Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1528830
MD5: d67ab8e2b66b87b5665333176583e552
SHA1: 571fb2b837941d8d3fb4bef82a09d850696dd856
SHA256: 4244ef7ff56a2dab17f06c98131f61460ec9ca7eec6f7cb057d7e779c3079a65
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Machine Learning detection for sample
Reads system files that contain records of logged in users
Sample deletes itself
Sample is packed with UPX
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "ps" command used to list the status of processes
Executes the "rm" command used to delete files or directories
Reads CPU information from /sys indicative of miner or evasive malware
Reads system information from the proc file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf Virustotal: Detection: 52% Perma Link
Source: na.elf ReversingLabs: Detection: 47%
Machine Learning detection for sample
Source: na.elf Joe Sandbox ML: detected
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/ps (PID: 5567) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 5692) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:44972 -> 194.120.230.54:57899
Sample listens on a socket
Source: /usr/libexec/gvfsd-trash (PID: 5833) Socket: unknown address family Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) Socket: unknown address family Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: cnc.merisprivate.net
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: na.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample tries to kill a massive number of system processes
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 792, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 797, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 802, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 803, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 855, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 884, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 490, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 656, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 657, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 659, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 765, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 767, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 800, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent to PID below 1000: pid: 917, result: successful Jump to behavior
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 797, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 802, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 803, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 855, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1444, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1475, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1480, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1482, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1563, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1588, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1604, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1745, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1751, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1765, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1804, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1832, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1847, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1866, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1879, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1881, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1884, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1891, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1906, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1925, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1930, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1946, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1969, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1982, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2926, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2961, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2964, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2972, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2974, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2984, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3095, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3146, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3147, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3153, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3161, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3182, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3183, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3336, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3342, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3375, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3413, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3420, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3424, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3429, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3448, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3619, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5403, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5404, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5487, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5536, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5559, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 490, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 656, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 657, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 659, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 765, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 767, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 917, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1648, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2935, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3164, result: successful Jump to behavior
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0xc01000
Sample tries to kill a process (SIGKILL)
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 660, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 726, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 727, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 778, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 780, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 790, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 792, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 797, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 802, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 803, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 855, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 914, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1400, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1444, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1475, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1480, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1482, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1563, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1588, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1604, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1745, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1751, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1765, result: no such process Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1804, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1805, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1832, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1847, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1866, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1879, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1881, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1884, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1891, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1906, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1925, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1930, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1940, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1944, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1946, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1969, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1982, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2926, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2961, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2964, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2972, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2974, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2984, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3069, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3095, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3104, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3114, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3117, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3122, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3132, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3134, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3146, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3147, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3153, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3161, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3181, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3182, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3183, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3185, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3208, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3209, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3212, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3300, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3310, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3336, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3342, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3375, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3413, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3420, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3424, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3429, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3434, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3448, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3619, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5403, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5404, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5487, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5533, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5536, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 5559, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 490, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 656, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 657, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 659, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 765, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 767, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 917, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 1648, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2935, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 2936, result: successful Jump to behavior
Source: /tmp/na.elf (PID: 5455) SIGKILL sent: pid: 3164, result: successful Jump to behavior
Yara signature match
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5452.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5454.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5455.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal88.spre.troj.evad.linELF@0/23@3/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /bin/fusermount (PID: 5532) File: /proc/5532/mounts Jump to behavior
Source: /bin/fusermount (PID: 5634) File: /proc/5634/mounts Jump to behavior
Creates hidden files and/or directories
