Analysis
-
max time kernel
31s -
max time network
69s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
05-02-2024 16:30
Static task
static1
Behavioral task
behavioral1
Sample
pg.sh
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral2
Sample
pg.sh
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral3
Sample
pg.sh
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral4
Sample
pg.sh
Resource
debian9-mipsel-20231215-en
General
-
Target
pg.sh
-
Size
35KB
-
MD5
2550990d2d52581b213e7c9305c392d3
-
SHA1
f7f069915c9b97550dc1fb6cf631f6222416dcf5
-
SHA256
8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006
-
SHA512
a30d4a39203e6a98937e8670b7b3caaa63d2141fdf404bb28ca240d95cb7420bdfb8c695db81cc9c799e8818266600c137b8b0df2dfc69d7566bae64eee2ad50
-
SSDEEP
768:X87XzQ5VFNcDAFLcIwgnoYq0xFB6ytguz:X3VF+D6cIwgos/z
Malware Config
Signatures
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog rm -
Flushes firewall rules 2 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 1544 ufw 1719 iptables -
ioc pid Process /lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko 1551 modprobe -
Attempts to change immutable files 49 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 1541 chattr 1569 iptables 1649 ip6tables 1673 ip6tables 1641 ip6tables 1680 ip6tables 1705 ip6tables 1600 iptables 1566 iptables 1542 chattr 1629 iptables 1676 ip6tables 1599 iptables 1632 iptables 1677 ip6tables 1592 iptables 1595 iptables 1598 iptables 1543 chattr 1565 iptables 1580 iptables 1596 iptables 1644 ip6tables 1678 ip6tables 1713 ip6tables 1560 iptables 1567 iptables 1601 iptables 1681 ip6tables 1682 ip6tables 1693 ip6tables 1612 iptables 1679 ip6tables 1549 ufw-init 1647 ip6tables 1710 ip6tables 1540 chattr 1563 iptables 1564 iptables 1597 iptables 1646 ip6tables 1724 chattr 1568 iptables 1624 iptables 1648 ip6tables 1725 chattr 1645 ip6tables 1650 ip6tables 1661 ip6tables -
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/module/x_tables/initstate modprobe File opened for reading /sys/module/ip6_tables/initstate modprobe -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1123 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems sudo File opened for reading /proc/1059 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1127 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1169 ls File opened for reading /proc/1181 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1037 ls File opened for reading /proc/1187 ls File opened for reading /proc/1188 ls File opened for reading /proc/filesystems ls File opened for reading /proc/1072 ls File opened for reading /proc/1086 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1152 ls File opened for reading /proc/sys/kernel/modprobe ip6tables File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/1156 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1144 ls File opened for reading /proc/1099 ls File opened for reading /proc/115 ls File opened for reading /proc/filesystems ls File opened for reading /proc/1186 ls File opened for reading /proc/filesystems userdel File opened for reading /proc/1023 ls File opened for reading /proc/filesystems ls File opened for reading /proc/1131 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1173 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1056 ls File opened for reading /proc/1149 ls File opened for reading /proc/1189 ls File opened for reading /proc/self/fd Process not Found File opened for reading /proc/filesystems ls File opened for reading /proc/1115 ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1184 ls File opened for reading /proc/filesystems ls File opened for reading /proc/12 ls File opened for reading /proc/filesystems userdel File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/1168 ls File opened for reading /proc/10 ls File opened for reading /proc/filesystems ls File opened for reading /proc/1114 ls -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/log_rot pg.sh
Processes
-
/tmp/pg.sh/tmp/pg.sh1⤵
- Writes file to tmp directory
PID:1538 -
/bin/rmrm -rf /var/log/syslog2⤵
- Deletes system logs
PID:1539
