Edit tour

Linux Analysis Report
miraint.sh4.elf

Overview

General Information

Sample name:	miraint.sh4.elf
Analysis ID:	1729419
Has dependencies:	false
MD5:	534057249570111308bfbe02b741564f
SHA1:	c41f8b8cf876f6e72b880abac23c92d32241b881
SHA256:	61f393b85dbb8d4b35fab546d1b249a8f2da452e3d221070b85a11ee491846e4
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "rm" command used to delete files or directories

Reads CPU information from /sys indicative of miner or evasive malware

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1729419
Start date and time:	2025-07-06 08:12:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	miraint.sh4.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/5@0/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/miraint.sh4.elf
PID:	6270
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	listening tun0
Standard Error:

Process Tree

system is lnxubuntu20

miraint.sh4.elf (PID: 6270, Parent: 6194, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/miraint.sh4.elf

miraint.sh4.elf New Fork (PID: 6272, Parent: 6270)

miraint.sh4.elf New Fork (PID: 6280, Parent: 6272)

dash New Fork (PID: 6319, Parent: 4331)

rm (PID: 6319, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.9IxA3L5gZA /tmp/tmp.2EX1vQCFmw /tmp/tmp.48jecbiIfL

dash New Fork (PID: 6320, Parent: 4331)

rm (PID: 6320, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.9IxA3L5gZA /tmp/tmp.2EX1vQCFmw /tmp/tmp.48jecbiIfL

gnome-session-binary New Fork (PID: 6345, Parent: 1477)

sh (PID: 6345, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6345, Parent: 1477, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6516, Parent: 6345)

ibus-daemon (PID: 6516, Parent: 6345, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6521, Parent: 6516)

ibus-memconf (PID: 6521, Parent: 6516, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6523, Parent: 6516)

ibus-daemon New Fork (PID: 6524, Parent: 6523)

ibus-x11 (PID: 6524, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6673, Parent: 6516)

ibus-engine-simple (PID: 6673, Parent: 6516, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

systemd New Fork (PID: 6368, Parent: 1)

systemd-localed (PID: 6368, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

dbus-daemon New Fork (PID: 6526, Parent: 6525)

ibus-portal (PID: 6526, Parent: 6525, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

Xorg New Fork (PID: 6533, Parent: 1465)

sh (PID: 6533, Parent: 1465, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6534, Parent: 6533)

xkbcomp (PID: 6534, Parent: 6533, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

systemd New Fork (PID: 6537, Parent: 1)

accounts-daemon (PID: 6537, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6541, Parent: 6537)

language-validate (PID: 6541, Parent: 6537, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6542, Parent: 6541)

language-options (PID: 6542, Parent: 6541, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6543, Parent: 6542)

sh (PID: 6543, Parent: 6542, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6544, Parent: 6543)

locale (PID: 6544, Parent: 6543, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6545, Parent: 6543)

grep (PID: 6545, Parent: 6543, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6548, Parent: 1)

geoclue (PID: 6548, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

dbus-daemon New Fork (PID: 6657, Parent: 6656)

gjs (PID: 6657, Parent: 6656, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

systemd New Fork (PID: 6685, Parent: 1)

fprintd (PID: 6685, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

gnome-session-binary New Fork (PID: 6798, Parent: 1477)

sh (PID: 6798, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6798, Parent: 1477, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

systemd New Fork (PID: 6807, Parent: 1)

systemd-hostnamed (PID: 6807, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

xfce4-session New Fork (PID: 6973, Parent: 1900)

xfwm4 (PID: 6973, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

xfce4-session New Fork (PID: 6976, Parent: 1900)

xfce4-panel (PID: 6976, Parent: 1900, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2b4cc744e-8b9d-436f-9a4a-312b40faa2ec

xfce4-panel New Fork (PID: 6988, Parent: 6976)

wrapper-2.0 (PID: 6988, Parent: 6976, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 8388616 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6989, Parent: 6976)

wrapper-2.0 (PID: 6989, Parent: 6976, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 8388617 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6990, Parent: 6976)

wrapper-2.0 (PID: 6990, Parent: 6976, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 8388618 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6991, Parent: 6976)

wrapper-2.0 (PID: 6991, Parent: 6976, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 8388619 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 7061, Parent: 6991)

xfpm-power-backlight-helper (PID: 7061, Parent: 6991, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6994, Parent: 6976)

wrapper-2.0 (PID: 6994, Parent: 6976, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 8388620 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 7024, Parent: 6976)

wrapper-2.0 (PID: 7024, Parent: 6976, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 8388621 actions "Action Buttons" "Log out, lock or other system actions"

xfce4-session New Fork (PID: 6983, Parent: 1900)

xfdesktop (PID: 6983, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

dbus-daemon New Fork (PID: 6996, Parent: 6995)

