Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5540/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5541/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5322/cmdline |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5520/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5542/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5521/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5543/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5519/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5511/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5555/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5512/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5556/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5513/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5557/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5514/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5515/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5516/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5538/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5517/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5539/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5518/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5550/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5551/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5552/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5553/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5510/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5554/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5508/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/1/cmdline |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5509/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5522/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5544/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5523/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5545/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5524/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5546/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5525/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5547/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5548/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5549/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) |
File opened: /proc/5507/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5482/cmdline |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5540/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5541/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5322/cmdline |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5520/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5542/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5521/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5543/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5519/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5511/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5555/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5512/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5556/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5513/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5557/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5514/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5515/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5516/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5538/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5517/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5539/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5518/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5492/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5494/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5494/cmdline |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5550/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5496/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5551/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5552/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5553/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5510/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5554/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5508/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/1/cmdline |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5509/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5522/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5544/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5523/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5545/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5524/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5546/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5525/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5547/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5548/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5549/status |
Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) |
File opened: /proc/5507/status |
Jump to behavior |
Source: arm5.elf, 5479.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5482.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5494.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5588.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5590.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf |
Source: arm5.elf, 5479.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5482.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5494.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5588.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5590.1.000055c3ff021000.000055c3ff197000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/arm |
Source: arm5.elf, 5479.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5482.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5494.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5588.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5590.1.000055c3ff021000.000055c3ff197000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/arm |
Source: arm5.elf, 5479.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5482.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5494.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5588.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5590.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-arm |
Source: arm5.elf, 5494.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp |
Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped |
Source: Yara match |
File source: arm5.elf, type: SAMPLE |
Source: Yara match |
File source: 5479.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5482.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5494.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5588.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5590.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5479, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5482, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5588, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5590, type: MEMORYSTR |
Source: Yara match |
File source: arm5.elf, type: SAMPLE |
Source: Yara match |
File source: 5479.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5482.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5494.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5588.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 5590.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5479, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5482, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5588, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: arm5.elf PID: 5590, type: MEMORYSTR |