Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 213.142.151.173 |
Source: unknown | TCP traffic detected without corresponding DNS query: 42.206.170.59 |
Source: unknown | TCP traffic detected without corresponding DNS query: 135.200.170.59 |
Source: unknown | TCP traffic detected without corresponding DNS query: 71.54.177.109 |
Source: unknown | TCP traffic detected without corresponding DNS query: 202.177.85.67 |
Source: unknown | TCP traffic detected without corresponding DNS query: 114.160.19.53 |
Source: unknown | TCP traffic detected without corresponding DNS query: 87.217.87.234 |
Source: unknown | TCP traffic detected without corresponding DNS query: 90.89.149.49 |
Source: unknown | TCP traffic detected without corresponding DNS query: 24.233.73.211 |
Source: unknown | TCP traffic detected without corresponding DNS query: 150.108.251.103 |
Source: unknown | TCP traffic detected without corresponding DNS query: 63.192.40.80 |
Source: unknown | TCP traffic detected without corresponding DNS query: 241.42.225.34 |
Source: unknown | TCP traffic detected without corresponding DNS query: 242.129.72.75 |
Source: unknown | TCP traffic detected without corresponding DNS query: 101.49.83.55 |
Source: unknown | TCP traffic detected without corresponding DNS query: 173.78.106.113 |
Source: unknown | TCP traffic detected without corresponding DNS query: 101.254.144.216 |
Source: unknown | TCP traffic detected without corresponding DNS query: 98.93.82.125 |
Source: unknown | TCP traffic detected without corresponding DNS query: 171.116.26.149 |
Source: unknown | TCP traffic detected without corresponding DNS query: 61.186.211.87 |
Source: unknown | TCP traffic detected without corresponding DNS query: 182.185.141.79 |
Source: unknown | TCP traffic detected without corresponding DNS query: 62.115.180.247 |
Source: unknown | TCP traffic detected without corresponding DNS query: 193.234.174.245 |
Source: unknown | TCP traffic detected without corresponding DNS query: 162.73.72.127 |
Source: unknown | TCP traffic detected without corresponding DNS query: 4.62.3.193 |
Source: unknown | TCP traffic detected without corresponding DNS query: 61.184.114.68 |
Source: unknown | TCP traffic detected without corresponding DNS query: 85.12.220.195 |
Source: unknown | TCP traffic detected without corresponding DNS query: 241.239.160.106 |
Source: unknown | TCP traffic detected without corresponding DNS query: 195.247.35.66 |
Source: unknown | TCP traffic detected without corresponding DNS query: 2.73.22.72 |
Source: unknown | TCP traffic detected without corresponding DNS query: 163.105.58.142 |
Source: unknown | TCP traffic detected without corresponding DNS query: 192.43.12.27 |
Source: unknown | TCP traffic detected without corresponding DNS query: 105.177.247.193 |
Source: unknown | TCP traffic detected without corresponding DNS query: 46.91.160.204 |
Source: unknown | TCP traffic detected without corresponding DNS query: 115.38.14.246 |
Source: unknown | TCP traffic detected without corresponding DNS query: 13.214.102.207 |
Source: unknown | TCP traffic detected without corresponding DNS query: 116.189.120.228 |
Source: unknown | TCP traffic detected without corresponding DNS query: 44.115.184.183 |
Source: unknown | TCP traffic detected without corresponding DNS query: 245.122.77.51 |
Source: unknown | TCP traffic detected without corresponding DNS query: 212.12.238.192 |
Source: unknown | TCP traffic detected without corresponding DNS query: 106.254.136.117 |
Source: unknown | TCP traffic detected without corresponding DNS query: 90.0.137.25 |
Source: unknown | TCP traffic detected without corresponding DNS query: 85.34.241.134 |
Source: unknown | TCP traffic detected without corresponding DNS query: 252.156.109.83 |
Source: unknown | TCP traffic detected without corresponding DNS query: 160.60.84.94 |
Source: unknown | TCP traffic detected without corresponding DNS query: 220.109.255.28 |
Source: unknown | TCP traffic detected without corresponding DNS query: 42.81.82.77 |
Source: unknown | TCP traffic detected without corresponding DNS query: 240.107.174.34 |
Source: unknown | TCP traffic detected without corresponding DNS query: 123.38.162.221 |
Source: unknown | TCP traffic detected without corresponding DNS query: 155.128.50.176 |
Source: 6232.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: 6232.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: 6229.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: 6229.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: 6239.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: 6239.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: 6233.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects Mirai Botnet Malware Author: Florian Roth |
Source: 6233.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: 6239.1.00007fd584030000.00007fd584032000.rw-.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: 6229.1.00007fd584030000.00007fd584032000.rw-.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: 6232.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: 6232.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: 6232.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 6229.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: 6229.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: 6229.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 6239.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: 6239.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: 6239.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 6233.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: 6233.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b |
Source: 6233.1.00007fd584017000.00007fd584029000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 6232.1.00007fd584030000.00007fd584032000.rw-.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: 6233.1.00007fd584030000.00007fd584032000.rw-.