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/local/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /home/saturnino/.local/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /home/saturnino/.fonts/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/X11/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/cMap/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/cmap/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/opentype/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/type1/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/X11/Type1/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/X11/encodings/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/X11/misc/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/X11/util/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/opentype/malayalam/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/opentype/mathjax/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/opentype/noto/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/opentype/urw-base35/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/Gargi/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/Gubbi/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/Nakula/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/Navilu/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/Sahadeva/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/Sarai/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/abyssinica/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/dejavu/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/droid/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/freefont/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/kacst/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/kacst-one/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lao/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lato/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/liberation/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/liberation2/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/malayalam/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/noto/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/openoffice/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/padauk/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/pagul/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/samyak/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/sinhala/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/tlwg/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/truetype/ubuntu/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/type1/urw-base35/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /usr/share/fonts/X11/encodings/large/.uuid Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /home/saturnino/.drirc Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/upower/upowerd (PID: 5568) Directory: <invalid fd (12)>/.. Jump to behavior
Source: /usr/lib/upower/upowerd (PID: 5568) Directory: <invalid fd (11)>/.. Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/local/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /home/saturnino/.local/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /home/saturnino/.fonts/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/X11/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/cMap/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/cmap/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/opentype/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/type1/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/X11/Type1/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/X11/encodings/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/X11/misc/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/X11/util/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/opentype/malayalam/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/opentype/mathjax/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/opentype/noto/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/opentype/urw-base35/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/Gargi/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/Gubbi/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/Nakula/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/Navilu/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/Sahadeva/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/Sarai/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/abyssinica/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/dejavu/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/droid/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/freefont/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/kacst/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/kacst-one/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lao/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lato/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/liberation/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/liberation2/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/malayalam/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/noto/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/openoffice/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/padauk/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/pagul/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/samyak/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/sinhala/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/tlwg/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/truetype/ubuntu/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/type1/urw-base35/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /usr/share/fonts/X11/encodings/large/.uuid Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5718) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5719) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /home/saturnino/.local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /home/saturnino/.fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/X11/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/cMap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/cmap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/opentype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/X11/Type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/X11/encodings/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/X11/misc/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/X11/util/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/opentype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/opentype/mathjax/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/opentype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/opentype/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/Gargi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/Gubbi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/Nakula/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/Navilu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/Sahadeva/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/Sarai/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/abyssinica/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/dejavu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/droid/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/freefont/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/kacst/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/kacst-one/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lao/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lato/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/liberation/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/liberation2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/openoffice/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/padauk/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/pagul/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/samyak/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/sinhala/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/tlwg/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/truetype/ubuntu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/type1/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Directory: /usr/share/fonts/X11/encodings/large/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /home/saturnino/.local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /home/saturnino/.fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/X11/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/cMap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/cmap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/opentype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/X11/Type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/X11/encodings/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/X11/misc/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/X11/util/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/opentype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/opentype/mathjax/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/opentype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/opentype/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/Gargi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/Gubbi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/Nakula/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/Navilu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/Sahadeva/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/Sarai/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/abyssinica/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/dejavu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/droid/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/freefont/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/kacst/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/kacst-one/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lao/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lato/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/liberation/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/liberation2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/openoffice/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/padauk/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/pagul/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/samyak/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/sinhala/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/tlwg/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/truetype/ubuntu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/type1/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Directory: /usr/share/fonts/X11/encodings/large/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /home/saturnino/.local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /home/saturnino/.fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/X11/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/cMap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/cmap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/opentype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/X11/Type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/X11/encodings/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/X11/misc/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/X11/util/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/opentype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/opentype/mathjax/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/opentype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/opentype/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/Gargi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/Gubbi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/Nakula/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/Navilu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/Sahadeva/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/Sarai/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/abyssinica/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/dejavu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/droid/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/freefont/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/kacst/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/kacst-one/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lao/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lato/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/liberation/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/liberation2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/openoffice/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/padauk/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/pagul/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/samyak/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/sinhala/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/tlwg/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/truetype/ubuntu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/type1/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /usr/share/fonts/X11/encodings/large/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /home/saturnino/.local/share/fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /home/saturnino/.fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/X11/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/cMap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/cmap/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/opentype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/X11/Type1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/X11/encodings/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/X11/misc/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/X11/util/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/opentype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/opentype/mathjax/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/opentype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/opentype/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/Gargi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/Gubbi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/Nakula/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/Navilu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/Sahadeva/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/Sarai/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/abyssinica/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/dejavu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/droid/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/freefont/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/kacst/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/kacst-one/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lao/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lato/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/liberation/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/liberation2/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/malayalam/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/noto/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/openoffice/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/padauk/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/pagul/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/samyak/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/sinhala/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/tlwg/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/truetype/ubuntu/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/type1/urw-base35/.uuid Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Directory: /usr/share/fonts/X11/encodings/large/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /home/saturnino/.Xdefaults-galassia Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /home/saturnino/.hidden Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /.hidden Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /home/.hidden Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/local/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /home/saturnino/.local/share/fonts/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /home/saturnino/.fonts/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/X11/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/cMap/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/cmap/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/opentype/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/type1/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/X11/Type1/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/X11/encodings/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/X11/misc/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/X11/util/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/opentype/malayalam/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/opentype/mathjax/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/opentype/noto/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/opentype/urw-base35/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/Gargi/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/Gubbi/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/Nakula/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/Navilu/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/Sahadeva/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/Sarai/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/abyssinica/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/dejavu/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/droid/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid Jump to behavior
Enumerates processes within the "proc" file system
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5681/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5681/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5681/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5681/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5681/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5681/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5681/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5682/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5682/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5682/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5682/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5682/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5682/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5782/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5782/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5782/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5782/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5782/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5782/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5782/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5684/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5684/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5684/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5684/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5684/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5684/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5684/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5685/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5685/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5685/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5685/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5685/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5685/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5685/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5565/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5565/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5565/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5565/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5565/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5565/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5565/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5862/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5862/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5862/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5862/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5862/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5862/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5862/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/3164/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/3164/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/3164/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/3164/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/3164/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/3164/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/3164/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5718/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5718/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5718/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5718/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5718/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5718/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5718/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5719/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5719/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5719/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5719/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5719/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5719/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5719/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5692/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5692/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5692/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5692/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5692/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5692/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5692/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5791/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5791/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5791/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5791/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5791/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5791/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5791/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5697/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5697/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5697/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5697/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5697/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5697/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5697/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5851/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5851/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5851/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5851/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5851/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5851/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/5851/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) File opened: /proc/660/cgroup Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/na.elf (PID: 5566) Shell command executed: sh -c "ps -A -o pid,cmd --no-headers" Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5878) Shell command executed: sh -c "locale -a | grep -F .utf8 "
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5880) Grep executable: /usr/bin/grep -> grep -F .utf8
Executes the "ps" command used to list the status of processes
Source: /bin/sh (PID: 5567) Ps executable: /usr/bin/ps -> ps -A -o pid,cmd --no-headers Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5413) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.nNPFxb16jB /tmp/tmp.JAVKQHsnD7 /tmp/tmp.JJECfR6OHN Jump to behavior
Source: /usr/bin/dash (PID: 5422) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.nNPFxb16jB /tmp/tmp.JAVKQHsnD7 /tmp/tmp.JJECfR6OHN Jump to behavior
Source: /usr/bin/xfce4-session (PID: 5555) Rm executable: /usr/bin/rm -> rm -f /home/saturnino/.cache/sessions/Thunar-2ec7c2e14-9c4d-40f3-9704-8617ab831fb4 Jump to behavior
Reads system information from the proc file system
Source: /usr/bin/ps (PID: 5567) Reads from proc file: /proc/meminfo Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) Reads from proc file: /proc/meminfo Jump to behavior
Sample tries to set the executable flag
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5862) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5862) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/na.elf (PID: 5452) File: /tmp/na.elf Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: na.elf Submission file: segment LOAD with 7.8803 entropy (max. 8.0)
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/ps (PID: 5567) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5565) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 5692) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /usr/bin/xfwm4 (PID: 5565) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5576) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5718) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5719) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5722) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5724) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5726) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5746) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5609) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5644) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5645) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5681) Queries kernel information via 'uname': Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5682) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 5692) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5697) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/Thunar (PID: 5791) Queries kernel information via 'uname':
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5851) Queries kernel information via 'uname':
Source: na.elf, 5455.1.0000000008059000.000000000805c000.rw-.sdmp Binary or memory string: [DEBUG] Checking process: PID=727, Path=/usr/bin/vmtoolsdrvicemd-journald
Source: na.elf, 5455.1.0000000008528000.0000000008529000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsdrvicemd-journald
Source: na.elf, 5455.1.0000000008059000.000000000805c000.rw-.sdmp Binary or memory string: [DEBUG] Killing process: PID=727, Path=/usr/bin/vmtoolsdrvicemd-journald

Language, Device and Operating System Detection
barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5862) Logged in records file read: /var/log/wtmp

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
194.120.230.54
 cnc.merisprivate.net unknown
133115 HKKFGL-AS-APHKKwaifongGroupLimitedHK false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
cnc.merisprivate.net 194.120.230.54 true