Create Interactive Tour

Linux Analysis Report
vejfa5.elf

Overview

General Information

Sample name:	vejfa5.elf
Analysis ID:	1653071
MD5:	53b897d0d6102223eab60fd79737ae49
SHA1:	23a086d06400b955a5234c48439beff92f667f83
SHA256:	9d4d3ddf070509f7b3e7f509a4224563a6c5cfc6a00c0525b23105db8b61e02d
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Deletes system log files

Manipulation of devices in /dev

Reads system files that contain records of logged in users

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1653071
Start date and time:	2025-03-31 19:23:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vejfa5.elf
Detection:	MAL
Classification:	mal72.spre.troj.evad.linELF@0/4@6/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/vejfa5.elf
PID:	6231
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

vejfa5.elf (PID: 6231, Parent: 6152, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/vejfa5.elf

vejfa5.elf New Fork (PID: 6233, Parent: 6231)

vejfa5.elf New Fork (PID: 6235, Parent: 6233)

vejfa5.elf New Fork (PID: 6236, Parent: 6233)

vejfa5.elf New Fork (PID: 6238, Parent: 6233)

xfce4-panel New Fork (PID: 6243, Parent: 2063)

wrapper-2.0 (PID: 6243, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

dbus-daemon New Fork (PID: 6247, Parent: 6246)

xfconfd (PID: 6247, Parent: 6246, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

xfce4-panel New Fork (PID: 6251, Parent: 2063)

wrapper-2.0 (PID: 6251, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6252, Parent: 2063)

wrapper-2.0 (PID: 6252, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6257, Parent: 2063)

wrapper-2.0 (PID: 6257, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 6258, Parent: 2063)

wrapper-2.0 (PID: 6258, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6259, Parent: 2063)

wrapper-2.0 (PID: 6259, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dash New Fork (PID: 6300, Parent: 4334)

rm (PID: 6300, Parent: 4334, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bWrZvONhQN /tmp/tmp.CafzBXGPDx /tmp/tmp.CF8MkTlyQS

dash New Fork (PID: 6301, Parent: 4334)

cat (PID: 6301, Parent: 4334, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.bWrZvONhQN

dash New Fork (PID: 6302, Parent: 4334)

head (PID: 6302, Parent: 4334, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6303, Parent: 4334)

tr (PID: 6303, Parent: 4334, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6304, Parent: 4334)

cut (PID: 6304, Parent: 4334, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6305, Parent: 4334)

cat (PID: 6305, Parent: 4334, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.bWrZvONhQN

dash New Fork (PID: 6306, Parent: 4334)

head (PID: 6306, Parent: 4334, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6307, Parent: 4334)

tr (PID: 6307, Parent: 4334, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6308, Parent: 4334)

cut (PID: 6308, Parent: 4334, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6309, Parent: 4334)

rm (PID: 6309, Parent: 4334, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bWrZvONhQN /tmp/tmp.CafzBXGPDx /tmp/tmp.CF8MkTlyQS

gnome-session-binary New Fork (PID: 6336, Parent: 1477)

sh (PID: 6336, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6336, Parent: 1477, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6339, Parent: 1477)

sh (PID: 6339, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6339, Parent: 1477, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6340, Parent: 1477)

sh (PID: 6340, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6341, Parent: 1477)

sh (PID: 6341, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

dbus-daemon New Fork (PID: 6344, Parent: 6343)

xfconfd (PID: 6344, Parent: 6343, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

gdm3 New Fork (PID: 6345, Parent: 1320)

Default (PID: 6345, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6361, Parent: 1320)