tumblerd (PID: 6996, Parent: 6995, MD5: 2ef099898845e9c5ec6f1a6fd3ad61af) Arguments: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd

xfce4-session New Fork (PID: 7021, Parent: 1900)

xfwm4 (PID: 7021, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

xfce4-session New Fork (PID: 7054, Parent: 1900)

xfwm4 (PID: 7054, Parent: 1900, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2389ab8d9-421f-49fc-90ad-c6cc4c15ac4c

systemd New Fork (PID: 7063, Parent: 1860)

gvfs-udisks2-volume-monitor (PID: 7063, Parent: 1860, MD5: 4912ae23684d55062ac889dd671a8ab9) Arguments: /usr/libexec/gvfs-udisks2-volume-monitor

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
miraint.sh4.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
miraint.sh4.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
miraint.sh4.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xbd64:$x1: POST /cdn-cgi/ 0xbe2c:$x2: /dev/misc/watchdog 0xbe1c:$x3: /dev/watchdog 0xc01c:$s1: LCOGQGPTGP 0xbea0:$s6: NKQVGLKLE
miraint.sh4.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xbd64:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xbd64:$x1: POST /cdn-cgi/ 0xbe2c:$x2: /dev/misc/watchdog 0xbe1c:$x3: /dev/watchdog 0xc01c:$s1: LCOGQGPTGP 0xbea0:$s6: NKQVGLKLE
6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xbd64:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: miraint.sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: miraint.sh4.elf	Virustotal: Detection: 57%			Perma Link
Source: miraint.sh4.elf	ReversingLabs: Detection: 66%

Source: /usr/bin/gnome-shell (PID: 6345)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6996)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /tmp/miraint.sh4.elf (PID: 6270)	Socket: 127.0.0.1:48101			Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 6516)	Socket: unknown address family			Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:39258 -> 34.249.145.219:443
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39258 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: miraint.sh4.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: miraint.sh4.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1532, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1877, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2050, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2063, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2097, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2195, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2226, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2242, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2275, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1532, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1877, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2050, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2063, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2097, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2195, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2226, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2242, result: successful	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	SIGKILL sent: pid: 2275, result: successful	Jump to behavior

Source: miraint.sh4.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: miraint.sh4.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/5@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/gnome-shell (PID: 6345)	File: /proc/6345/mounts			Jump to behavior
Source: /usr/bin/gjs (PID: 6657)	File: /proc/6657/mounts			Jump to behavior

Source: /usr/bin/gnome-shell (PID: 6345)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6345)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6345)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 6524)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 6524)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6537)	Directory: /root/.cache	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6807)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.drirc	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6988)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Directory: /home/saturnino/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Directory: /.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Directory: /home/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6996)	Directory: /home/saturnino/.lv2	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2033/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2275/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1612/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2028/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2025/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2146/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/517/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/759/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2285/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2281/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/761/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1622/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/884/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1983/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2038/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1860/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2156/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1627/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1900/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/3021/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2294/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2050/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1877/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/772/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1633/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1632/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/774/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/896/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1872/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2048/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2289/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1639/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1638/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2208/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2180/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1809/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1494/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1890/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2063/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2062/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1888/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1886/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/420/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/420/exe	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1489/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1642/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/788/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/667/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1648/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2078/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2077/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2074/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2195/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/670/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2746/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1656/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1654/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2226/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/1532/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/797/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/677/maps	Jump to behavior
Source: /tmp/miraint.sh4.elf (PID: 6280)	File opened: /proc/2069/maps	Jump to behavior

Source: /usr/lib/xorg/Xorg (PID: 6533)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""			Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6543)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "			Jump to behavior

Source: /bin/sh (PID: 6545)

Grep executable: /usr/bin/grep -> grep -F .utf8

Jump to behavior

Source: /usr/bin/dash (PID: 6319)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9IxA3L5gZA /tmp/tmp.2EX1vQCFmw /tmp/tmp.48jecbiIfL			Jump to behavior
Source: /usr/bin/dash (PID: 6320)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9IxA3L5gZA /tmp/tmp.2EX1vQCFmw /tmp/tmp.48jecbiIfL			Jump to behavior

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6537)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6537)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/miraint.sh4.elf (PID: 6270)

File: /tmp/miraint.sh4.elf

Jump to behavior

Source: /usr/bin/gnome-shell (PID: 6345)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6996)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /tmp/miraint.sh4.elf (PID: 6270)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6345)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 6524)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/fprintd (PID: 6685)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6798)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6807)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6973)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6976)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6988)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6989)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6990)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6991)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6994)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 7024)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6983)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd (PID: 6996)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7021)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 7054)	Queries kernel information via 'uname':	Jump to behavior

