Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
45s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231221-en -
resource tags
arch:mipsimage:debian9-mipsbe-20231221-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
14/02/2024, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
al.txt
Resource
ubuntu1804-amd64-20231222-en
Behavioral task
behavioral2
Sample
al.txt
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral3
Sample
al.txt
Resource
debian9-mipsbe-20231221-en
Behavioral task
behavioral4
Sample
al.txt
Resource
debian9-mipsel-20231215-en
General
-
Target
al.txt
-
Size
3KB
-
MD5
a84cc0a810b8772bfd33e660dd1f05da
-
SHA1
155b9c06a1e3896f6336ea7a250078a015d269e5
-
SHA256
d30538787f9b9b9c2bdb9a438e49b39e655642bc1ce21dac8a7b58f71d0f3f45
-
SHA512
ecf516c1147ea307c2254c4b622bfc24984f011be42fe1a4c3356ae2bde51192af13f77f7238a2ba93233f4516a34478a893fdc035f901426540ba00ecb21421
Malware Config
Signatures
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.TZ2Iwu crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 pastebin.com 2 pastebin.com -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online top File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/18/status pkill File opened for reading /proc/10/status ps File opened for reading /proc/345/cmdline ps File opened for reading /proc/23/stat ps File opened for reading /proc/707/cmdline pkill File opened for reading /proc/769/status pkill File opened for reading /proc/5/cmdline pkill File opened for reading /proc/727/status pkill File opened for reading /proc/15/cmdline pkill File opened for reading /proc/707/cmdline pgrep File opened for reading /proc/338/status pkill File opened for reading /proc/339/cmdline pkill File opened for reading /proc/11/cmdline pkill File opened for reading /proc/71/status pkill File opened for reading /proc/126/cmdline ps File opened for reading /proc/2/cmdline pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/7/status ps File opened for reading /proc/710/status pkill File opened for reading /proc/159/cmdline pkill File opened for reading /proc/37/status pkill File opened for reading /proc/806/status pkill File opened for reading /proc/24/cmdline pkill File opened for reading /proc/386/cmdline pkill File opened for reading /proc/675/status pkill File opened for reading /proc/156/cmdline ps File opened for reading /proc/710/stat ps File opened for reading /proc/74/cmdline ps File opened for reading /proc/81/cmdline pkill File opened for reading /proc/669/cmdline pkill File opened for reading /proc/5/cmdline pkill File opened for reading /proc/22/cmdline pkill File opened for reading /proc/345/status pkill File opened for reading /proc/13/cmdline pkill File opened for reading /proc/7/cmdline ps File opened for reading /proc/339/cmdline ps File opened for reading /proc/736/status pkill File opened for reading /proc/711/status pkill File opened for reading /proc/4/status pkill File opened for reading /proc/711/cmdline pkill File opened for reading /proc/174/cmdline ps File opened for reading /proc/857/stat ps File opened for reading /proc/21/cmdline pkill File opened for reading /proc/437/status pkill File opened for reading /proc/12/cmdline pkill File opened for reading /proc/16/cmdline pkill File opened for reading /proc/23/cmdline pkill File opened for reading /proc/174/status pkill File opened for reading /proc/10/status pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/382/status pkill File opened for reading /proc/72/status pkill File opened for reading /proc/238/statm top File opened for reading /proc/21/status pkill File opened for reading /proc/705/status pkill File opened for reading /proc/252/cmdline pkill File opened for reading /proc/383/status pkill File opened for reading /proc/252/status pkill File opened for reading /proc/718/status pkill File opened for reading /proc/437/cmdline pgrep File opened for reading /proc/437/cmdline pkill File opened for reading /proc/7 ls File opened for reading /proc/81/cmdline pkill File opened for reading /proc/705/cmdline pkill -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/~/.bash_profile al.txt File opened for modification /tmp/~/.bash_history al.txt File opened for modification /tmp/~/.bashrc al.txt
Processes
-
/tmp/al.txt/tmp/al.txt1⤵
- Writes file to tmp directory
PID:718 -
/bin/rmrm -f "/dev/shm/*"2⤵PID:720
-
-
/bin/rmrm -f /dev/shm/. /dev/shm/..2⤵PID:722
-
-
/usr/bin/pkillpkill -f telnetd2⤵
- Reads CPU attributes
PID:724
-
-
/usr/bin/pkillpkill -f network-managerr2⤵PID:731
-
-
/usr/bin/pkillpkill -f ipv6_addrconfd2⤵
- Reads CPU attributes
- Reads runtime system information
PID:735
-
-
/usr/bin/pkillpkill -f bdus-daemon2⤵
- Reads CPU attributes
- Reads runtime system information
PID:737
-
-
/usr/bin/pkillpkill JavaUpdate2⤵
- Reads CPU attributes
PID:739
-
-
/usr/bin/pkillpkill SSHD22⤵
- Reads CPU attributes
PID:741
-
-
/usr/bin/pkillpkill LSHT2⤵
- Reads CPU attributes
PID:743
-
-
/usr/bin/xargsxargs kill -92⤵PID:746
-
/usr/local/sbin/killkill -93⤵PID:748
-
-
/usr/local/bin/killkill -93⤵PID:748
-
-
/usr/sbin/killkill -93⤵PID:748
-
-
/usr/bin/killkill -93⤵PID:748
-
-
/sbin/killkill -93⤵PID:748
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:748
-
-
-
/usr/bin/pgreppgrep LSHT2⤵
- Reads CPU attributes
PID:745
-
-
/bin/chmodchmod +w /var/tmp/.bin2⤵PID:750
-
-
/bin/rmrm -rf /var/tmp/.bin2⤵PID:752
-
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:753
-
-
/usr/bin/touchtouch /var/tmp/.bin2⤵PID:754
-
-
/usr/bin/pkillpkill mysqlserver2⤵
- Reads CPU attributes
- Reads runtime system information
PID:755
-
-
/usr/bin/pkillpkill gitlab-redis2⤵
- Reads CPU attributes
PID:756
-
-
/bin/rmrm -rf /var/tmp/. /var/tmp/.. /var/tmp/.bin2⤵PID:757
-
-
/usr/bin/pkillpkill -9 -f donate2⤵
- Reads CPU attributes
- Reads runtime system information
PID:758
-
-
/usr/bin/pkillpkill -f /tmp/.solr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:759
-
-
/usr/bin/pkillpkill -9 -f crond642⤵
- Reads CPU attributes
- Reads runtime system information
PID:760
-
-
/usr/bin/pkillpkill -9 -f stratum2⤵
- Reads runtime system information
PID:761
-
-
/usr/bin/pkillpkill -9 -f /tmp/java2⤵
- Reads CPU attributes
- Reads runtime system information
PID:762
-
-
/usr/bin/pkillpkill -9 -f KIXER2⤵
- Reads CPU attributes
- Reads runtime system information
PID:763
-
-
/usr/bin/pkillpkill -9 -f /tmp/system2⤵
- Reads CPU attributes
- Reads runtime system information
PID:764
-
-
/usr/bin/pkillpkill -9 -f telnetd2⤵
- Reads CPU attributes
- Reads runtime system information
PID:765
-
-
/usr/bin/pkillpkill -9 -f agettyd2⤵
- Reads CPU attributes
- Reads runtime system information
PID:766
-
-
/usr/bin/pkillpkill -9 -f /var/tmp2⤵
- Reads CPU attributes
- Reads runtime system information
PID:767
-
-
/usr/bin/pkillpkill -9 -f "\\./python"2⤵
- Reads CPU attributes
PID:768
-
-
/usr/bin/pkillpkill -9 -f "\\./crun"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:769
-
-
/usr/bin/pkillpkill -9 -f "\\./\\."2⤵