Default (PID: 6361, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

xfce4-session New Fork (PID: 6369, Parent: 1900)

xfwm4 (PID: 6369, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

xfce4-session New Fork (PID: 6382, Parent: 1900)

xfce4-panel (PID: 6382, Parent: 1900, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2b4cc744e-8b9d-436f-9a4a-312b40faa2ec

xfce4-session New Fork (PID: 6383, Parent: 1900)

rm (PID: 6383, Parent: 1900, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /home/saturnino/.cache/sessions/Thunar-2ec9153f1-6fa0-4067-96b1-e5fe875b1e51

xfce4-session New Fork (PID: 6384, Parent: 1900)

xfdesktop (PID: 6384, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

dbus-daemon New Fork (PID: 6394, Parent: 6393)

xfconfd (PID: 6394, Parent: 6393, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

xfce4-session New Fork (PID: 6398, Parent: 1900)

xfwm4 (PID: 6398, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

xfce4-session New Fork (PID: 6399, Parent: 1900)

xfce4-panel (PID: 6399, Parent: 1900, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2b4cc744e-8b9d-436f-9a4a-312b40faa2ec

xfce4-panel New Fork (PID: 6421, Parent: 6399)

wrapper-2.0 (PID: 6421, Parent: 6399, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6422, Parent: 6399)

wrapper-2.0 (PID: 6422, Parent: 6399, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6423, Parent: 6399)

wrapper-2.0 (PID: 6423, Parent: 6399, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6424, Parent: 6399)

wrapper-2.0 (PID: 6424, Parent: 6399, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6471, Parent: 6424)

xfpm-power-backlight-helper (PID: 6471, Parent: 6424, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6425, Parent: 6399)

wrapper-2.0 (PID: 6425, Parent: 6399, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6429, Parent: 6399)

wrapper-2.0 (PID: 6429, Parent: 6399, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

xfce4-session New Fork (PID: 6400, Parent: 1900)

xfdesktop (PID: 6400, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-session New Fork (PID: 6412, Parent: 1900)

xfwm4 (PID: 6412, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

dbus-daemon New Fork (PID: 6414, Parent: 6413)

tumblerd (PID: 6414, Parent: 6413, MD5: 2ef099898845e9c5ec6f1a6fd3ad61af) Arguments: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd

xfce4-session New Fork (PID: 6426, Parent: 1900)

xfwm4 (PID: 6426, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

systemd New Fork (PID: 6450, Parent: 1860)

Thunar (PID: 6450, Parent: 1860, MD5: ca35dca6175038f11f012b29178a4f46) Arguments: /usr/bin/Thunar --daemon

xfce4-session New Fork (PID: 6451, Parent: 1900)

xfwm4 (PID: 6451, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

systemd New Fork (PID: 6480, Parent: 1860)

xfce4-notifyd (PID: 6480, Parent: 1860, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

systemd New Fork (PID: 6488, Parent: 1)

accounts-daemon (PID: 6488, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6501, Parent: 6488)

language-validate (PID: 6501, Parent: 6488, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6502, Parent: 6501)

language-options (PID: 6502, Parent: 6501, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6503, Parent: 6502)

sh (PID: 6503, Parent: 6502, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6504, Parent: 6503)

locale (PID: 6504, Parent: 6503, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6505, Parent: 6503)

grep (PID: 6505, Parent: 6503, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

cleanup

Joe Sandbox Signatures

• AV Detection
• Bitcoin Miner
• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: vejfa5.elf	Virustotal: Detection: 42%			Perma Link
Source: vejfa5.elf	ReversingLabs: Detection: 41%

Source: /usr/bin/xfwm4 (PID: 6369)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6414)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

Source: vejfa5.elf

String: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlnohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmux[watcher] deleted file: %s%s/%s/data/local/tmp/sbin/dev/null/dev/console/var/lib/dockerkworker/u8:0raw.awaken-network.net/proc/self/cmdline/proc/%d/statusName:-

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.awaken-network.net. [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:50622 -> 141.98.10.142:7733

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net
Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net. [malformed]

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6236, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6238, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6251, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6257, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6258, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6259, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 774, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1900, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2050, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2062, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2063, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2069, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2097, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2123, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2126, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6216, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6216, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6344, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6369, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6382, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6382, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6384, result: no such process	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6236, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6238, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6251, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6257, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6258, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6259, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 774, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 1900, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2050, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2062, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2063, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2069, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2097, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2123, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2126, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6216, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6216, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6344, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6369, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6382, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6382, result: no such process	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	SIGKILL sent: pid: 6384, result: no such process	Jump to behavior