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Attempts to change immutable files
PID:1540
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Attempts to change immutable files
PID:1541
-
-
/usr/bin/chattrchattr -R -i /var/spool/cron2⤵
- Attempts to change immutable files
PID:1542
-
-
/usr/bin/chattrchattr -i /etc/crontab2⤵
- Attempts to change immutable files
PID:1543
-
-
/usr/sbin/ufwufw disable2⤵
- Flushes firewall rules
PID:1544 -
/sbin/iptables/sbin/iptables -V3⤵PID:1548
-
-
/lib/ufw/ufw-init/lib/ufw/ufw-init force-stop3⤵
- Attempts to change immutable files
PID:1549 -
/sbin/ip6tablesip6tables -L INPUT -n4⤵
- Reads runtime system information
PID:1550 -
/sbin/modprobe/sbin/modprobe ip6_tables5⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
PID:1551
-
-
-
/sbin/iptablesiptables -F ufw-logging-deny4⤵PID:1555
-
-
/sbin/iptablesiptables -F ufw-logging-allow4⤵PID:1558
-
-
/sbin/iptablesiptables -F ufw-not-local4⤵PID:1559
-
-
/sbin/iptablesiptables -F ufw-user-logging-input4⤵
- Attempts to change immutable files
PID:1560
-
-
/sbin/iptablesiptables -F ufw-user-limit-accept4⤵PID:1561
-
-
/sbin/iptablesiptables -F ufw-user-limit4⤵PID:1562
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-input4⤵
- Attempts to change immutable files
PID:1563
-
-
/sbin/iptablesiptables -F ufw-reject-input4⤵
- Attempts to change immutable files
PID:1564
-
-
/sbin/iptablesiptables -F ufw-after-logging-input4⤵
- Attempts to change immutable files
PID:1565
-
-
/sbin/iptablesiptables -F ufw-after-input4⤵
- Attempts to change immutable files
PID:1566
-
-
/sbin/iptablesiptables -F ufw-user-input4⤵
- Attempts to change immutable files
PID:1567
-
-
/sbin/iptablesiptables -F ufw-before-input4⤵
- Attempts to change immutable files
PID:1568
-
-
/sbin/iptablesiptables -F ufw-before-logging-input4⤵
- Attempts to change immutable files
PID:1569
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-forward4⤵PID:1570
-
-
/sbin/iptablesiptables -F ufw-reject-forward4⤵PID:1571
-
-
/sbin/iptablesiptables -F ufw-after-logging-forward4⤵PID:1572
-
-
/sbin/iptablesiptables -F ufw-after-forward4⤵PID:1573
-
-
/sbin/iptablesiptables -F ufw-user-logging-forward4⤵PID:1574
-
-
/sbin/iptablesiptables -F ufw-user-forward4⤵PID:1575
-
-
/sbin/iptablesiptables -F ufw-before-forward4⤵PID:1576
-
-
/sbin/iptablesiptables -F ufw-before-logging-forward4⤵PID:1577
-
-
/sbin/iptablesiptables -F ufw-track-forward4⤵PID:1578
-
-
/sbin/iptablesiptables -F ufw-track-output4⤵PID:1579
-
-
/sbin/iptablesiptables -F ufw-track-input4⤵
- Attempts to change immutable files
PID:1580
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-output4⤵PID:1581
-
-
/sbin/iptablesiptables -F ufw-reject-output4⤵PID:1582
-
-
/sbin/iptablesiptables -F ufw-after-logging-output4⤵PID:1583
-
-
/sbin/iptablesiptables -F ufw-after-output4⤵PID:1584
-
-
/sbin/iptablesiptables -F ufw-user-logging-output4⤵PID:1585
-
-
/sbin/iptablesiptables -F ufw-user-output4⤵PID:1586
-
-
/sbin/iptablesiptables -F ufw-before-output4⤵PID:1587
-
-
/sbin/iptablesiptables -F ufw-before-logging-output4⤵PID:1588
-
-
/sbin/iptablesiptables -Z ufw-logging-deny4⤵PID:1589
-
-
/sbin/iptablesiptables -Z ufw-logging-allow4⤵PID:1590
-
-
/sbin/iptablesiptables -Z ufw-not-local4⤵PID:1591
-
-
/sbin/iptablesiptables -Z ufw-user-logging-input4⤵
- Attempts to change immutable files
PID:1592
-
-
/sbin/iptablesiptables -Z ufw-user-limit-accept4⤵PID:1593
-
-
/sbin/iptablesiptables -Z ufw-user-limit4⤵PID:1594
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-input4⤵
- Attempts to change immutable files
PID:1595
-
-
/sbin/iptablesiptables -Z ufw-reject-input4⤵
- Attempts to change immutable files
PID:1596
-
-
/sbin/iptablesiptables -Z ufw-after-logging-input4⤵
- Attempts to change immutable files
PID:1597
-
-
/sbin/iptablesiptables -Z ufw-after-input4⤵
- Attempts to change immutable files
PID:1598
-
-
/sbin/iptablesiptables -Z ufw-user-input4⤵
- Attempts to change immutable files
PID:1599
-
-
/sbin/iptablesiptables -Z ufw-before-input4⤵
- Attempts to change immutable files
PID:1600
-
-
/sbin/iptablesiptables -Z ufw-before-logging-input4⤵
- Attempts to change immutable files
PID:1601