- Reads CPU attributes
- Reads runtime system information
PID:770
-
-
/usr/bin/pkillpkill -9 -f "118/cf\\.sh"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:771
-
-
/usr/bin/pkillpkill -9 "\\.6379"2⤵
- Reads CPU attributes
PID:772
-
-
/usr/bin/pkillpkill -9 "load\\.sh"2⤵
- Reads CPU attributes
PID:773
-
-
/usr/bin/pkillpkill -9 "init\\.sh"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:774
-
-
/usr/bin/pkillpkill -9 "solr\\.sh"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:775
-
-
/usr/bin/pkillpkill -9 "\\.rsyslogds"2⤵
- Reads runtime system information
PID:776
-
-
/usr/bin/pkillpkill -9 pnscan2⤵
- Reads CPU attributes
- Reads runtime system information
PID:777
-
-
/usr/bin/pkillpkill -9 masscan2⤵
- Reads CPU attributes
- Reads runtime system information
PID:778
-
-
/usr/bin/pkillpkill -9 kthreaddi2⤵
- Reads CPU attributes
- Reads runtime system information
PID:779
-
-
/usr/bin/pkillpkill -9 sysguard2⤵
- Reads CPU attributes
- Reads runtime system information
PID:780
-
-
/usr/bin/pkillpkill -9 kthreaddk2⤵
- Reads CPU attributes
- Reads runtime system information
PID:781
-
-
/usr/bin/pkillpkill -9 kdevtmpfsi2⤵
- Reads CPU attributes
- Reads runtime system information
PID:782
-
-
/usr/bin/pkillpkill -9 networkservice2⤵
- Reads CPU attributes
PID:783
-
-
/usr/bin/pkillpkill -9 sysupdate2⤵
- Reads CPU attributes
- Reads runtime system information
PID:784
-
-
/bin/grepgrep unifiw2⤵PID:787
-
-
/bin/grepgrep -v grep2⤵PID:786
-
-
/usr/bin/toptop -b -n 12⤵
- Reads CPU attributes
- Reads runtime system information
PID:785
-
-
/usr/bin/awkawk "{if(\$9<=50.0) print \$1}"2⤵PID:788
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:789
-
-
/usr/bin/pkillpkill -9 phpguard2⤵
- Reads CPU attributes
PID:790
-
-
/usr/bin/pkillpkill -9 phpupdate2⤵
- Reads runtime system information
PID:791
-
-
/usr/bin/pkillpkill -9 networkmanager2⤵
- Reads CPU attributes
PID:792
-
-
/usr/bin/pkillpkill -9 knthread2⤵
- Reads CPU attributes
- Reads runtime system information
PID:793
-
-
/usr/bin/pkillpkill -9 mysqlserver2⤵
- Reads CPU attributes
PID:796
-
-
/usr/bin/pkillpkill -9 watchbog2⤵
- Reads CPU attributes
PID:797
-
-
/usr/bin/pkillpkill -9 xmrig2⤵
- Reads CPU attributes
- Reads runtime system information
PID:799
-
-
/usr/bin/pkillpkill -f /tmp/.x1112⤵
- Reads CPU attributes
- Reads runtime system information
PID:801
-
-
/usr/bin/killallkillall "/tmp/.x111/*"2⤵PID:803
-
-
/usr/bin/pkillpkill -9 -f /dev/shm2⤵
- Reads CPU attributes
PID:805
-
-
/usr/bin/pkillpkill -9 bashirc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:806
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:810
-
-
/usr/bin/pgreppgrep pbotbyjanhotzu2⤵
- Reads CPU attributes
- Reads runtime system information
PID:809
-
-
/usr/bin/xargsxargs kill -92⤵PID:815
-
/usr/local/sbin/killkill -93⤵PID:817
-
-
/usr/local/bin/killkill -93⤵PID:817
-
-
/usr/sbin/killkill -93⤵PID:817
-
-
/usr/bin/killkill -93⤵PID:817
-
-
/sbin/killkill -93⤵PID:817
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:817
-
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:814
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:813
-
-
/bin/grepgrep :135312⤵PID:812
-
-
/usr/bin/xargsxargs kill -92⤵PID:827
-
/usr/local/sbin/killkill -93⤵PID:828
-
-
/usr/local/bin/killkill -93⤵PID:828
-
-
/usr/sbin/killkill -93⤵PID:828
-
-
/usr/bin/killkill -93⤵PID:828
-
-
/sbin/killkill -93⤵PID:828
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:828
-
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:826