Source: classification engine

Classification label: mal72.spre.troj.evad.linELF@0/4@6/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/vejfa5.elf (PID: 6238)

Deleted: /dev/kmsg

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6243)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6247)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6247)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6247)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6247)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6251)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6252)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6257)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6258)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6259)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6344)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6344)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6344)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6344)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.drirc	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6382)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6384)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6394)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6394)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6394)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6394)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.drirc	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6421)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6422)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior

Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/6236/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6235)	File opened: /proc/119/stat	Jump to behavior

Source: /usr/share/language-tools/language-options (PID: 6503)

Shell command executed: sh -c "locale -a | grep -F .utf8 "

Source: /bin/sh (PID: 6505)

Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/bin/dash (PID: 6300)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bWrZvONhQN /tmp/tmp.CafzBXGPDx /tmp/tmp.CF8MkTlyQS	Jump to behavior
Source: /usr/bin/dash (PID: 6309)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bWrZvONhQN /tmp/tmp.CafzBXGPDx /tmp/tmp.CF8MkTlyQS	Jump to behavior
Source: /usr/bin/xfce4-session (PID: 6383)	Rm executable: /usr/bin/rm -> rm -f /home/saturnino/.cache/sessions/Thunar-2ec9153f1-6fa0-4067-96b1-e5fe875b1e51	Jump to behavior

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6488)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6488)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/vejfa5.elf (PID: 6238)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/vejfa5.elf (PID: 6233)

File: /tmp/vejfa5.elf

Jump to behavior

Source: /usr/bin/xfwm4 (PID: 6369)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6414)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/vejfa5.elf (PID: 6231)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6243)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6251)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6252)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6257)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6258)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6259)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6369)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6382)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6384)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6398)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6399)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6421)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6422)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6423)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6424)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6425)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6429)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6400)	Queries kernel information via 'uname':
Source: /usr/bin/xfwm4 (PID: 6412)	Queries kernel information via 'uname':
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6414)	Queries kernel information via 'uname':
Source: /usr/bin/xfwm4 (PID: 6426)	Queries kernel information via 'uname':
Source: /usr/bin/Thunar (PID: 6450)	Queries kernel information via 'uname':
Source: /usr/bin/xfwm4 (PID: 6451)	Queries kernel information via 'uname':
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6480)	Queries kernel information via 'uname':

Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: /var/lib/vmware4/var/lib/PackageKit
Source: vejfa5.elf, 6238.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp	Binary or memory string: U1/var/log/speech-dispatcher!/tmp/snap.lxd/tmp1/tmp/vmware-root_721-42905598891/var/lib/php/modules/7.4
Source: vejfa5.elf, 6231.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp, vejfa5.elf, 6233.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp, vejfa5.elf, 6235.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp, vejfa5.elf, 6238.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: vejfa5.elf, 6238.1.00007fa3ec046000.00007fa3ec053000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_721-4290559889(
Source: vejfa5.elf	Binary or memory string: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlnohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmux[watcher] deleted file: %s%s/%s/data/local/tmp/sbin/dev/null/dev/console/var/lib/dockerkworker/u8:0raw.awaken-network.net/proc/self/cmdline/proc/%d/statusName:-
Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: vejfa5.elf, 6238.1.000055f5e7d19000.000055f5e7d40000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmtP
Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth4/var/lib/NetworkManagerLR
Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStore
Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: T/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/tmpX/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp$/tmp/vmware-root_721-4290559889\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-timedated.service-06eilf4/tmp/snap.lxd
Source: vejfa5.elf, 6231.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp, vejfa5.elf, 6233.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp, vejfa5.elf, 6235.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp, vejfa5.elf, 6238.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/vejfa5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vejfa5.elf
Source: vejfa5.elf, 6231.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp, vejfa5.elf, 6233.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp, vejfa5.elf, 6235.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp, vejfa5.elf, 6238.1.000055f5e7beb000.000055f5e7d19000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: vejfa5.elf, 6231.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.HWceXn
Source: vejfa5.elf, 6231.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp, vejfa5.elf, 6233.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp, vejfa5.elf, 6235.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp, vejfa5.elf, 6238.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: vejfa5.elf, 6231.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.HWceXn:%
Source: vejfa5.elf, 6238.1.000055f5e7d19000.000055f5e7d40000.rw-.sdmp	Binary or memory string: -keys-v1.d0!/var/lib/fwupd/builder!/var/lib/vmware/arm/var1/var/cache/dictionaries-common0!/var/lib/fwupd/pki1/var/lib/systemd/coredump
Source: vejfa5.elf, 6238.1.000055f5e7d19000.000055f5e7d40000.rw-.sdmp	Binary or memory string: !/var/lib/avahi-autoipd!/var/log/lightdmQ/var/lib/polkit-1/localauthority/50-local.dreP!/var/log/installerA/var/lib/polkit-1/localauthority/20-org.dhare/prereg/bua/var/lib/systemd/deb-systemd-helper-enabled/display-manager.service.wants0!/var/log/journal!/var/lib/sudo/lecturedrQ/var/lib/polkit-1/localauthority/30-site.d/etc/qemu-binfmtP!/var/lib/sgml-base3baee1/var/lib/unattended-upgradespolkit-1/lo!/var/lib/bluetooth!/var/lib/hp1/var/lib/dictionaries-commonhp!/var/lib/git1/var/lib/polkit-1/localauthorityk
Source: vejfa5.elf, 6238.1.00007fa3ec053000.00007fa3ec260000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: vejfa5.elf, 6238.1.000055f5e7d19000.000055f5e7d40000.rw-.sdmp	Binary or memory string: !/var/lib/PackageKit!/var/lib/lightdm-data!/var/lib/whoopsierm/varQ/var/lib/systemd/deb-systemd-helper-enabled/cloud-init.target.wants/var1/var/lib/cloud/instances0!/var/lib/fwupd!/var/lib/vmware/VGAuthr1/var/lib/vmware/VGAuth/aliasStore!/var/lib/fwupd/gnupg!/var/lib/grub/esprm/varQ/var/lib/systemd/deb-systemd-helper-enabled/cloud-final.service.wantsar1/var/lib/tpm
Source: vejfa5.elf, 6233.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp, vejfa5.elf, 6235.1.00007ffd475cc000.00007ffd475ed000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6488)

Logged in records file read: /var/log/wtmp

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vejfa5.elf	42%	Virustotal		Browse
vejfa5.elf	42%	ReversingLabs	Linux.Backdoor.Mirai

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high
raw.awaken-network.net. [malformed]	unknown	unknown	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
141.98.10.142	raw.awaken-network.net	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
141.98.10.142	rjfe686.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	bejv86.elf	Get hash	malicious	Unknown	Browse
	jfeeps.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arm5.nn.elf	Get hash	malicious	Mirai	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	efjepc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	arm5.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	efefa7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	weje64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	efjepc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	arm5.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	efefa7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	weje64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
HOSTBALTICLT	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	drea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	bejv86.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
AMAZON-02US	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	https://cernercare.com/accounts/login/help/return?assertionToken=-cWB7fekf-eb_t-qV2pvU1HgFbQCIEINVHf6lRWu81pw3GFK4lVkU5uNBdVik14jWyYBfmiRAYcAmHeJMGg73IFm4SUx2jmRdQi4so9Gd4GkpAp1LB8qROommUQrA8PlLZQ-XU6_zICUlOQyPsjjrGcFaQpreAqzWe8NZ31v98L0UpFGDZum3ZLmDfVg0dmn&	Get hash	malicious	Unknown	Browse	75.2.83.33
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	na.elf	Get hash	malicious	Prometei	Browse	52.26.80.133
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	rjfe686.elf	Get hash	malicious	Unknown	Browse	54.247.62.1
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	arm5.nn.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	ENQ-NO_0698990_MQ10385_QTY2000_Order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	3.29.197.107
	efefa7.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
INIT7CH	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	efjepc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	arm5.nn.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	efefa7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	weje64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb4726d465c5f28b84cd6d14cedd13a7	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	havoc.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	mips.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	jade420.m68k.elf	Get hash	malicious	Mirai	Browse	54.171.230.55