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-forward4⤵PID:1602
-
-
/sbin/iptablesiptables -Z ufw-reject-forward4⤵PID:1603
-
-
/sbin/iptablesiptables -Z ufw-after-logging-forward4⤵PID:1604
-
-
/sbin/iptablesiptables -Z ufw-after-forward4⤵PID:1605
-
-
/sbin/iptablesiptables -Z ufw-user-logging-forward4⤵PID:1606
-
-
/sbin/iptablesiptables -Z ufw-user-forward4⤵PID:1607
-
-
/sbin/iptablesiptables -Z ufw-before-forward4⤵PID:1608
-
-
/sbin/iptablesiptables -Z ufw-before-logging-forward4⤵PID:1609
-
-
/sbin/iptablesiptables -Z ufw-track-forward4⤵PID:1610
-
-
/sbin/iptablesiptables -Z ufw-track-output4⤵PID:1611
-
-
/sbin/iptablesiptables -Z ufw-track-input4⤵
- Attempts to change immutable files
PID:1612
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-output4⤵PID:1613
-
-
/sbin/iptablesiptables -Z ufw-reject-output4⤵PID:1614
-
-
/sbin/iptablesiptables -Z ufw-after-logging-output4⤵PID:1615
-
-
/sbin/iptablesiptables -Z ufw-after-output4⤵PID:1616
-
-
/sbin/iptablesiptables -Z ufw-user-logging-output4⤵PID:1617
-
-
/sbin/iptablesiptables -Z ufw-user-output4⤵PID:1618
-
-
/sbin/iptablesiptables -Z ufw-before-output4⤵PID:1619
-
-
/sbin/iptablesiptables -Z ufw-before-logging-output4⤵PID:1620
-
-
/sbin/iptablesiptables -X ufw-logging-deny4⤵PID:1621
-
-
/sbin/iptablesiptables -X ufw-logging-allow4⤵PID:1622
-
-
/sbin/iptablesiptables -X ufw-not-local4⤵PID:1623
-
-
/sbin/iptablesiptables -X ufw-user-logging-input4⤵
- Attempts to change immutable files
PID:1624
-
-
/sbin/iptablesiptables -X ufw-user-logging-output4⤵PID:1625
-
-
/sbin/iptablesiptables -X ufw-user-logging-forward4⤵PID:1626
-
-
/sbin/iptablesiptables -X ufw-user-limit-accept4⤵PID:1627
-
-
/sbin/iptablesiptables -X ufw-user-limit4⤵PID:1628
-
-
/sbin/iptablesiptables -X ufw-user-input4⤵
- Attempts to change immutable files
PID:1629
-
-
/sbin/iptablesiptables -X ufw-user-forward4⤵PID:1630
-
-
/sbin/iptablesiptables -X ufw-user-output4⤵PID:1631
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-input4⤵
- Attempts to change immutable files
PID:1632
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-output4⤵PID:1633
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-forward4⤵PID:1634
-
-
/sbin/iptablesiptables -P INPUT ACCEPT4⤵PID:1635
-
-
/sbin/iptablesiptables -P OUTPUT ACCEPT4⤵PID:1636
-
-
/sbin/iptablesiptables -P FORWARD ACCEPT4⤵PID:1637
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-deny4⤵PID:1638
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-allow4⤵PID:1639
-
-
/sbin/ip6tablesip6tables -F ufw6-not-local4⤵PID:1640
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-input4⤵
- Attempts to change immutable files
PID:1641
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit-accept4⤵PID:1642
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit4⤵PID:1643
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-input4⤵
- Attempts to change immutable files
PID:1644
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-input4⤵
- Attempts to change immutable files
PID:1645
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-input4⤵
- Attempts to change immutable files
PID:1646
-
-
/sbin/ip6tablesip6tables -F ufw6-after-input4⤵
- Attempts to change immutable files
PID:1647
-
-
/sbin/ip6tablesip6tables -F ufw6-user-input4⤵
- Attempts to change immutable files
PID:1648
-
-
/sbin/ip6tablesip6tables -F ufw6-before-input4⤵
- Attempts to change immutable files
PID:1649
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-input4⤵
- Attempts to change immutable files
PID:1650
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-forward4⤵PID:1651
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-forward4⤵PID:1652
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-forward4⤵PID:1653
-
-
/sbin/ip6tablesip6tables -F ufw6-after-forward4⤵PID:1654
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-forward4⤵PID:1655
-
-
/sbin/ip6tablesip6tables -F ufw6-user-forward4⤵PID:1656
-
-
/sbin/ip6tablesip6tables -F ufw6-before-forward4⤵PID:1657
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-forward4⤵PID:1658
-
-
/sbin/ip6tablesip6tables -F ufw6-track-forward4⤵PID:1659
-
-
/sbin/ip6tablesip6tables -F ufw6-track-output4⤵PID:1660
