Edit tour

Linux Analysis Report
miraint.x86.elf

Overview

General Information

Sample name:	miraint.x86.elf
Analysis ID:	1729401
Has dependencies:	false
MD5:	e3b153c7645b0320ec7423f10ecb82b5
SHA1:	3233d84a1d178d347bdc063a7b0a4a94f1e927f6
SHA256:	29ca823fd91e44c349fda4226400e09ca358920c6369a06f521e540b7c16ecee
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "rm" command used to delete files or directories

Reads CPU information from /sys indicative of miner or evasive malware

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1729401
Start date and time:	2025-07-06 07:56:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	miraint.x86.elf
Detection:	MAL
Classification:	mal88.spre.troj.evad.linELF@0/4@0/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/miraint.x86.elf
PID:	6237
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	listening tun0
Standard Error:

Process Tree

system is lnxubuntu20

miraint.x86.elf (PID: 6237, Parent: 6161, MD5: e3b153c7645b0320ec7423f10ecb82b5) Arguments: /tmp/miraint.x86.elf

miraint.x86.elf New Fork (PID: 6238, Parent: 6237)

miraint.x86.elf New Fork (PID: 6239, Parent: 6238)

gnome-session-binary New Fork (PID: 6283, Parent: 1477)

sh (PID: 6283, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6283, Parent: 1477, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6455, Parent: 6283)

ibus-daemon (PID: 6455, Parent: 6283, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6460, Parent: 6455)

ibus-memconf (PID: 6460, Parent: 6455, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6462, Parent: 6455)

ibus-daemon New Fork (PID: 6463, Parent: 6462)

ibus-x11 (PID: 6463, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6610, Parent: 6455)

ibus-engine-simple (PID: 6610, Parent: 6455, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

systemd New Fork (PID: 6306, Parent: 1)

systemd-localed (PID: 6306, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

dbus-daemon New Fork (PID: 6465, Parent: 6464)

ibus-portal (PID: 6465, Parent: 6464, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

Xorg New Fork (PID: 6473, Parent: 1465)

sh (PID: 6473, Parent: 1465, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6474, Parent: 6473)

xkbcomp (PID: 6474, Parent: 6473, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

systemd New Fork (PID: 6475, Parent: 1)

accounts-daemon (PID: 6475, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6479, Parent: 6475)

language-validate (PID: 6479, Parent: 6475, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6480, Parent: 6479)

language-options (PID: 6480, Parent: 6479, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6481, Parent: 6480)

sh (PID: 6481, Parent: 6480, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6482, Parent: 6481)

locale (PID: 6482, Parent: 6481, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6483, Parent: 6481)

grep (PID: 6483, Parent: 6481, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6484, Parent: 1)

geoclue (PID: 6484, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

dbus-daemon New Fork (PID: 6596, Parent: 6595)

gjs (PID: 6596, Parent: 6595, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

systemd New Fork (PID: 6622, Parent: 1)

fprintd (PID: 6622, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

gnome-session-binary New Fork (PID: 6750, Parent: 1477)

sh (PID: 6750, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6750, Parent: 1477, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

systemd New Fork (PID: 6757, Parent: 1)

systemd-hostnamed (PID: 6757, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

dash New Fork (PID: 6894, Parent: 4332)

rm (PID: 6894, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.TYrWC4T67A /tmp/tmp.yAdBe2aS2r /tmp/tmp.LXfFD8a55H

dash New Fork (PID: 6895, Parent: 4332)

rm (PID: 6895, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.TYrWC4T67A /tmp/tmp.yAdBe2aS2r /tmp/tmp.LXfFD8a55H

xfce4-session New Fork (PID: 6942, Parent: 1900)

xfwm4 (PID: 6942, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

xfce4-session New Fork (PID: 6945, Parent: 1900)

xfce4-panel (PID: 6945, Parent: 1900, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2b4cc744e-8b9d-436f-9a4a-312b40faa2ec