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13 |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/491/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/793/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/772/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/796/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/774/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/797/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/777/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/799/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/658/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/912/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/759/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/936/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/918/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/1/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/761/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/785/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/884/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/720/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/721/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/788/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/789/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/800/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/801/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/847/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6232) | File opened: /proc/904/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/6232/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2033/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2033/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1582/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1582/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2275/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/6191/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/6192/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1612/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1612/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1579/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1579/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1699/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1699/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1335/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1335/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1698/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1698/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2028/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2028/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1334/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1334/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1576/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1576/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2302/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/3236/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2025/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2025/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2146/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/910/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/912/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/912/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/912/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/759/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/759/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/759/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/517/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2307/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/918/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/918/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/918/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1594/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1594/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2285/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2281/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1349/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1349/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1623/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1623/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/761/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/761/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/761/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1622/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1622/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/884/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/884/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/884/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1983/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1983/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2038/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2038/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1586/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1586/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1465/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1465/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1344/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1344/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1860/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1860/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1463/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/1463/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/2156/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/800/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/800/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/800/exe | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/801/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/801/fd | Jump to behavior |
Source: /tmp/xd.arm (PID: 6238) | File opened: /proc/801/exe | Jump to behavior |
Source: 6335.26.dr | Binary or memory string: -9915837702310A--gzvmware kernel module |
Source: 6335.26.dr | Binary or memory string: -1116261022170A--gzQEMU User Emulator |
Source: 6335.26.dr | Binary or memory string: qemu-or1k |
Source: 6335.26.dr | Binary or memory string: qemu-riscv64 |
Source: 6335.26.dr | Binary or memory string: {cqemu |
Source: 6335.26.dr | Binary or memory string: qemu-arm |
Source: xd.arm, 6229.1.0000562cbaa4e000.0000562cbab7c000.rw-.sdmp, xd.arm, 6232.1.0000562cbaa4e000.0000562cbab7c000.rw-.sdmp, xd.arm, 6233.1.0000562cbaa4e000.0000562cbab7c000.rw-.sdmp, xd.arm, 6239.1.0000562cbaa4e000.0000562cbab7c000.rw-.sdmp | Binary or memory string: ,V!/etc/qemu-binfmt/arm |
Source: 6335.26.dr | Binary or memory string: (qemu |
Source: 6335.26.dr | Binary or memory string: qemu-tilegx |
Source: 6335.26.dr | Binary or memory string: qemu-hppa |
Source: 6335.26.dr | Binary or memory string: q{rqemu% |
Source: 6335.26.dr | Binary or memory string: )qemu |
Source: 6335.26.dr | Binary or memory string: vmware-toolbox-cmd |
Source: 6335.26.dr | Binary or memory string: qemu-ppc |
Source: 6335.26.dr | Binary or memory string: Tqemu9 |
Source: 6335.26.dr | Binary or memory string: qemu-aarch64_be |
Source: 6335.26.dr | Binary or memory string: 0qemu9 |
Source: 6335.26.dr | Binary or memory string: qemu-sparc64 |
Source: 6335.26.dr | Binary or memory string: qemu-mips64 |
Source: 6335.26.dr | Binary or memory string: vV:qemu9 |
Source: 6335.26.dr | Binary or memory string: qemu-ppc64le |
Source: 6335.26.dr | Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-111582782727 |