-
-
/sbin/ip6tablesip6tables -F ufw6-track-input4⤵
- Attempts to change immutable files
PID:1661
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-output4⤵PID:1662
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-output4⤵PID:1663
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-output4⤵PID:1664
-
-
/sbin/ip6tablesip6tables -F ufw6-after-output4⤵PID:1665
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-output4⤵PID:1666
-
-
/sbin/ip6tablesip6tables -F ufw6-user-output4⤵PID:1667
-
-
/sbin/ip6tablesip6tables -F ufw6-before-output4⤵PID:1668
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-output4⤵PID:1669
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-deny4⤵PID:1670
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-allow4⤵PID:1671
-
-
/sbin/ip6tablesip6tables -Z ufw6-not-local4⤵PID:1672
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-input4⤵
- Attempts to change immutable files
PID:1673
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit-accept4⤵PID:1674
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit4⤵PID:1675
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-input4⤵
- Attempts to change immutable files
PID:1676
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-input4⤵
- Attempts to change immutable files
PID:1677
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-input4⤵
- Attempts to change immutable files
PID:1678
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-input4⤵
- Attempts to change immutable files
PID:1679
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-input4⤵
- Attempts to change immutable files
PID:1680
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-input4⤵
- Attempts to change immutable files
PID:1681
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-input4⤵
- Attempts to change immutable files
PID:1682
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-forward4⤵PID:1683
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-forward4⤵PID:1684
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-forward4⤵PID:1685
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-forward4⤵PID:1686
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-forward4⤵PID:1687
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-forward4⤵PID:1688
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-forward4⤵PID:1689
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-forward4⤵PID:1690
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-forward4⤵PID:1691
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-output4⤵PID:1692
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-input4⤵
- Attempts to change immutable files
PID:1693
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-output4⤵PID:1694
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-output4⤵PID:1695
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-output4⤵PID:1696
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-output4⤵PID:1697
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-output4⤵PID:1698
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-output4⤵PID:1699
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-output4⤵PID:1700
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-output4⤵PID:1701
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-deny4⤵PID:1702
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-allow4⤵PID:1703
-
-
/sbin/ip6tablesip6tables -X ufw6-not-local4⤵PID:1704
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-input4⤵
- Attempts to change immutable files
PID:1705
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-output4⤵PID:1706
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-forward4⤵PID:1707
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit-accept4⤵PID:1708
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit4⤵PID:1709
-
-
/sbin/ip6tablesip6tables -X ufw6-user-input4⤵
- Attempts to change immutable files
PID:1710
-
-
/sbin/ip6tablesip6tables -X ufw6-user-forward4⤵PID:1711
-
-
/sbin/ip6tablesip6tables -X ufw6-user-output4⤵PID:1712
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-input4⤵
- Attempts to change immutable files