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:825
-
-
/bin/grepgrep :55552⤵PID:824
-
-
/usr/bin/xargsxargs kill -92⤵PID:837
-
/usr/local/sbin/killkill -93⤵PID:839
-
-
/usr/local/bin/killkill -93⤵PID:839
-
-
/usr/sbin/killkill -93⤵PID:839
-
-
/usr/bin/killkill -93⤵PID:839
-
-
/sbin/killkill -93⤵PID:839
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:839
-
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:836
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:835
-
-
/bin/grepgrep :333312⤵PID:834
-
-
/usr/bin/xargsxargs kill -92⤵PID:849
-
/usr/local/sbin/killkill -93⤵PID:850
-
-
/usr/local/bin/killkill -93⤵PID:850
-
-
/usr/sbin/killkill -93⤵PID:850
-
-
/usr/bin/killkill -93⤵PID:850
-
-
/sbin/killkill -93⤵PID:850
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:850
-
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:848
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:847
-
-
/bin/grepgrep :333322⤵PID:846
-
-
/usr/bin/xargsxargs kill -92⤵PID:863
-
/usr/local/sbin/killkill -93⤵PID:864
-
-
/usr/local/bin/killkill -93⤵PID:864
-
-
/usr/sbin/killkill -93⤵PID:864
-
-
/usr/bin/killkill -93⤵PID:864
-
-
/sbin/killkill -93⤵PID:864
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:864
-
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:862
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:861
-
-
/bin/grepgrep :177772⤵PID:860
-
-
/usr/bin/xargsxargs kill -92⤵PID:878
-
/usr/local/sbin/killkill -93⤵PID:880
-
-
/usr/local/bin/killkill -93⤵PID:880
-
-
/usr/sbin/killkill -93⤵PID:880
-
-
/usr/bin/killkill -93⤵PID:880
-
-
/sbin/killkill -93⤵PID:880
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:880
-
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:877
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:876
-
-
/bin/grepgrep :33332⤵PID:875
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:888
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:887
-
-
/bin/grepgrep /tmp/.x1112⤵PID:886
-
-
/bin/grepgrep -v grep2⤵PID:885
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:884
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:892
-
-
/bin/grepgrep kinsing2⤵PID:891
-
-
/bin/grepgrep -v grep2⤵PID:890
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:893
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:889
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:898
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:897
-
-
/bin/grepgrep kremasys2⤵PID:896
-
-
/bin/grepgrep -v grep2⤵PID:895
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:894
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:903
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:902
-
-
/bin/grepgrep "while read procid"2⤵PID:901
-
-
/bin/grepgrep -v grep2⤵PID:900
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:899
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:908
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:907
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:906
-
-
/bin/grepgrep -v grep2⤵PID:905
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:904
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:913
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:912
-
-
/bin/grepgrep KGN1cmwg2⤵PID:911
-
-
/bin/grepgrep -v grep2⤵PID:910
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:909
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:918
-
/usr/local/sbin/killkill -9 7043⤵PID:919
-
-
/usr/local/bin/killkill -9 7043⤵PID:919
-
-