xfce4-panel New Fork (PID: 6964, Parent: 6945)

wrapper-2.0 (PID: 6964, Parent: 6945, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 8388616 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6984, Parent: 6945)

wrapper-2.0 (PID: 6984, Parent: 6945, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 8388617 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6987, Parent: 6945)

wrapper-2.0 (PID: 6987, Parent: 6945, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 8388618 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6989, Parent: 6945)

wrapper-2.0 (PID: 6989, Parent: 6945, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 8388619 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 7028, Parent: 6989)

xfpm-power-backlight-helper (PID: 7028, Parent: 6989, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6990, Parent: 6945)

wrapper-2.0 (PID: 6990, Parent: 6945, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 8388620 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 7001, Parent: 6945)

wrapper-2.0 (PID: 7001, Parent: 6945, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 8388621 actions "Action Buttons" "Log out, lock or other system actions"

xfce4-session New Fork (PID: 6952, Parent: 1900)

xfdesktop (PID: 6952, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

dbus-daemon New Fork (PID: 6959, Parent: 6958)

tumblerd (PID: 6959, Parent: 6958, MD5: 2ef099898845e9c5ec6f1a6fd3ad61af) Arguments: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd

xfce4-session New Fork (PID: 6988, Parent: 1900)

xfwm4 (PID: 6988, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
miraint.x86.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
miraint.x86.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x467:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
miraint.x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
miraint.x86.elf	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4ee:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
miraint.x86.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xf8e:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x106e:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1143:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1420:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a0:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
miraint.x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x9082:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
miraint.x86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x20d2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
miraint.x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9b90:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
miraint.x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x9002:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
miraint.x86.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xbde0:$x1: POST /cdn-cgi/ 0xbe87:$x2: /dev/misc/watchdog 0xbe79:$x3: /dev/watchdog 0xc03c:$s1: LCOGQGPTGP 0xbf03:$s6: NKQVGLKLE
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6237.1.0000000008048000.0000000008055000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x467:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4ee:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xf8e:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x106e:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1143:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1420:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a0:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x9082:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x20d2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9b90:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x9002:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6237.1.0000000008048000.0000000008055000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xbde0:$x1: POST /cdn-cgi/ 0xbe87:$x2: /dev/misc/watchdog 0xbe79:$x3: /dev/watchdog 0xc03c:$s1: LCOGQGPTGP 0xbf03:$s6: NKQVGLKLE
Click to see the 5 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: miraint.x86.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: miraint.x86.elf	ReversingLabs: Detection: 72%
Source: miraint.x86.elf	Virustotal: Detection: 60%			Perma Link

Source: /usr/bin/gnome-shell (PID: 6283)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6959)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/bin/ibus-daemon (PID: 6455)

Socket: unknown address family

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39250
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39250 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1532, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1877, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2050, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2063, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2097, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2195, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2226, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2242, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2275, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1532, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1877, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2050, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2063, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2097, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2195, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2226, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2242, result: successful	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	SIGKILL sent: pid: 2275, result: successful	Jump to behavior

Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: miraint.x86.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal88.spre.troj.evad.linELF@0/4@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/gnome-shell (PID: 6283)	File: /proc/6283/mounts			Jump to behavior
Source: /usr/bin/gjs (PID: 6596)	File: /proc/6596/mounts			Jump to behavior

Source: /usr/bin/gnome-shell (PID: 6283)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6283)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6283)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 6463)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 6463)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6475)	Directory: /root/.cache	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6757)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.drirc	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6964)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6984)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /home/saturnino/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /home/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior

Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2033/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2275/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1612/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2028/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/3236/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2025/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2146/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/517/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/759/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2285/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2281/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/761/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1622/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/884/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1983/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2038/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1860/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2156/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/6239/exe	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1627/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1900/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/3021/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2294/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2050/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1877/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/772/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1633/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1632/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/774/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/896/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1872/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2048/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2289/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1639/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1638/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2208/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2180/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1809/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1494/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1890/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2063/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2062/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1888/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1886/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/420/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/420/exe	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1489/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1642/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/788/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/667/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1648/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2078/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2077/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2074/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2195/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/670/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2746/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1656/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1654/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/2226/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/1532/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/797/maps	Jump to behavior
Source: /tmp/miraint.x86.elf (PID: 6239)	File opened: /proc/676/maps	Jump to behavior

Source: /usr/lib/xorg/Xorg (PID: 6473)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""			Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6481)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "			Jump to behavior

Source: /bin/sh (PID: 6483)

Grep executable: /usr/bin/grep -> grep -F .utf8

Jump to behavior

Source: /usr/bin/dash (PID: 6894)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.TYrWC4T67A /tmp/tmp.yAdBe2aS2r /tmp/tmp.LXfFD8a55H			Jump to behavior
Source: /usr/bin/dash (PID: 6895)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.TYrWC4T67A /tmp/tmp.yAdBe2aS2r /tmp/tmp.LXfFD8a55H			Jump to behavior

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6475)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6475)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/miraint.x86.elf (PID: 6237)

File: /tmp/miraint.x86.elf

Jump to behavior

Source: /usr/bin/gnome-shell (PID: 6283)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6959)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/bin/gnome-shell (PID: 6283)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 6463)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/fprintd (PID: 6622)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6750)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6757)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6942)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6945)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6964)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6984)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6987)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7001)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6952)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6959)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6988)	Queries kernel information via 'uname':	Jump to behavior

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6475)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: miraint.x86.elf, type: SAMPLE
Source: Yara match	File source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: miraint.x86.elf, type: SAMPLE
Source: Yara match	File source: 6237.1.0000000008048000.0000000008055000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 File Deletion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
miraint.x86.elf	72%	ReversingLabs	Linux.Worm.Mirai
miraint.x86.elf	60%	Virustotal		Browse
miraint.x86.elf	100%	Avira	EXP/ELF.Mirai.O