PID:1713
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-output4⤵PID:1714
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-forward4⤵PID:1715
-
-
/sbin/ip6tablesip6tables -P INPUT ACCEPT4⤵PID:1716
-
-
/sbin/ip6tablesip6tables -P OUTPUT ACCEPT4⤵PID:1717
-
-
/sbin/ip6tablesip6tables -P FORWARD ACCEPT4⤵PID:1718
-
-
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:1719
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵
- Reads runtime system information
PID:1720 -
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:1721
-
-
-
/usr/sbin/userdeluserdel akay2⤵
- Reads runtime system information
PID:1722
-
-
/usr/sbin/userdeluserdel vfinder2⤵
- Reads runtime system information
PID:1723
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Attempts to change immutable files
PID:1724
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Attempts to change immutable files
PID:1725
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:1726
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:1727
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:1728
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1733
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1738
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1743
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1748
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1753
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1758
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1763
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1768
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1773
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1778
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1783
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1788
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1793
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1798
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1803
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1808
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1813
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1818
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1823
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1828
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1833
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1838
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1843
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1848
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1853
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1858
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1863
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1868
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1873
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1878
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1883
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1888
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1893
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1898
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1903
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1908
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1913
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1918
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1923
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1928
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1933
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1938
-
-
/bin/grepgrep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"2⤵PID:1944
-
-
/bin/lsls -latrh /proc/11⤵PID:1730
-
/bin/grepgrep exe1⤵PID:1731
-
/bin/lsls -latrh /proc/101⤵
- Reads runtime system information
PID:1735
-
/bin/grepgrep exe1⤵PID:1736
-
/bin/lsls -latrh /proc/10181⤵
- Reads runtime system information
PID:1740
-
/bin/grepgrep exe1⤵PID:1741
-
/bin/lsls -latrh /proc/10231⤵
- Reads runtime system information
PID:1745
-
/bin/grepgrep exe1⤵PID:1746
-
/bin/lsls -latrh /proc/10371⤵
- Reads runtime system information
PID:1750
-
/bin/grepgrep exe1⤵PID:1751
-
/bin/lsls -latrh /proc/10431⤵
