Edit tour

Linux Analysis Report
boatnet.arm7.elf

Overview

General Information

Sample name:boatnet.arm7.elf
Analysis ID:1641126
MD5:c611f8b2b5795a97df87493acdce7a4c
SHA1:11be42642b3c23b003fcb7b3734cfb8a491c70d7
SHA256:875b1cf545c632bb88ab16e611a16caf086324ea8971e125d47e613105aa67ad
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1641126
Start date and time:2025-03-18 03:22:43 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 59s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.arm7.elf
Detection:MAL
Classification:mal72.spre.troj.evad.linELF@0/0@2/0
Command:/tmp/boatnet.arm7.elf
PID:5522
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5533, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5534, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5535, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5536, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 5553, Parent: 5536, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 5537, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5538, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 5555, Parent: 5554, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • systemd New Fork (PID: 5564, Parent: 3044)
  • xfce4-notifyd (PID: 5564, Parent: 3044, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x11dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x12344:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x11dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      Click to see the 10 entries
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: boatnet.arm7.elfVirustotal: Detection: 55%Perma Link
      Source: boatnet.arm7.elfReversingLabs: Detection: 58%
      Source: global trafficTCP traffic: 192.168.2.15:56832 -> 209.141.36.93:3778
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
      Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
      Source: boatnet.arm7.elfString found in binary or memory: http://upx.sf.net

      System Summary

      barindex
      Source: 5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5522.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5522.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: boatnet.arm7.elf PID: 5525, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: boatnet.arm7.elf PID: 5525, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: boatnet.arm7.elf PID: 5527, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: boatnet.arm7.elf PID: 5527, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3192, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3249, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3250, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3251, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3252, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3253, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3255, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3272, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3274, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3298, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5527, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5533, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5534, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5535, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5536, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5537, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5538, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5555, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5564, result: successfulJump to behavior
      Source: LOAD without section mappingsProgram segment: 0x8000
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3192, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3249, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3250, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3251, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3252, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3253, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3255, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3272, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3274, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 3298, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5527, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5533, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5534, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5535, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5536, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5537, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5538, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5555, result: successfulJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)SIGKILL sent: pid: 5564, result: successfulJump to behavior
      Source: 5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5522.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5522.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm7.elf PID: 5525, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm7.elf PID: 5525, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm7.elf PID: 5527, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm7.elf PID: 5527, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: classification engineClassification label: mal72.spre.troj.evad.linELF@0/0@2/0

      Data Obfuscation

      barindex
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5533)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5534)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /home/saturnino/.fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/X11/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /home/saturnino/.fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/X11/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /home/saturnino/.fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/X11/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /home/saturnino/.cacheJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /home/saturnino/.localJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Directory: /home/saturnino/.configJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /home/saturnino/.fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/X11/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5555)Directory: /home/saturnino/.cacheJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5555)Directory: /home/saturnino/.localJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5555)Directory: /home/saturnino/.configJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5555)Directory: /home/saturnino/.configJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5564)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5564)Directory: /home/saturnino/.cacheJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5564)Directory: /home/saturnino/.localJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5564)Directory: /home/saturnino/.configJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5660/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1185/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3241/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3483/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1732/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1730/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1333/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1695/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3235/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3234/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5533/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/911/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/515/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5534/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5535/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5536/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/914/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1617/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5537/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5538/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1615/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/917/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3255/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3253/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1591/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3252/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3251/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3250/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1623/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1588/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3249/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/764/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3368/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1585/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3246/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3488/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/766/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/800/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/888/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/802/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1509/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3885/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/803/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/804/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3800/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3801/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1867/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3407/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3802/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5564/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1484/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/490/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1514/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1634/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1479/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1875/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/654/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3379/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/655/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/656/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/777/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/931/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1595/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/657/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5555/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/812/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/779/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/658/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/933/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/418/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/419/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3419/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3310/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3275/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3274/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3273/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3394/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3272/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/782/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3303/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1762/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3027/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3709/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1486/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/789/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1806/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/5464/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1660/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3440/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/793/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/794/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3316/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/674/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/796/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/675/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/676/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1498/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1497/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1496/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3157/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3278/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3399/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3799/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/1659/cmdlineJump to behavior
      Source: /tmp/boatnet.arm7.elf (PID: 5524)File opened: /proc/3332/cmdlineJump to behavior
      Source: boatnet.arm7.elfSubmission file: segment LOAD with 7.9537 entropy (max. 8.0)
      Source: /tmp/boatnet.arm7.elf (PID: 5522)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5533)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5534)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5535)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5536)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5537)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5538)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5564)Queries kernel information via 'uname': Jump to behavior
      Source: boatnet.arm7.elf, 5522.1.00005642480ae000.000056424827c000.rw-.sdmp, boatnet.arm7.elf, 5525.1.00005642480ae000.000056424827c000.rw-.sdmp, boatnet.arm7.elf, 5527.1.00005642480ae000.000056424827c000.rw-.sdmpBinary or memory string: HBV!/etc/qemu-binfmt/arm
      Source: boatnet.arm7.elf, 5522.1.00005642480ae000.000056424827c000.rw-.sdmp, boatnet.arm7.elf, 5525.1.00005642480ae000.000056424827c000.rw-.sdmp, boatnet.arm7.elf, 5527.1.00005642480ae000.000056424827c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
      Source: boatnet.arm7.elf, 5522.1.00007ffc88947000.00007ffc88968000.rw-.sdmp, boatnet.arm7.elf, 5525.1.00007ffc88947000.00007ffc88968000.rw-.sdmp, boatnet.arm7.elf, 5527.1.00007ffc88947000.00007ffc88968000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
      Source: boatnet.arm7.elf, 5522.1.00007ffc88947000.00007ffc88968000.rw-.sdmp, boatnet.arm7.elf, 5525.1.00007ffc88947000.00007ffc88968000.rw-.sdmp, boatnet.arm7.elf, 5527.1.00007ffc88947000.00007ffc88968000.rw-.sdmpBinary or memory string: jx86_64/usr/bin/qemu-arm/tmp/boatnet.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.arm7.elf

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5522.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: boatnet.arm7.elf PID: 5525, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: boatnet.arm7.elf PID: 5527, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 5527.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5525.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5522.1.00007f22c8017000.00007f22c802b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: boatnet.arm7.elf PID: 5525, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: boatnet.arm7.elf PID: 5527, type: MEMORYSTR
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
      Hidden Files and Directories
      1
      OS Credential Dumping
      11
      Security Software Discovery
      Remote ServicesData from Local System1
      Non-Standard Port
      Exfiltration Over Other Network Medium1
      Service Stop
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
      Obfuscated Files or Information
      LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
      Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1641126 Sample: boatnet.arm7.elf Startdate: 18/03/2025 Architecture: LINUX Score: 72 24 209.141.36.93, 3778, 56832, 56834 PONYNETUS United States 2->24 26 daisy.ubuntu.com 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 34 Sample is packed with UPX 2->34 7 boatnet.arm7.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 6 other processes 2->13 signatures3 process4 process5 15 boatnet.arm7.elf 7->15         started        18 boatnet.arm7.elf 7->18         started        20 boatnet.arm7.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 36 Sample tries to kill multiple processes (SIGKILL) 15->36

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      boatnet.arm7.elf56%VirustotalBrowse
      boatnet.arm7.elf58%ReversingLabsLinux.Backdoor.Mirai
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches

      Download Network PCAP: filteredfull

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      162.213.35.24
      truefalse
        high
        NameSourceMaliciousAntivirus DetectionReputation
        http://upx.sf.netboatnet.arm7.elffalse
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          209.141.36.93
          unknownUnited States
          53667PONYNETUSfalse
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          209.141.36.93boatnet.ppc.elfGet hashmaliciousMiraiBrowse
            boatnet.mips.elfGet hashmaliciousMiraiBrowse
              boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                daisy.ubuntu.comboatnet.ppc.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                kworker.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                sync.arm6.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                sync.arm5.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                .i.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                gigab.arm5.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                sync.x86.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                resgod.x86.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                gigab.ppc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                sshd.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                PONYNETUSboatnet.ppc.elfGet hashmaliciousMiraiBrowse
                • 209.141.36.93
                kworker.elfGet hashmaliciousUnknownBrowse
                • 198.98.48.4
                arm.elfGet hashmaliciousMiraiBrowse
                • 107.189.4.201
                mpsl.elfGet hashmaliciousMiraiBrowse
                • 107.189.4.201
                arm7.elfGet hashmaliciousMiraiBrowse
                • 107.189.4.201
                Q3N5HdmTIp.exeGet hashmaliciousUnknownBrowse
                • 107.189.1.160
                Space.m68k.elfGet hashmaliciousMiraiBrowse
                • 209.141.59.9
                Space.x86.elfGet hashmaliciousUnknownBrowse
                • 209.141.59.9
                Space.ppc.elfGet hashmaliciousUnknownBrowse
                • 209.141.59.9
                Space.i686.elfGet hashmaliciousUnknownBrowse
                • 209.141.59.9
                No context
                No context
                No created / dropped files found
                File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
                Entropy (8bit):7.974116162771522
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:boatnet.arm7.elf
                File size:46'672 bytes
                MD5:c611f8b2b5795a97df87493acdce7a4c
                SHA1:11be42642b3c23b003fcb7b3734cfb8a491c70d7
                SHA256:875b1cf545c632bb88ab16e611a16caf086324ea8971e125d47e613105aa67ad
                SHA512:b47854ef712190ecd06ea0c555cf179d0ca76fe218c7c49db21ddce38ef7cb94d8020d4964f61ff37fd69a6e1d0d4f204afc86de716d0c7eb170fc40131cbf52
                SSDEEP:768:F/TYCoIxdEk+AxoTZAZHFeq8b339q3UELALZFk5JXYocwfvXPcZ0P7i:FECFd+A6YHAxGLvZfvXO0ji
                TLSH:1B23F111E60F987358A01C3389EDD257BBE219F4C52B7133D734C9082E6EAB3A9A55C9
                File Content Preview:.ELF..............(.....H...4...........4. ...(.....................5{..5{..............dd..dd..dd..................Q.td...............................OUPX!....................h..........?.E.h;....#..$...o.....D...X....Awk]5a......YMS4I......!..m.,*.g....

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:ARM
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - Linux
                ABI Version:0
                Entry Point Address:0xe948
                Flags:0x4000002
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:0
                Section Header Size:40
                Number of Section Headers:0
                Header String Table Index:0
                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x80000x80000x7b350x7b357.95370x5R E0x8000
                LOAD0x64640x264640x264640x00x00.00000x6RW 0x8000
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                Download Network PCAP: filteredfull