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
207.167.64.24	unknown	Reserved	7837	UNASSIGNED	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	morte.x86.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.mpsl.elf	Get hash	malicious	Mirai, Xmrig	Browse
	armv4l.elf	Get hash	malicious	Unknown	Browse
	sh4.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
207.167.64.24	miraint.ppc440.elf	Get hash	malicious	Mirai	Browse
	miraint.mips.elf	Get hash	malicious	Mirai	Browse
	miraint.arm6.elf	Get hash	malicious	Mirai	Browse
	miraint.sh4.elf	Get hash	malicious	Mirai	Browse
	miraint.x86.elf	Get hash	malicious	Mirai	Browse
	miraint.i686.elf	Get hash	malicious	Mirai	Browse
	miraint.m68k.elf	Get hash	malicious	Mirai	Browse
	miraint.spc.elf	Get hash	malicious	Mirai	Browse
	miraint.arm7.elf	Get hash	malicious	Mirai	Browse
	miraint.mpsl.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.mips.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.spc.elf	Get hash	malicious	Mirai, Xmrig	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.x86_64.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.i686.elf	Get hash	malicious	Mirai, Xmrig	Browse
91.189.91.42	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.mips.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.spc.elf	Get hash	malicious	Mirai, Xmrig	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.x86_64.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.i686.elf	Get hash	malicious	Mirai, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	debug.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	162.213.35.24
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.mips.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.spc.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
CANONICAL-ASGB	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	debug.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	162.213.35.24
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.mips.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.spc.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
UNASSIGNED	https://workstationteam.zoholandingpage.com/proservedasri.com/?FA7658923%E2%80%9107%E2%80%912025.xls	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://link.edgepilot.com/s/4f329cc8/7u6er1vNgUiUhze8mMdKiw?u=https://forms.office.com/e/AV2WV8aDuq?origin=lprLink	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://link.edgepilot.com/s/ba114da0/ncfBAU2fKESRW5ciSGiHJA?u=https://forms.office.com/e/DyxB5QirkT?origin%3DlprLink	Get hash	malicious	Unknown	Browse	199.67.84.72
	i686.elf	Get hash	malicious	Mirai	Browse	157.225.246.152
	m68k.elf	Get hash	malicious	Mirai	Browse	156.134.188.76
	https://mibc-fr-09.mailinblack.com/securelink/?url=https:**Aforms.office.com&key=eyJsYW5nIjoiRlIiLCJ1cmwiOiJodHRwczovL2Zvcm1zLm9mZmljZS5jb20vZS9YQmJzeHdiUkw3P29yaWdpbj1scHJMaW5rIiwidG9rZW4iOiJnQUFBQUFCb1pWSWFnN3R0a1dyTlR3TWhoSzJKSWFMM01XREZBeVp3V0lzT0QtWVNYM2xGc0tYX3M0cHdSWloxR1Q4SXFhUmkyY0hNeWQ0NmVHYWxQSjZxR2FCcC0zWU9aZVhSTTRqMjFTTVMtVlNpVk00MFA1OWNZWTVXY0RxeGUwcmR5VzNtMGhNRWpPcHMteDJjemF1R1ZSTFZaVTNkQzBPUlFFSm9iQlRHaUpjdjdmbkh2YWpXVHBrTlJyZUFINTBRZFJHX0x3VkRkaTBVOEVZZDZucE42R0wxY1VWZnMyUnJtWDltWVRkNXNrR25uOVVFRjlBYXpWUG1vcTRmMHBHZE9hVWdYbVZOU1RRSnF4U3c0SzQ0d3lOanVCV0JPbURzZk1LdFBDZnJVUTFIemlqWFZlc3lvOU9RLVdKNFJQRlRRQncwbVNRWiJ9	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://tcjbpd-cmpzourl.maillist-manage.com/click/11259935e94618217/11259935e945e7722	Get hash	malicious	Unknown	Browse	199.67.84.76
	miraint.ppc440.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
	miraint.mips.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
	miraint.arm6.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
INIT7CH	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.mips.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.spc.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.x86_64.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.i686.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
AMAZON-02US	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	mirai.arm6.elf	Get hash	malicious	Mirai	Browse	18.157.142.188
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.254.182.186
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	morte.i686.elf	Get hash	malicious	Mirai, Xmrig	Browse	54.171.230.55
	morte.x86.elf	Get hash	malicious	Mirai, Xmrig	Browse	54.171.230.55
	arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	morte.mpsl.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.243.160.129

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-media-keys
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.178206769744651
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWT6M3THlD1r:q5sU3LWfLUDmQymqSFbfomSMolD1fT
MD5:	EB94F92F4670DB9FA052CE0971220C20
SHA1:	393728459FEE49392962667B4BA6C72F2DB2D78C
SHA-256:	8F6152891650A5F7D559C7E97FB714C9A5677EC5E2980B3C20770AAD769EFB3F
SHA-512:	54706E05563363528C022868C5DB7C309372273AD195D2F5C2502110C8677F3C34A9ECDD81A029A6D07ACE2B79E7C890B3B7F478BFA328EDC8BF6284F41EEB55
Malicious:	false
Reputation:	low
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-J3FhbOG3,guid=9daf989f5153444c400e56a7686a1072.IBUS_DAEMON_PID=6455.