- Reads runtime system information
PID:1755
-
/bin/grepgrep exe1⤵PID:1756
-
/bin/lsls -latrh /proc/10561⤵
- Reads runtime system information
PID:1760
-
/bin/grepgrep exe1⤵PID:1761
-
/bin/lsls -latrh /proc/10591⤵
- Reads runtime system information
PID:1765
-
/bin/grepgrep exe1⤵PID:1766
-
/bin/lsls -latrh /proc/10671⤵PID:1770
-
/bin/grepgrep exe1⤵PID:1771
-
/bin/lsls -latrh /proc/10691⤵
- Reads runtime system information
PID:1775
-
/bin/grepgrep exe1⤵PID:1776
-
/bin/lsls -latrh /proc/10721⤵
- Reads runtime system information
PID:1780
-
/bin/grepgrep exe1⤵PID:1781
-
/bin/lsls -latrh /proc/10811⤵
- Reads runtime system information
PID:1785
-
/bin/grepgrep exe1⤵PID:1786
-
/bin/lsls -latrh /proc/10861⤵
- Reads runtime system information
PID:1790
-
/bin/grepgrep exe1⤵PID:1791
-
/bin/grepgrep exe1⤵PID:1796
-
/bin/lsls -latrh /proc/10911⤵
- Reads runtime system information
PID:1795
-
/bin/lsls -latrh /proc/10991⤵
- Reads runtime system information
PID:1800
-
/bin/grepgrep exe1⤵PID:1801
-
/bin/lsls -latrh /proc/111⤵
- Reads runtime system information
PID:1805
-
/bin/grepgrep exe1⤵PID:1806
-
/bin/lsls -latrh /proc/11141⤵
- Reads runtime system information
PID:1810
-
/bin/grepgrep exe1⤵PID:1811
-
/bin/lsls -latrh /proc/11151⤵
- Reads runtime system information
PID:1815
-
/bin/grepgrep exe1⤵PID:1816
-
/bin/lsls -latrh /proc/11231⤵
- Reads runtime system information
PID:1820
-
/bin/grepgrep exe1⤵PID:1821
-
/bin/grepgrep exe1⤵PID:1826
-
/bin/lsls -latrh /proc/11271⤵
- Reads runtime system information
PID:1825
-
/bin/lsls -latrh /proc/11311⤵
- Reads runtime system information
PID:1830
-
/bin/grepgrep exe1⤵PID:1831
-
/bin/lsls -latrh /proc/11351⤵
- Reads runtime system information
PID:1835
-
/bin/grepgrep exe1⤵PID:1836
-
/bin/lsls -latrh /proc/11391⤵PID:1840
-
/bin/grepgrep exe1⤵PID:1841
-
/bin/lsls -latrh /proc/11441⤵
- Reads runtime system information
PID:1845
-
/bin/grepgrep exe1⤵PID:1846
-
/bin/grepgrep exe1⤵PID:1851
-
/bin/lsls -latrh /proc/11481⤵
- Reads runtime system information
PID:1850
-
/bin/lsls -latrh /proc/11491⤵
- Reads runtime system information
PID:1855
-
/bin/grepgrep exe1⤵PID:1856
-
/bin/lsls -latrh /proc/1151⤵
- Reads runtime system information
PID:1860
-
/bin/grepgrep exe1⤵PID:1861
-
/bin/lsls -latrh /proc/11521⤵
- Reads runtime system information
PID:1865
-
/bin/grepgrep exe1⤵PID:1866
-
/bin/lsls -latrh /proc/11541⤵
- Reads runtime system information
PID:1870
-
/bin/grepgrep exe1⤵PID:1871
-
/bin/lsls -latrh /proc/11561⤵
- Reads runtime system information
PID:1875
-
/bin/grepgrep exe1⤵PID:1876
-
/bin/lsls -latrh /proc/11621⤵PID:1880
-
/bin/grepgrep exe1⤵PID:1881
-
/bin/grepgrep exe1⤵PID:1886
-
/bin/lsls -latrh /proc/11671⤵
- Reads runtime system information
PID:1885
-
/bin/lsls -latrh /proc/11681⤵
- Reads runtime system information
PID:1890
-
/bin/grepgrep exe1⤵PID:1891
-
/bin/lsls -latrh /proc/11691⤵
- Reads runtime system information
PID:1895
-
/bin/grepgrep exe1⤵PID:1896
-
/bin/lsls -latrh /proc/11731⤵
- Reads runtime system information
PID:1900
-
/bin/grepgrep exe1⤵PID:1901
-
/bin/grepgrep exe1⤵PID:1906
-
/bin/lsls -latrh /proc/11811⤵
- Reads runtime system information
PID:1905
-
/bin/lsls -latrh /proc/11841⤵
- Reads runtime system information
PID:1910
-
/bin/grepgrep exe1⤵PID:1911
-
/bin/lsls -latrh /proc/11861⤵
- Reads runtime system information
PID:1915
-
/bin/grepgrep exe1⤵PID:1916
-
/bin/lsls -latrh /proc/11871⤵
- Reads runtime system information
PID:1920
-
/bin/grepgrep exe1⤵PID:1921
-
/bin/lsls -latrh /proc/11881⤵
- Reads runtime system information
PID:1925
-
/bin/grepgrep exe1⤵PID:1926
-
/bin/lsls -latrh /proc/11891⤵
- Reads runtime system information
PID:1930
-
/bin/grepgrep exe1⤵PID:1931
-
/bin/grepgrep exe1⤵PID:1936
-
/bin/lsls -latrh /proc/11931⤵
- Reads runtime system information
PID:1935
-
/bin/lsls -latrh /proc/121⤵
- Reads runtime system information
PID:1940
-
/bin/grepgrep exe1⤵PID:1941
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5727479ef7cedf30c03459bec7d87b0f0
SHA12082e7f715f058acab2398d25d135cf5f4c0ce41
SHA25629872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6
SHA5124cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba