Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5540/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5541/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5322/cmdline | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5520/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5542/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5521/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5543/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5519/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5511/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5555/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5512/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5556/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5513/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5557/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5514/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5515/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5516/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5538/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5517/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5539/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5518/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5550/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5551/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5552/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5553/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5510/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5554/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5508/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/1/cmdline | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5509/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5522/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5544/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5523/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5545/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5524/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5546/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5525/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5547/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5548/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5549/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5492) | File opened: /proc/5507/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5482/cmdline | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5540/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5541/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5322/cmdline | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5520/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5542/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5521/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5543/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5519/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5511/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5555/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5512/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5556/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5513/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5557/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5514/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5515/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5516/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5538/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5517/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5539/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5518/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5492/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5494/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5494/cmdline | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5550/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5496/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5551/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5552/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5553/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5510/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5554/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5508/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/1/cmdline | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5509/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5522/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5544/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5523/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5545/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5524/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5546/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5525/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5547/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5548/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5549/status | Jump to behavior |
Source: /tmp/arm5.elf (PID: 5484) | File opened: /proc/5507/status | Jump to behavior |
Source: arm5.elf, 5479.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5482.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5494.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5588.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5590.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp | Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf |
Source: arm5.elf, 5479.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5482.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5494.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5588.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5590.1.000055c3ff021000.000055c3ff197000.rw-.sdmp | Binary or memory string: U!/etc/qemu-binfmt/arm |
Source: arm5.elf, 5479.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5482.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5494.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5588.1.000055c3ff021000.000055c3ff197000.rw-.sdmp, arm5.elf, 5590.1.000055c3ff021000.000055c3ff197000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/arm |
Source: arm5.elf, 5479.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5482.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5494.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5588.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp, arm5.elf, 5590.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-arm |
Source: arm5.elf, 5494.1.00007ffc283c8000.00007ffc283e9000.rw-.sdmp | Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped |
Source: Yara match | File source: arm5.elf, type: SAMPLE |
Source: Yara match | File source: 5479.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5482.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5494.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5588.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5590.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5479, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5482, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5588, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5590, type: MEMORYSTR |
Source: Yara match | File source: arm5.elf, type: SAMPLE |
Source: Yara match | File source: 5479.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5482.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5494.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5588.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 5590.1.00007fce0c017000.00007fce0c029000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5479, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5482, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5494, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5588, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: arm5.elf PID: 5590, type: MEMORYSTR |