Source: miraint.sh4.elf, 6270.1.00007ffd8d4d2000.00007ffd8d4f3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/miraint.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/miraint.sh4.elf
Source: miraint.sh4.elf, 6270.1.00007ffd8d4d2000.00007ffd8d4f3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: miraint.sh4.elf, 6270.1.0000558ab6399000.0000558ab63fc000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: miraint.sh4.elf, 6270.1.0000558ab6399000.0000558ab63fc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6537)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: miraint.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: miraint.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6270.1.00007f13dc400000.00007f13dc40d000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 File Deletion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
miraint.sh4.elf	58%	Virustotal		Browse
miraint.sh4.elf	67%	ReversingLabs	Linux.Worm.Mirai
miraint.sh4.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
207.167.64.24	unknown	Reserved	7837	UNASSIGNED	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	morte.arc.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse
	miraint.x86.elf	Get hash	malicious	Mirai	Browse
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	morte.x86.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.mpsl.elf	Get hash	malicious	Mirai, Xmrig	Browse
207.167.64.24	miraint.x86.elf	Get hash	malicious	Mirai	Browse
	miraint.arm.elf	Get hash	malicious	Mirai	Browse
	miraint.ppc440.elf	Get hash	malicious	Mirai	Browse
	miraint.mips.elf	Get hash	malicious	Mirai	Browse
	miraint.arm6.elf	Get hash	malicious	Mirai	Browse
	miraint.sh4.elf	Get hash	malicious	Mirai	Browse
	miraint.x86.elf	Get hash	malicious	Mirai	Browse
	miraint.i686.elf	Get hash	malicious	Mirai	Browse
	miraint.m68k.elf	Get hash	malicious	Mirai	Browse
	miraint.spc.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.42	morte.arc.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse
	miraint.x86.elf	Get hash	malicious	Mirai	Browse
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.mips.elf	Get hash	malicious	Mirai, Xmrig	Browse
	morte.spc.elf	Get hash	malicious	Mirai, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	morte.arc.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.arm5.elf	Get hash	malicious	Xmrig	Browse	162.213.35.24
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	162.213.35.25
	miraint.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	91.189.91.42
	debug.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
UNASSIGNED	miraint.x86.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
	miraint.arm.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
	https://workstationteam.zoholandingpage.com/proservedasri.com/?FA7658923%E2%80%9107%E2%80%912025.xls	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://link.edgepilot.com/s/4f329cc8/7u6er1vNgUiUhze8mMdKiw?u=https://forms.office.com/e/AV2WV8aDuq?origin=lprLink	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://link.edgepilot.com/s/ba114da0/ncfBAU2fKESRW5ciSGiHJA?u=https://forms.office.com/e/DyxB5QirkT?origin%3DlprLink	Get hash	malicious	Unknown	Browse	199.67.84.72
	i686.elf	Get hash	malicious	Mirai	Browse	157.225.246.152
	m68k.elf	Get hash	malicious	Mirai	Browse	156.134.188.76
	https://mibc-fr-09.mailinblack.com/securelink/?url=https:**Aforms.office.com&key=eyJsYW5nIjoiRlIiLCJ1cmwiOiJodHRwczovL2Zvcm1zLm9mZmljZS5jb20vZS9YQmJzeHdiUkw3P29yaWdpbj1scHJMaW5rIiwidG9rZW4iOiJnQUFBQUFCb1pWSWFnN3R0a1dyTlR3TWhoSzJKSWFMM01XREZBeVp3V0lzT0QtWVNYM2xGc0tYX3M0cHdSWloxR1Q4SXFhUmkyY0hNeWQ0NmVHYWxQSjZxR2FCcC0zWU9aZVhSTTRqMjFTTVMtVlNpVk00MFA1OWNZWTVXY0RxeGUwcmR5VzNtMGhNRWpPcHMteDJjemF1R1ZSTFZaVTNkQzBPUlFFSm9iQlRHaUpjdjdmbkh2YWpXVHBrTlJyZUFINTBRZFJHX0x3VkRkaTBVOEVZZDZucE42R0wxY1VWZnMyUnJtWDltWVRkNXNrR25uOVVFRjlBYXpWUG1vcTRmMHBHZE9hVWdYbVZOU1RRSnF4U3c0SzQ0d3lOanVCV0JPbURzZk1LdFBDZnJVUTFIemlqWFZlc3lvOU9RLVdKNFJQRlRRQncwbVNRWiJ9	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://tcjbpd-cmpzourl.maillist-manage.com/click/11259935e94618217/11259935e945e7722	Get hash	malicious	Unknown	Browse	199.67.84.76
	miraint.ppc440.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
INIT7CH	morte.arc.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	miraint.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.mips.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
	morte.spc.elf	Get hash	malicious	Mirai, Xmrig	Browse	109.202.202.202
AMAZON-02US	mirai.i686.elf	Get hash	malicious	Mirai	Browse	34.254.230.219
	morte.arc.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	54.171.230.55
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	miraint.x86.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	morte.arm6.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	morte.arm7.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219
	mirai.arm6.elf	Get hash	malicious	Mirai	Browse	18.157.142.188
	morte.arm.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.254.182.186
	morte.sh4.elf	Get hash	malicious	Mirai, Xmrig	Browse	34.249.145.219