                • Total Packets: 62
                • 3778 undefined
                • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Mar 18, 2025 03:23:29.661053896 CET568323778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:29.667095900 CET377856832209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:29.667144060 CET568323778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:29.692995071 CET568323778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:29.697789907 CET377856832209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:29.697841883 CET568323778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:29.702511072 CET377856832209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.258419991 CET377856832209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.258774996 CET568323778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.258774996 CET568323778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.259357929 CET568343778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.264101028 CET377856834209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.264179945 CET568343778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.265003920 CET568343778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.269654989 CET377856834209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.269704103 CET568343778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.274399042 CET377856834209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.839831114 CET377856834209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.840137005 CET568343778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.840137005 CET568343778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.840625048 CET568363778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.845341921 CET377856836209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.845462084 CET568363778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.846227884 CET568363778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.850913048 CET377856836209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:30.850995064 CET568363778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:30.855679989 CET377856836209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:31.415597916 CET377856836209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:31.415720940 CET568363778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.415776014 CET568363778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.416347027 CET568383778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.421058893 CET377856838209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:31.421123028 CET568383778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.421960115 CET568383778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.426599026 CET377856838209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:31.426637888 CET568383778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.431303024 CET377856838209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:31.990030050 CET377856838209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:31.990161896 CET568383778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.990364075 CET568383778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.990880966 CET568403778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.995621920 CET377856840209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:31.995680094 CET568403778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:31.996499062 CET568403778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.001513958 CET377856840209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:32.001560926 CET568403778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.006268024 CET377856840209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:32.577327013 CET377856840209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:32.577455044 CET568403778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.577569008 CET568403778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.578336000 CET568423778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.584750891 CET377856842209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:32.584813118 CET568423778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.585736990 CET568423778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.593889952 CET377856842209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:32.593935966 CET568423778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:32.602081060 CET377856842209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.183866024 CET377856842209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.184123993 CET568423778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.184164047 CET568423778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.184757948 CET568443778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.189481020 CET377856844209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.189541101 CET568443778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.190435886 CET568443778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.195153952 CET377856844209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.195202112 CET568443778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.199884892 CET377856844209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.771286011 CET377856844209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.771641016 CET568443778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.771641016 CET568443778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.772358894 CET568463778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.777044058 CET377856846209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.777098894 CET568463778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.777853012 CET568463778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.782502890 CET377856846209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:33.782551050 CET568463778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:33.787249088 CET377856846209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.347853899 CET377856846209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.347989082 CET568463778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.348025084 CET568463778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.348788023 CET568483778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.353530884 CET377856848209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.353595018 CET568483778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.354407072 CET568483778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.359066963 CET377856848209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.359116077 CET568483778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.363742113 CET377856848209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.934030056 CET377856848209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.934096098 CET568483778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.934120893 CET568483778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.934649944 CET568503778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.939369917 CET377856850209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.939434052 CET568503778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.941483021 CET568503778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.946190119 CET377856850209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:34.946254015 CET568503778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:34.950951099 CET377856850209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:35.231874943 CET568503778192.168.2.15209.141.36.93
                Mar 18, 2025 03:23:35.283058882 CET377856850209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:35.366693020 CET377856850209.141.36.93192.168.2.15
                Mar 18, 2025 03:23:35.366777897 CET568503778192.168.2.15209.141.36.93
                TimestampSource PortDest PortSource IPDest IP
                Mar 18, 2025 03:26:15.875117064 CET4153453192.168.2.151.1.1.1
                Mar 18, 2025 03:26:15.875174046 CET4468753192.168.2.151.1.1.1
                Mar 18, 2025 03:26:15.881650925 CET53446871.1.1.1192.168.2.15
                Mar 18, 2025 03:26:15.882603884 CET53415341.1.1.1192.168.2.15
                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Mar 18, 2025 03:26:15.875117064 CET192.168.2.151.1.1.10x3b7aStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                Mar 18, 2025 03:26:15.875174046 CET192.168.2.151.1.1.10xdc94Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Mar 18, 2025 03:26:15.882603884 CET1.1.1.1192.168.2.150x3b7aNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                Mar 18, 2025 03:26:15.882603884 CET1.1.1.1192.168.2.150x3b7aNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                System Behavior

                Start time (UTC):02:23:28
                Start date (UTC):18/03/2025
                Path:/tmp/boatnet.arm7.elf
                Arguments:/tmp/boatnet.arm7.elf
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                Start time (UTC):02:23:28
                Start date (UTC):18/03/2025
                Path:/tmp/boatnet.arm7.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                Start time (UTC):02:23:28
                Start date (UTC):18/03/2025
                Path:/tmp/boatnet.arm7.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                Start time (UTC):02:23:28
                Start date (UTC):18/03/2025
                Path:/tmp/boatnet.arm7.elf
                Arguments:-
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):02:23:33
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):02:23:39
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:-
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):02:23:39
                Start date (UTC):18/03/2025
                Path:/usr/sbin/xfpm-power-backlight-helper
                Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
                File size:14656 bytes
                MD5 hash:3d221ad23f28ca3259f599b1664e2427

                Start time (UTC):02:23:34
                Start date (UTC):18/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):02:23:34
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):02:23:34
                Start date (UTC):18/03/2025
                Path:/usr/bin/xfce4-panel
                Arguments:-
                File size:375768 bytes
                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                Start time (UTC):02:23:34
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                File size:35136 bytes
                MD5 hash:ac0b8a906f359a8ae102244738682e76

                Start time (UTC):02:23:39
                Start date (UTC):18/03/2025
                Path:/usr/bin/dbus-daemon
                Arguments:-
                File size:249032 bytes
                MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                Start time (UTC):02:23:39
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                File size:112880 bytes
                MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9

                Start time (UTC):02:23:43
                Start date (UTC):18/03/2025
                Path:/usr/lib/systemd/systemd
                Arguments:-
                File size:1620224 bytes
                MD5 hash:9b2bec7092a40488108543f9334aab75

                Start time (UTC):02:23:43
                Start date (UTC):18/03/2025
                Path:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                File size:112872 bytes
                MD5 hash:eee956f1b227c1d5031f9c61223255d1