Source: 5493.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5493.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5494.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5494.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5489.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5489.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: XCpzABZN79.elf PID: 5489, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: XCpzABZN79.elf PID: 5489, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3129, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3184, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3187, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3188, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3189, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3190, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3193, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3207, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3215, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3235, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5494, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5509, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5510, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5511, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5512, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5513, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5514, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5531, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5562, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5569, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3129, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3184, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3187, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3188, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3189, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3190, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3193, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3207, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3215, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 3235, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5494, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5509, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5510, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5511, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5512, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5513, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5514, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5531, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5562, result: successful | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | SIGKILL sent: pid: 5569, result: successful | Jump to behavior |
Source: 5493.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5493.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5494.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5494.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5489.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5489.1.00007f6740017000.00007f674002b000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: XCpzABZN79.elf PID: 5489, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: XCpzABZN79.elf PID: 5489, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5509) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5510) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5511) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5512) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /usr/share/fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /usr/local/share/fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /home/saturnino/.local/share/fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /home/saturnino/.fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /usr/share/fonts/X11/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /usr/share/fonts/cMap/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /usr/share/fonts/cmap/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /home/saturnino/.cache | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /home/saturnino/.local | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5513) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5514) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5531) | Directory: /home/saturnino/.cache | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5531) | Directory: /home/saturnino/.local | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5531) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5531) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5562) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5562) | Directory: /home/saturnino/.cache | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5562) | Directory: /home/saturnino/.local | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5562) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5569) | Directory: /home/saturnino/.cache | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5569) | Directory: /home/saturnino/.local | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5569) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5569) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3760/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3761/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/2672/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1583/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3244/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3120/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3361/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3239/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1577/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1610/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/512/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1299/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3235/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/514/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/519/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/2946/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/917/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3134/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1593/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3011/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3094/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3406/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1589/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3129/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1588/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3402/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3125/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3246/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3245/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/767/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/800/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/888/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3762/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/801/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3763/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/769/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/803/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/806/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/807/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/928/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/2956/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/5562/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3420/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/490/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3142/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1635/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1633/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1599/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3139/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1873/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1630/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3412/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/657/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/658/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/659/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/418/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/5437/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/419/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1639/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1638/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/5332/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3398/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1371/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3392/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/780/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/660/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/661/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/782/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1369/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3304/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3425/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/785/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1642/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/940/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/941/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1640/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3147/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3268/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1364/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/548/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/5569/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1647/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3682/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/2991/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1383/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1382/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1381/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/791/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/671/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3837/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/794/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1655/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/2986/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/795/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/674/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1653/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/797/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/2983/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3159/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/678/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1650/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3157/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/679/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/1659/cmdline | Jump to behavior |
Source: /tmp/XCpzABZN79.elf (PID: 5491) | File opened: /proc/3319/cmdline | Jump to behavior |
Source: XCpzABZN79.elf, 5489.1.00007ffeb0064000.00007ffeb0085000.rw-.sdmp, XCpzABZN79.elf, 5493.1.00007ffeb0064000.00007ffeb0085000.rw-.sdmp, XCpzABZN79.elf, 5494.1.00007ffeb0064000.00007ffeb0085000.rw-.sdmp | Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/XCpzABZN79.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XCpzABZN79.elf |
Source: XCpzABZN79.elf, 5489.1.000055c98e2ba000.000055c98e488000.rw-.sdmp, XCpzABZN79.elf, 5493.1.000055c98e2ba000.000055c98e488000.rw-.sdmp, XCpzABZN79.elf, 5494.1.000055c98e2ba000.000055c98e488000.rw-.sdmp | Binary or memory string: U!/etc/qemu-binfmt/arm |
Source: XCpzABZN79.elf, 5489.1.000055c98e2ba000.000055c98e488000.rw-.sdmp, XCpzABZN79.elf, 5493.1.000055c98e2ba000.000055c98e488000.rw-.sdmp, XCpzABZN79.elf, 5494.1.000055c98e2ba000.000055c98e488000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/arm |
Source: XCpzABZN79.elf, 5489.1.00007ffeb0064000.00007ffeb0085000.rw-.sdmp, XCpzABZN79.elf, 5493.1.00007ffeb0064000.00007ffeb0085000.rw-.sdmp, XCpzABZN79.elf, 5494.1.00007ffeb0064000.00007ffeb0085000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-arm |