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
                MD5:2A2A7C34B585CDAE5E123F3C5100C253
                SHA1:E814B1B1531B25581DB76CB813C85E53E1390BA4
                SHA-256:BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
                SHA-512:CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
                Malicious:false
                Reputation:moderate, very likely benign file
                Preview:<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in
                File type:ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
                Entropy (8bit):7.844484218094543
                TrID:
                • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                File name:boatnet.x86.elf
                File size:21'500 bytes
                MD5:d4e07ff0542f5183a06e57bf5f2f4a9f
                SHA1:80de5bd0df449c15c321ce6275db806f025d6515
                SHA256:976ab0137ae8871838459890d9924058f6ccbdff84bf26aa4bd8ec83496c5a82
                SHA512:10576e9c2ce7a40441a8baf614caff93008f983a4606307262062fede555112b5c3f3509cb46ba94a2b1cae04d95ad6f40e63cc5a645dabfabc3d22cc99009e4
                SSDEEP:384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTg:O98o08kxofBE+ZkXaITbp2F2TWul0c5M
                TLSH:ABA2E019BF1C868BC8367A7555D9EAD21293FC61F29CCC0D6940D16FF0A33A92834F86
                File Content Preview:.ELF.....................Z..4...........4. ...(......................R...R...................G...G..................Q.td................................UPX!....................Y.......w....ELF.......d....g..4...34. (.....[..;;.F.@....'..6..f?..@..>....{?i

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:Intel 80386
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - Linux
                ABI Version:0
                Entry Point Address:0xc05af0
                Flags:0x0
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:0
                Section Header Size:40
                Number of Section Headers:0
                Header String Table Index:0
                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00xc010000xc010000x52fc0x52fc7.84830x5R E0x1000
                LOAD0x7a00x80547a00x80547a00x00x00.00000x6RW 0x1000
                GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                Download Network PCAP: filteredfull

                • Total Packets: 56
                • 3778 undefined
                • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Mar 11, 2025 08:53:15.743590117 CET580583778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:15.748584986 CET37785805887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:15.748642921 CET580583778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:15.748680115 CET580583778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:15.753483057 CET37785805887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:15.753530025 CET580583778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:15.758378029 CET37785805887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:16.373459101 CET37785805887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:16.373620987 CET580583778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:16.373620987 CET580583778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:16.373693943 CET580603778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:16.379091978 CET37785806087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:16.379200935 CET580603778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:16.379200935 CET580603778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:16.384000063 CET37785806087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:16.384077072 CET580603778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:16.389256954 CET37785806087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.031765938 CET37785806087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.032047987 CET580603778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.032047987 CET580603778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.032100916 CET580623778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.036956072 CET37785806287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.037035942 CET580623778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.037051916 CET580623778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.041913033 CET37785806287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.041975021 CET580623778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.046829939 CET37785806287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.720455885 CET37785806287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.720613956 CET580623778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.720613956 CET580623778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.720633030 CET580643778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.725564003 CET37785806487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.725652933 CET580643778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.725673914 CET580643778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.730556965 CET37785806487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:17.730614901 CET580643778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:17.735430002 CET37785806487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:18.394478083 CET37785806487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:18.394629002 CET580643778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:18.394728899 CET580643778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:18.394730091 CET580663778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:18.399629116 CET37785806687.121.84.183192.168.2.13
                Mar 11, 2025 08:53:18.399733067 CET580663778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:18.399768114 CET580663778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:18.404710054 CET37785806687.121.84.183192.168.2.13
                Mar 11, 2025 08:53:18.404764891 CET580663778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:18.409684896 CET37785806687.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.025516987 CET37785806687.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.025687933 CET580663778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.025687933 CET580663778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.025707960 CET580683778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.030740976 CET37785806887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.030865908 CET580683778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.030865908 CET580683778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.035734892 CET37785806887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.035859108 CET580683778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.040674925 CET37785806887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.667943954 CET37785806887.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.668085098 CET580683778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.668116093 CET580683778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.668152094 CET580703778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.673091888 CET37785807087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.673229933 CET580703778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.673252106 CET580703778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.678086042 CET37785807087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:19.678168058 CET580703778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:19.682996988 CET37785807087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.304480076 CET37785807087.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.304702997 CET580703778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.304702997 CET580703778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.304728985 CET580723778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.309670925 CET37785807287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.309796095 CET580723778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.309825897 CET580723778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.314656973 CET37785807287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.314713955 CET580723778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.319502115 CET37785807287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.946069956 CET37785807287.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.946140051 CET580723778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.946182013 CET580723778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.946223021 CET580743778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.951169968 CET37785807487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.951242924 CET580743778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.951261044 CET580743778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.956091881 CET37785807487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:20.956135035 CET580743778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:20.961044073 CET37785807487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:21.155061960 CET580743778192.168.2.1387.121.84.183
                Mar 11, 2025 08:53:21.203246117 CET37785807487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:21.408921003 CET37785807487.121.84.183192.168.2.13
                Mar 11, 2025 08:53:21.408991098 CET580743778192.168.2.1387.121.84.183
                TimestampSource PortDest PortSource IPDest IP
                Mar 11, 2025 08:56:00.139209986 CET4531253192.168.2.138.8.8.8
                Mar 11, 2025 08:56:00.139281988 CET6005653192.168.2.138.8.8.8
                Mar 11, 2025 08:56:00.145528078 CET53600568.8.8.8192.168.2.13
                Mar 11, 2025 08:56:00.145550013 CET53453128.8.8.8192.168.2.13
                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Mar 11, 2025 08:56:00.139209986 CET192.168.2.138.8.8.80x50a5Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                Mar 11, 2025 08:56:00.139281988 CET192.168.2.138.8.8.80xab8eStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Mar 11, 2025 08:56:00.145550013 CET8.8.8.8192.168.2.130x50a5No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                Mar 11, 2025 08:56:00.145550013 CET8.8.8.8192.168.2.130x50a5No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                System Behavior