/usr/sbin/killkill -9 7043⤵PID:919
-
-
/usr/bin/killkill -9 7043⤵PID:919
-
-
/sbin/killkill -9 7043⤵PID:919
-
-
/bin/killkill -9 7043⤵
- Reads CPU attributes
PID:919
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:917
-
-
/bin/grepgrep .dat2⤵PID:916
-
-
/bin/grepgrep -v grep2⤵PID:915
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:914
-
-
/bin/rmrm /tmp/.dat2⤵PID:923
-
-
/usr/bin/pkillpkill kinsing2⤵
- Reads CPU attributes
- Reads runtime system information
PID:924
-
-
/usr/bin/pkillpkill -9 zgrab2⤵
- Reads CPU attributes
- Reads runtime system information
PID:925
-
-
/bin/grepgrep -q https://pastebin.com/raw/rVXcPD8Z2⤵PID:927
-
-
/usr/bin/crontabcrontab -l2⤵PID:926
-
-
/usr/bin/crontabcrontab -r2⤵PID:928
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:930
-
-
/bin/grepgrep unifiw2⤵PID:940
-
-
/bin/lsls -al /proc/12⤵PID:939
-
-
/bin/grepgrep -a donate-level /proc/1/exe2⤵PID:941
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:944
-
-
/bin/grepgrep exe2⤵PID:943
-
-
/bin/lsls -al /proc/12⤵PID:942
-
-
/bin/grepgrep unifiw2⤵PID:946
-
-
/bin/lsls -al /proc/102⤵PID:945
-
-
/bin/grepgrep -a donate-level /proc/10/exe2⤵PID:947
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:950
-
-
/bin/grepgrep exe2⤵PID:949
-
-
/bin/lsls -al /proc/102⤵PID:948
-
-
/bin/grepgrep unifiw2⤵PID:952
-
-
/bin/lsls -al /proc/1092⤵PID:951
-
-
/bin/grepgrep -a donate-level /proc/109/exe2⤵PID:953
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:956
-
-
/bin/grepgrep exe2⤵PID:955
-
-
/bin/lsls -al /proc/1092⤵PID:954
-
-
/bin/grepgrep unifiw2⤵PID:958
-
-
/bin/lsls -al /proc/112⤵PID:957
-
-
/bin/grepgrep -a donate-level /proc/11/exe2⤵PID:959
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:962
-
-
/bin/grepgrep exe2⤵PID:961
-
-
/bin/lsls -al /proc/112⤵PID:960
-
-
/bin/grepgrep unifiw2⤵PID:964
-
-
/bin/lsls -al /proc/122⤵PID:963
-
-
/bin/grepgrep -a donate-level /proc/12/exe2⤵PID:965
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:968
-
-
/bin/grepgrep exe2⤵PID:967
-
-
/bin/lsls -al /proc/122⤵PID:966
-
-
/bin/grepgrep unifiw2⤵PID:970
-
-
/bin/lsls -al /proc/1252⤵PID:969
-
-
/bin/grepgrep -a donate-level /proc/125/exe2⤵PID:971
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:974
-
-
/bin/grepgrep exe2⤵PID:973
-
-
/bin/lsls -al /proc/1252⤵PID:972
-
-
/bin/grepgrep unifiw2⤵PID:976
-
-
/bin/lsls -al /proc/1262⤵PID:975
-
-
/bin/grepgrep -a donate-level /proc/126/exe2⤵PID:979
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:982
-
-
/bin/grepgrep exe2⤵PID:981
-
-
/bin/lsls -al /proc/1262⤵PID:980
-
-
/bin/grepgrep unifiw2⤵PID:986
-
-
/bin/lsls -al /proc/132⤵PID:985
-
-
/bin/grepgrep -a donate-level /proc/13/exe2⤵PID:988
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:992
-
-
/bin/grepgrep exe2⤵PID:991
-
-
/bin/lsls -al /proc/132⤵PID:990
-
-
/bin/grepgrep unifiw2⤵PID:994
-
-
/bin/lsls -al /proc/142⤵PID:993
-
-
/bin/grepgrep -a donate-level /proc/14/exe2⤵PID:997
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1000
-
-
/bin/grepgrep exe2⤵PID:999
-
-
/bin/lsls -al /proc/142⤵PID:998
-
-
/bin/grepgrep unifiw2⤵PID:1004
-
-
/bin/lsls -al /proc/152⤵PID:1003
-
-
/bin/grepgrep -a donate-level /proc/15/exe2⤵PID:1006
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1009
-
-
/bin/grepgrep exe2⤵PID:1008
-
-
/bin/lsls -al /proc/152⤵PID:1007
-
-
/bin/grepgrep unifiw2⤵PID:1012
-
-
/bin/lsls -al /proc/1562⤵PID:1011
-
-
/bin/grepgrep -a donate-level /proc/156/exe2⤵PID:1015
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1018