Process:	/tmp/vejfa5.elf
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:I:I
MD5:	336D5EBC5436534E61D16E63DDFCA327
SHA1:	3BC15C8AAE3E4124DD409035F32EA2FD6835EFC9
SHA-256:	3973E022E93220F9212C18D0D0C543AE7C309E46640DA93A4A0314DE999F5112
SHA-512:	7C0B0D99A6E4C33CDA0F6F63547F878F4DD9F486DFE5D0446CE004B1C0FF28F191FF86F5D5933D3614CCEEE6FBBDC17E658881D3A164DFA5D6F4C699B2126E3D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	-

/tmp/qemu-open.HWceXn (deleted)

Download File

Process:	/tmp/vejfa5.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.132944044980958
Encrypted:	false
SSDEEP:	3:TgOa8HJN:TgOHJN
MD5:	079B40630E4A0B76B23C3BCE169EF09D
SHA1:	2CEA90056BE9C627F34E568D62B4B3ABDCF5A24F
SHA-256:	70A13BE099FF5BB666A892A3B10CDBEB1E3D612FEDFBCFF8261E8225007A11CD
SHA-512:	CEA5628D3E159007A3218F1D99A6B987BCAAF441DCA5EBE7EDE2D5C1EE7B6EC8F09A13C60F95B4D43C4893724CC1AFE8F203B27FC9AADA49A8A9131F4444D36C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/vejfa5.elf.nwlrbbmqbh

/tmp/qemu-open.QRPwuo (deleted)

Download File

Process:	/tmp/vejfa5.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.566065315772105
Encrypted:	false
SSDEEP:	3:lNKXTq/TUdVvo/FNvN:lN0Tq/YdVA/1
MD5:	809C043231163E2E521B78EF2F4A0D22
SHA1:	38D83A58D02CCE7C8100C2F11A87B50E309B3334
SHA-256:	6C845763B10E5C0FC21A80B267646E6222F162D87677E260648DCC25BFEDF32B
SHA-512:	8755629763C17EE29E675C82C256F378305B4A4AA70E8B99F00DE29FAC8BC89FE987FEBC2B38D25D325E163969B8C72DE80C4BFC163C2009651817CB514A7EC9
Malicious:	false
Reputation:	low
Preview:	6231 (/tmp/vejfa5.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4294901136 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.- (0) S 0 0 0 0 0 0 0 0 0 0 0 0 0 0

/tmp/qemu-open.Un0jPl (deleted)

Download File

Process:	/tmp/vejfa5.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.6168746059562227
Encrypted:	false
SSDEEP:	3:TgO0n:TgO0
MD5:	F46209FAECA264DCCAA1C28428432FCA
SHA1:	A720CCC89EBF48DB6CAB5ACEF64FBD9D7002D97F
SHA-256:	E0C71F5CC25B94995D2A1F474D513D7B4BF83CDC4C1C310A5D6C194226CC7D49
SHA-512:	E031B57F2E664F0C290AAB1107BA5F3C6FDF26B6C4A22C9A05451C8F6AAC7A4E11A253096891C0A8BA3A947BA6D2B7C66C1A3CF2ACCF4BA6341F3EEC88B6C076
Malicious:	false
Reputation:	low
Preview:	/tmp/vejfa5.elf..