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.265228697146932
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	miraint.x86.elf
File size:	53'856 bytes
MD5:	e3b153c7645b0320ec7423f10ecb82b5
SHA1:	3233d84a1d178d347bdc063a7b0a4a94f1e927f6
SHA256:	29ca823fd91e44c349fda4226400e09ca358920c6369a06f521e540b7c16ecee
SHA512:	5ae336bf5e47feb4990710deeee8a045eac646c75597a1e0862195937b9dac9e40c98af3c54c57f88fa6ac1ff67f894cedecca3d4f051eb17c0cc1eaa663ba93
SSDEEP:	1536:mt6TP8/G8L8uzwJcz4Lk7N1z6dlX/q0lOr7uq:8b/zL8uzaFw7N1z6LXJO3t
TLSH:	8D335AC59187EDF4FC160270243BF37226B3EABE1059EDDAC3289977D862602E60635D
File Content Preview:	.ELF....................d...4...........4. ...(..............................................P...P......@...........Q.td............................U..S.......w....h........[]...$.............U......=.P...t..5....$P.....$P......u........t....h.I..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	53456
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xbd06	0x0	0x6	AX	16
.fini	PROGBITS	0x8053db6	0xbdb6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8053de0	0xbde0	0xba0	0x0	0x2	A	32
.ctors	PROGBITS	0x8055000	0xd000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8055008	0xd008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8055020	0xd020	0x70	0x0	0x3	WA	4
.bss	NOBITS	0x80550a0	0xd090	0x6a0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xd090	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xc980	0xc980	6.4053	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xd000	0x8055000	0x8055000	0x90	0x740	1.7510	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2025 07:57:07.737548113 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 6, 2025 07:57:09.180423975 CEST	41434	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.301825047 CEST	23	41434	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.302031040 CEST	41434	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.302064896 CEST	41434	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.302069902 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.425683022 CEST	23	41434	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.425796032 CEST	41434	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.425946951 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.426007986 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.426059008 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.547621012 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.547707081 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.669342041 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.669491053 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.669545889 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.669572115 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.669601917 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.669620991 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.669625998 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:09.669677973 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:09.669692993 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:13.112735033 CEST	42836	443	192.168.2.23	91.189.91.43
Jul 6, 2025 07:57:14.648536921 CEST	42516	80	192.168.2.23	109.202.202.202
Jul 6, 2025 07:57:19.680246115 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:19.802083969 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:19.802205086 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:28.214828968 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 6, 2025 07:57:29.104597092 CEST	39250	443	192.168.2.23	34.249.145.219
Jul 6, 2025 07:57:29.104631901 CEST	443	39250	34.249.145.219	192.168.2.23
Jul 6, 2025 07:57:29.104717970 CEST	39250	443	192.168.2.23	34.249.145.219
Jul 6, 2025 07:57:29.104893923 CEST	39250	443	192.168.2.23	34.249.145.219
Jul 6, 2025 07:57:29.104899883 CEST	443	39250	34.249.145.219	192.168.2.23
Jul 6, 2025 07:57:35.262307882 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:35.262442112 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:57:40.500910044 CEST	42836	443	192.168.2.23	91.189.91.43
Jul 6, 2025 07:57:44.596324921 CEST	42516	80	192.168.2.23	109.202.202.202
Jul 6, 2025 07:57:50.615674973 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:57:50.615863085 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:58:05.980699062 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:58:05.980782032 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:58:09.168817043 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 6, 2025 07:58:19.853363991 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:58:19.975085020 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:58:19.975147009 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:58:29.096491098 CEST	39250	443	192.168.2.23	34.249.145.219
Jul 6, 2025 07:58:29.140275002 CEST	443	39250	34.249.145.219	192.168.2.23
Jul 6, 2025 07:58:35.162055016 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:58:35.162261009 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:58:50.520124912 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:58:50.520190954 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:59:05.876837969 CEST	23	41436	207.167.64.24	192.168.2.23
Jul 6, 2025 07:59:05.876929045 CEST	41436	23	192.168.2.23	207.167.64.24
Jul 6, 2025 07:59:13.295197010 CEST	443	39250	34.249.145.219	192.168.2.23
Jul 6, 2025 07:59:13.295260906 CEST	39250	443	192.168.2.23	34.249.145.219

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report miraint.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/user/127/dconf/user

/tmp/server-0.xkm

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Linux Analysis Report
miraint.x86.elf