Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2018, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2077, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2078, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2079, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2080, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2083, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2084, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2114, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2156, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6236, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6243, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6244, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6245, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6246, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6247, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6248, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6267, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6277, result: successful |
Jump to behavior |
Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2018, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2077, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2078, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2079, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2080, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2083, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2084, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2114, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 2156, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6236, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6243, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6244, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6245, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6246, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6247, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6248, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6267, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
SIGKILL sent: pid: 6277, result: successful |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6236/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1582/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2033/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2275/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/3088/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6191/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6192/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1612/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1579/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1699/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1335/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1698/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2028/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1334/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1576/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2302/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/3236/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2025/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2146/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/910/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/912/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/517/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/759/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2307/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/918/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6243/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6245/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6244/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6247/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6246/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1594/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2285/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2281/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1349/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1623/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/761/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1622/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/884/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1983/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2038/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1344/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1465/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1586/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1463/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2156/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/800/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/801/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1629/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6239/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1627/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1900/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/3021/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/491/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2294/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2050/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1877/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/772/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1633/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1599/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1632/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/774/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1477/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/654/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/896/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1476/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1872/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2048/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/655/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1475/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2289/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/656/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/777/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/657/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/4466/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/658/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/4467/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6248/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/4468/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/4469/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/4502/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/419/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/936/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1639/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1638/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2208/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2180/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6267/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1809/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1494/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1890/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2063/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/2062/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1888/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1886/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/420/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1489/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/785/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1642/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/788/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/667/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/789/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/1648/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6277/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/4497/cmdline |
Jump to behavior |
Source: /tmp/TvhJo1pOSe (PID: 6233) |
File opened: /proc/6158/cmdline |
Jump to behavior |
Source: TvhJo1pOSe, 6230.1.00007ffd0ddc6000.00007ffd0dde7000.rw-.sdmp, TvhJo1pOSe, 6234.1.00007ffd0ddc6000.00007ffd0dde7000.rw-.sdmp, TvhJo1pOSe, 6236.1.00007ffd0ddc6000.00007ffd0dde7000.rw-.sdmp |
Binary or memory string: Zx86_64/usr/bin/qemu-arm/tmp/TvhJo1pOSeSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/TvhJo1pOSe |
Source: TvhJo1pOSe, 6230.1.00005603b1fb7000.00005603b2125000.rw-.sdmp, TvhJo1pOSe, 6234.1.00005603b1fb7000.00005603b2125000.rw-.sdmp, TvhJo1pOSe, 6236.1.00005603b1fb7000.00005603b2125000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/arm |
Source: TvhJo1pOSe, 6230.1.00005603b1fb7000.00005603b2125000.rw-.sdmp, TvhJo1pOSe, 6234.1.00005603b1fb7000.00005603b2125000.rw-.sdmp, TvhJo1pOSe, 6236.1.00005603b1fb7000.00005603b2125000.rw-.sdmp |
Binary or memory string: V!/etc/qemu-binfmt/arm |
Source: TvhJo1pOSe, 6230.1.00007ffd0ddc6000.00007ffd0dde7000.rw-.sdmp, TvhJo1pOSe, 6234.1.00007ffd0ddc6000.00007ffd0dde7000.rw-.sdmp, TvhJo1pOSe, 6236.1.00007ffd0ddc6000.00007ffd0dde7000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-arm |