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.3882302109011615
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	vejfa5.elf
File size:	158'496 bytes
MD5:	53b897d0d6102223eab60fd79737ae49
SHA1:	23a086d06400b955a5234c48439beff92f667f83
SHA256:	9d4d3ddf070509f7b3e7f509a4224563a6c5cfc6a00c0525b23105db8b61e02d
SHA512:	b6775881c17f76c94ef5a26a419f3835d4349c1b064b79ca074de789715d4ff5c38c15c6b88b1bdcb7f2e0d906c00b3ac55f5cad9b2341054a14518c31067acc
SSDEEP:	1536:yPQ1OWGumQFirZBbE+Jx1cJ552aiUR4V9JATcVDvpJYtJOQ9xDmuVBImlKGwywi6:yPQ5EBbEX552C4FA+DvpCvyu3Dd0ge
TLSH:	2AF30845BC819F67C6D612BBFB5E428D372A1768D3EE71078D256F24378A85B0E37202
File Content Preview:	.ELF...a..........(.........4....i......4. ...(.......................................... ... ... ..PI..,...........Q.td..................................-...L."....t..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	158096
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1d058	0x0	0x6	AX	16
.fini	PROGBITS	0x25108	0x1d108	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x2511c	0x1d11c	0x3fe4	0x0	0x2	A	4
.ctors	PROGBITS	0x32000	0x22000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x3200c	0x2200c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x32020	0x22020	0x4930	0x0	0x3	WA	32
.bss	NOBITS	0x36950	0x26950	0xc5dc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x26950	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x21100	0x21100	5.9253	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x22000	0x32000	0x32000	0x4950	0x10f2c	0.4422	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 19:23:57.054060936 CEST	41326	53	192.168.2.23	8.8.8.8
Mar 31, 2025 19:23:57.152755976 CEST	53	41326	8.8.8.8	192.168.2.23
Mar 31, 2025 19:23:57.157869101 CEST	59488	53	192.168.2.23	8.8.8.8
Mar 31, 2025 19:24:02.163563967 CEST	45310	53	192.168.2.23	8.8.8.8
Mar 31, 2025 19:24:07.171880007 CEST	35782	53	192.168.2.23	8.8.8.8
Mar 31, 2025 19:24:12.177339077 CEST	36732	53	192.168.2.23	8.8.8.8
Mar 31, 2025 19:24:17.182962894 CEST	47356	53	192.168.2.23	8.8.8.8
Mar 31, 2025 19:25:10.221683025 CEST	36750	53	192.168.2.23	8.8.8.8
Mar 31, 2025 19:25:10.323834896 CEST	53	36750	8.8.8.8	192.168.2.23

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 31, 2025 19:24:14.513514042 CEST	54.171.230.55	443	192.168.2.23	33606	CN=motd.ubuntu.com CN=R10, O=Let's Encrypt, C=US	CN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Sat Mar 22 09:18:05 CET 2025 Wed Mar 13 01:00:00 CET 2024	Fri Jun 20 10:18:04 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2	fb4726d465c5f28b84cd6d14cedd13a7
Mar 31, 2025 19:24:14.513514042 CEST	54.171.230.55	443	192.168.2.23	33606	CN=R10, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		fb4726d465c5f28b84cd6d14cedd13a7

Start time (UTC):	17:23:55
Start date (UTC):	31/03/2025
Path:	/tmp/vejfa5.elf
Arguments:	/tmp/vejfa5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	17:23:56
Start date (UTC):	31/03/2025
Path:	/tmp/vejfa5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	17:24:02
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	17:24:03
Start date (UTC):	31/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:24:04
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	17:24:05
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	17:24:14
Start date (UTC):	31/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	17:24:21
Start date (UTC):	31/03/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	17:24:31
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	17:24:37
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	17:24:38
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	17:24:41
Start date (UTC):	31/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:24:42
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	17:24:57
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vejfa5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/proc/6231/task/6231/comm

/tmp/qemu-open.HWceXn (deleted)

/tmp/qemu-open.QRPwuo (deleted)

/tmp/qemu-open.Un0jPl (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Connections

System Behavior

Analysis Process: vejfa5.elf PID: 6231, Parent PID: 6152

General

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Prctl Requested

Linux Analysis Report
vejfa5.elf

Start time (UTC):	17:25:15
Start date (UTC):	31/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	17:25:01
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	17:24:50
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	17:24:53
Start date (UTC):	31/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	17:24:58
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	17:25:06
Start date (UTC):	31/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:25:07
Start date (UTC):	31/03/2025
Path:	/usr/bin/xfwm4
Arguments:	xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c
File size:	420424 bytes
MD5 hash:	59defa3c00cc30d85ed77b738d55e9da

Start time (UTC):	17:25:23
Start date (UTC):	31/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:25:30
Start date (UTC):	31/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:25:32
Start date (UTC):	31/03/2025
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30