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/user/1000/dconf/user

Download File

Process:	/usr/libexec/gvfs-udisks2-volume-monitor
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-media-keys
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.125232170637155
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWUfnMkN0p1H:q5sU3LWfLUDmQymqSFbfomS20pfh
MD5:	85D90EBBC1127A2A263F1E82908A593E
SHA1:	C120313E1FB96CC11A74BBA6BC8B754A18138651
SHA-256:	F536FDD8437CA6A72539232C6F102CED026FD1912D5644A59C5F88FCFF02ECB2
SHA-512:	191D0C886BFEDFE26E63E125A18AE17DB18C0752BE82CFB5E7C710A0F466230F5EA5252A85F74F0777B7B8CD1911C239EADF0225490AABD923A64BB40409E922
Malicious:	false
Reputation:	low
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-iwMcCkhh,guid=4721ee27f57d47173b5235ea686a1455.IBUS_DAEMON_PID=6516.

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.743262376339926
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	miraint.sh4.elf
File size:	51'756 bytes
MD5:	534057249570111308bfbe02b741564f
SHA1:	c41f8b8cf876f6e72b880abac23c92d32241b881
SHA256:	61f393b85dbb8d4b35fab546d1b249a8f2da452e3d221070b85a11ee491846e4
SHA512:	4a9cf5c6925402e59058d3b55736c897641c0a6af2ccb71912d95a873ef100f6609cf8097cfbc9728dc891481d88ac1383096de486b067bdf14aba89c3032ede
SSDEEP:	1536:zCwbCvQC6qwtTGlBVh4PwMFRrOVbuA+J8Cp:zleX6qCk7hoTr47+J8
TLSH:	14339D33C46AADC4E20D9279B6354D3C9BA3E101D24B3EF1A796855B8087EE8F5493F4
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@...........................A...A.x...............Q.td............................././"O.n........#.@........#.*@L....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	51356
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xbc60	0x0	0x6	AX	32
.fini	PROGBITS	0x40bd40	0xbd40	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40bd64	0xbd64	0x97c	0x0	0x2	A	4
.ctors	PROGBITS	0x41c6e4	0xc6e4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x41c6ec	0xc6ec	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x41c6f8	0xc6f8	0x164	0x0	0x3	WA	4
.bss	NOBITS	0x41c85c	0xc85c	0x320	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xc85c	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xc6e0	0xc6e0	6.7892	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xc6e4	0x41c6e4	0x41c6e4	0x178	0x498	0.8952	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2025 08:13:43.104407072 CEST	39258	443	192.168.2.23	34.249.145.219
Jul 6, 2025 08:13:43.848906040 CEST	41450	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:43.970622063 CEST	23	41450	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:43.970681906 CEST	41450	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:43.971128941 CEST	41450	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:43.971455097 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.092993975 CEST	23	41450	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.093147039 CEST	41450	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.093246937 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.093303919 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.094099998 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.215934038 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.216099024 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.337802887 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.337894917 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.338027954 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.338063002 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.338078976 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.338078976 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.338100910 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.338176012 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.338187933 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:44.338311911 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:44.338311911 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:45.152138948 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 6, 2025 08:13:51.295269012 CEST	39258	443	192.168.2.23	34.249.145.219
Jul 6, 2025 08:13:54.348798990 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:13:54.470654964 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:13:54.470716953 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:14:01.533967018 CEST	42516	80	192.168.2.23	109.202.202.202
Jul 6, 2025 08:14:05.629277945 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 6, 2025 08:14:07.421078920 CEST	39258	443	192.168.2.23	34.249.145.219
Jul 6, 2025 08:14:10.066946030 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:14:10.067229033 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:14:25.426958084 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:14:25.427057981 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:14:40.787609100 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:14:40.787662983 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:14:46.583538055 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 6, 2025 08:14:54.514441013 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:14:54.636230946 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:14:54.636298895 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:15:09.971963882 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:15:09.972043037 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:15:25.331075907 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:15:25.331135035 CEST	41452	23	192.168.2.23	207.167.64.24
Jul 6, 2025 08:15:40.693849087 CEST	23	41452	207.167.64.24	192.168.2.23
Jul 6, 2025 08:15:40.693902969 CEST	41452	23	192.168.2.23	207.167.64.24

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report miraint.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/user/1000/dconf/user

/run/user/127/dconf/user

/tmp/server-0.xkm

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Linux Analysis Report
miraint.sh4.elf