-
-
/bin/grepgrep exe2⤵PID:1017
-
-
/bin/lsls -al /proc/1562⤵PID:1016
-
-
/bin/grepgrep unifiw2⤵PID:1021
-
-
/bin/lsls -al /proc/1592⤵PID:1020
-
-
/bin/grepgrep -a donate-level /proc/159/exe2⤵PID:1023
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1026
-
-
/bin/grepgrep exe2⤵PID:1025
-
-
/bin/lsls -al /proc/1592⤵PID:1024
-
-
/bin/grepgrep unifiw2⤵PID:1030
-
-
/bin/lsls -al /proc/162⤵PID:1029
-
-
/bin/grepgrep -a donate-level /proc/16/exe2⤵PID:1031
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1035
-
-
/bin/grepgrep exe2⤵PID:1034
-
-
/bin/lsls -al /proc/162⤵PID:1033
-
-
/bin/grepgrep unifiw2⤵PID:1038
-
-
/bin/lsls -al /proc/172⤵PID:1037
-
-
/bin/grepgrep -a donate-level /proc/17/exe2⤵PID:1041
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1044
-
-
/bin/grepgrep exe2⤵PID:1043
-
-
/bin/lsls -al /proc/172⤵PID:1042
-
-
/bin/grepgrep unifiw2⤵PID:1048
-
-
/bin/lsls -al /proc/1742⤵PID:1047
-
-
/bin/grepgrep -a donate-level /proc/174/exe2⤵PID:1049
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1053
-
-
/bin/grepgrep exe2⤵PID:1052
-
-
/bin/lsls -al /proc/1742⤵PID:1051
-
-
/bin/grepgrep unifiw2⤵PID:1056
-
-
/bin/lsls -al /proc/182⤵PID:1055
-
-
/bin/grepgrep -a donate-level /proc/18/exe2⤵PID:1058
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1062
-
-
/bin/grepgrep exe2⤵PID:1061
-
-
/bin/lsls -al /proc/182⤵PID:1060
-
-
/bin/grepgrep unifiw2⤵PID:1064
-
-
/bin/lsls -al /proc/192⤵PID:1063
-
-
/bin/grepgrep -a donate-level /proc/19/exe2⤵PID:1067
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1070
-
-
/bin/grepgrep exe2⤵PID:1069
-
-
/bin/lsls -al /proc/192⤵PID:1068
-
-
/bin/grepgrep unifiw2⤵PID:1072
-
-
/bin/lsls -al /proc/22⤵PID:1071
-
-
/bin/grepgrep -a donate-level /proc/2/exe2⤵PID:1073
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1076
-
-
/bin/grepgrep exe2⤵PID:1075
-
-
/bin/lsls -al /proc/22⤵PID:1074
-
-
/bin/grepgrep unifiw2⤵PID:1078
-
-
/bin/lsls -al /proc/202⤵PID:1077
-
-
/bin/grepgrep -a donate-level /proc/20/exe2⤵PID:1079
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1082
-
-
/bin/grepgrep exe2⤵PID:1081
-
-
/bin/lsls -al /proc/202⤵PID:1080
-
-
/bin/grepgrep unifiw2⤵PID:1084
-
-
/bin/lsls -al /proc/212⤵PID:1083
-
-
/bin/grepgrep -a donate-level /proc/21/exe2⤵PID:1085
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1088
-
-
/bin/grepgrep exe2⤵PID:1087
-
-
/bin/lsls -al /proc/212⤵PID:1086
-
-
/bin/grepgrep unifiw2⤵PID:1090
-
-
/bin/lsls -al /proc/222⤵PID:1089
-
-
/bin/grepgrep -a donate-level /proc/22/exe2⤵PID:1091
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1094
-
-
/bin/grepgrep exe2⤵PID:1093
-
-
/bin/lsls -al /proc/222⤵PID:1092
-
-
/bin/grepgrep unifiw2⤵PID:1096
-
-
/bin/lsls -al /proc/232⤵PID:1095
-
-
/bin/grepgrep -a donate-level /proc/23/exe2⤵PID:1097
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1100
-
-
/bin/grepgrep exe2⤵PID:1099
-
-
/bin/lsls -al /proc/232⤵PID:1098
-
-
/bin/grepgrep unifiw2⤵PID:1102
-
-
/bin/lsls -al /proc/2382⤵PID:1101
-
-
/bin/grepgrep -a donate-level /proc/238/exe2⤵PID:1103
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1106
-
-
/bin/grepgrep exe2⤵PID:1105
-
-
/bin/lsls -al /proc/2382⤵PID:1104
-
-
/bin/grepgrep unifiw2⤵PID:1108
-
-
/bin/lsls -al /proc/242⤵PID:1107
-
-
/bin/grepgrep -a donate-level /proc/24/exe2⤵PID:1109
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1112
-
-
/bin/grepgrep exe2⤵PID:1111
-
-
/bin/lsls -al /proc/242⤵PID:1110
-
-
/bin/grepgrep unifiw2⤵PID:1114
-
-
/bin/lsls -al /proc/2522⤵PID:1113
-
-
