I found that in qemu user space on linux (qemu-i386), if you execute an executable that contains an "execve" this is execute into qemu-i386 replacing it.