                Start time (UTC):07:53:15
                Start date (UTC):11/03/2025
                Path:/tmp/boatnet.x86.elf
                Arguments:/tmp/boatnet.x86.elf
                File size:21500 bytes
                MD5 hash:d4e07ff0542f5183a06e57bf5f2f4a9f

                Start time (UTC):07:53:15
                Start date (UTC):11/03/2025
                Path:/tmp/boatnet.x86.elf
                Arguments:-
                File size:21500 bytes
                MD5 hash:d4e07ff0542f5183a06e57bf5f2f4a9f

                Start time (UTC):07:53:15
                Start date (UTC):11/03/2025
                Path:/tmp/boatnet.x86.elf
                Arguments:-
                File size:21500 bytes
                MD5 hash:d4e07ff0542f5183a06e57bf5f2f4a9f

                Start time (UTC):07:53:15
                Start date (UTC):11/03/2025
                Path:/tmp/boatnet.x86.elf
                Arguments:-
                File size:21500 bytes
                MD5 hash:d4e07ff0542f5183a06e57bf5f2f4a9f
                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):07:53:25
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:-
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):07:53:25
                Start date (UTC):11/03/2025
                Path:/usr/sbin/xfpm-power-backlight-helper
                Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
                File size:14656 bytes
                MD5 hash:3d221ad23f28ca3259f599b1664e2427

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):07:53:20
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):07:53:25
                Start date (UTC):11/03/2025
                Path:/usr/bin/dbus-daemon
                Arguments:-
                File size:249032 bytes
                MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                Start time (UTC):07:53:25
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                File size:112880 bytes
                MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9

                Start time (UTC):07:53:29
                Start date (UTC):11/03/2025
                Path:/usr/lib/systemd/systemd
                Arguments:-
                File size:1620224 bytes
                MD5 hash:9b2bec7092a40488108543f9334aab75

                Start time (UTC):07:53:29
                Start date (UTC):11/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                File size:112872 bytes
                MD5 hash:eee956f1b227c1d5031f9c61223255d1