/bin/grepgrep -a donate-level /proc/252/exe2⤵PID:1115
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1118
-
-
/bin/grepgrep exe2⤵PID:1117
-
-
/bin/lsls -al /proc/2522⤵PID:1116
-
-
/bin/grepgrep unifiw2⤵PID:1120
-
-
/bin/lsls -al /proc/32⤵PID:1119
-
-
/bin/grepgrep -a donate-level /proc/3/exe2⤵PID:1121
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1124
-
-
/bin/grepgrep exe2⤵PID:1123
-
-
/bin/lsls -al /proc/32⤵PID:1122
-
-
/bin/grepgrep unifiw2⤵PID:1126
-
-
/bin/lsls -al /proc/3382⤵PID:1125
-
-
/bin/grepgrep -a donate-level /proc/338/exe2⤵PID:1127
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1130
-
-
/bin/grepgrep exe2⤵PID:1129
-
-
/bin/lsls -al /proc/3382⤵PID:1128
-
-
/bin/grepgrep unifiw2⤵PID:1132
-
-
/bin/lsls -al /proc/3392⤵PID:1131
-
-
/bin/grepgrep -a donate-level /proc/339/exe2⤵PID:1133
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1136
-
-
/bin/grepgrep exe2⤵PID:1135
-
-
/bin/lsls -al /proc/3392⤵PID:1134
-
-
/bin/grepgrep unifiw2⤵PID:1138
-
-
/bin/lsls -al /proc/3402⤵PID:1137
-
-
/bin/grepgrep -a donate-level /proc/340/exe2⤵PID:1139
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1142
-
-
/bin/grepgrep exe2⤵PID:1141
-
-
/bin/lsls -al /proc/3402⤵PID:1140
-
-
/bin/grepgrep unifiw2⤵PID:1144
-
-
/bin/lsls -al /proc/3412⤵PID:1143
-
-
/bin/grepgrep -a donate-level /proc/341/exe2⤵PID:1145
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1148
-
-
/bin/grepgrep exe2⤵PID:1147
-
-
/bin/lsls -al /proc/3412⤵PID:1146
-
-
/bin/grepgrep unifiw2⤵PID:1150
-
-
/bin/lsls -al /proc/3452⤵PID:1149
-
-
/bin/grepgrep -a donate-level /proc/345/exe2⤵PID:1151
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1154
-
-
/bin/grepgrep exe2⤵PID:1153
-
-
/bin/lsls -al /proc/3452⤵PID:1152
-
-
/bin/grepgrep unifiw2⤵PID:1156
-
-
/bin/lsls -al /proc/362⤵PID:1155
-
-
/bin/grepgrep -a donate-level /proc/36/exe2⤵PID:1157
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1160
-
-
/bin/grepgrep exe2⤵PID:1159
-
-
/bin/lsls -al /proc/362⤵PID:1158
-
-
/bin/grepgrep unifiw2⤵PID:1162
-
-
/bin/lsls -al /proc/372⤵PID:1161
-
-
/bin/grepgrep -a donate-level /proc/37/exe2⤵PID:1163
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1166
-
-
/bin/grepgrep exe2⤵PID:1165
-
-
/bin/lsls -al /proc/372⤵PID:1164
-
-
/bin/grepgrep unifiw2⤵PID:1168
-
-
/bin/lsls -al /proc/3822⤵PID:1167
-
-
/bin/grepgrep -a donate-level /proc/382/exe2⤵PID:1169
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1172
-
-
/bin/grepgrep exe2⤵PID:1171
-
-
/bin/lsls -al /proc/3822⤵PID:1170
-
-
/bin/grepgrep unifiw2⤵PID:1174
-
-
/bin/lsls -al /proc/3832⤵PID:1173
-
-
/bin/grepgrep -a donate-level /proc/383/exe2⤵PID:1175
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1178
-
-
/bin/grepgrep exe2⤵PID:1177
-
-
/bin/lsls -al /proc/3832⤵PID:1176
-
-
/bin/grepgrep unifiw2⤵PID:1180
-
-
/bin/lsls -al /proc/3862⤵PID:1179
-
-
/bin/grepgrep -a donate-level /proc/386/exe2⤵PID:1181
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1184
-
-
/bin/grepgrep exe2⤵PID:1183
-
-
/bin/lsls -al /proc/3862⤵PID:1182
-
-
/bin/grepgrep unifiw2⤵PID:1186
-
-
/bin/lsls -al /proc/42⤵PID:1185
-
-
/bin/grepgrep -a donate-level /proc/4/exe2⤵PID:1187
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1190
-
-
/bin/grepgrep exe2⤵PID:1189
-
-
/bin/lsls -al /proc/42⤵PID:1188
-
-
/bin/grepgrep unifiw2⤵PID:1192
-
-
/bin/lsls -al /proc/4372⤵PID:1191
-
-
/bin/grepgrep -a donate-level /proc/437/exe2⤵PID:1193
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1196
-
-
/bin/grepgrep exe2⤵PID:1195
-
-
/bin/lsls -al /proc/4372⤵PID:1194
-
-
/bin/grepgrep unifiw2⤵PID:1198
-
-
/bin/lsls -al /proc/52⤵PID:1197
-
-
/bin/grepgrep -a donate-level /proc/5/exe2⤵PID:1199
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1202
-
-
/bin/grepgrep exe2⤵PID:1201
-
-
/bin/lsls -al /proc/52⤵PID:1200
-
-
/bin/grepgrep unifiw2⤵PID:1204
-
-
/bin/lsls -al /proc/62⤵PID:1203
-
-
/bin/grepgrep -a donate-level /proc/6/exe2⤵PID:1205
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1208
-
-
/bin/grepgrep exe2⤵PID:1207
-
-
/bin/lsls -al /proc/62⤵PID:1206
-
-
/bin/grepgrep unifiw2⤵PID:1210
-
-
/bin/lsls -al /proc/6692⤵PID:1209
-
-
/bin/grepgrep -a donate-level /proc/669/exe2⤵PID:1211
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1214
-
-
/bin/grepgrep exe2⤵PID:1213
-
-
/bin/lsls -al /proc/6692⤵PID:1212
-
-
/bin/grepgrep unifiw2⤵PID:1216
-
-
/bin/lsls -al /proc/672⤵PID:1215
-
-
/bin/grepgrep -a donate-level /proc/67/exe2⤵PID:1217
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1220
-
-
/bin/grepgrep exe2⤵PID:1219
-
-
/bin/lsls -al /proc/672⤵PID:1218
-
-
/bin/grepgrep unifiw2⤵PID:1222
-
-
/bin/lsls -al /proc/6722⤵PID:1221
-
-
/bin/grepgrep -a donate-level /proc/672/exe2⤵PID:1223
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1226
-
-
/bin/grepgrep exe2⤵PID:1225
-
-
/bin/lsls -al /proc/6722⤵PID:1224
-
-
/bin/grepgrep unifiw2⤵PID:1228
-
-
/bin/lsls -al /proc/6752⤵PID:1227
-
-
/bin/grepgrep -a donate-level /proc/675/exe2⤵PID:1229
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1232
-
-
/bin/grepgrep exe2⤵PID:1231
-
-
/bin/lsls -al /proc/6752⤵PID:1230
-
-
/bin/grepgrep unifiw2⤵PID:1234
-
-
/bin/lsls -al /proc/6762⤵PID:1233
-
-
/bin/grepgrep -a donate-level /proc/676/exe2⤵PID:1235
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1238
-
-
/bin/grepgrep exe2⤵PID:1237
-
-
/bin/lsls -al /proc/6762⤵PID:1236
-
-
/bin/grepgrep unifiw2⤵PID:1240
-
-
/bin/lsls -al /proc/6912⤵PID:1239
-
-
/bin/grepgrep -a donate-level /proc/691/exe2⤵PID:1241
-
-
/bin/grepgrep exe2⤵PID:1243
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1244
-
-
/bin/lsls -al /proc/6912⤵PID:1242
-
-
/bin/grepgrep unifiw2⤵PID:1246
-
-
/bin/lsls -al /proc/72⤵
- Reads runtime system information
PID:1245
-
-
/bin/grepgrep -a donate-level /proc/7/exe2⤵PID:1247
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1250
-
-
/bin/grepgrep exe2⤵PID:1249
-
-
/bin/lsls -al /proc/72⤵PID:1248
-
-
/bin/grepgrep unifiw2⤵PID:1252
-
-
/bin/lsls -al /proc/7072⤵PID:1251
-
-
/bin/grepgrep -a donate-level /proc/707/exe2⤵PID:1253
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1256
-
-
/bin/grepgrep exe2⤵PID:1255
-
-
/bin/lsls -al /proc/7072⤵PID:1254
-
-
/bin/grepgrep unifiw2⤵PID:1258
-
-
/bin/lsls -al /proc/712⤵PID:1257
-
-
/bin/grepgrep -a donate-level /proc/71/exe2⤵PID:1259
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1262
-
-
/bin/grepgrep exe2⤵PID:1261
-
-
/bin/lsls -al /proc/712⤵PID:1260
-
-
/bin/grepgrep unifiw2⤵PID:1264
-
-
/bin/lsls -al /proc/7102⤵PID:1263
-
-
/bin/grepgrep -a donate-level /proc/710/exe2⤵PID:1265
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1268
-
-
/bin/grepgrep exe2⤵PID:1267
-
-
/bin/lsls -al /proc/7102⤵PID:1266
-
-
/bin/grepgrep unifiw2⤵PID:1270
-
-
/bin/lsls -al /proc/7112⤵PID:1269
-
-
/bin/grepgrep -a donate-level /proc/711/exe2⤵PID:1271
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1274
-
-
/bin/grepgrep exe2⤵PID:1273
-
-
/bin/lsls -al /proc/7112⤵PID:1272
-
-
/bin/grepgrep unifiw2⤵PID:1276
-
-
/bin/lsls -al /proc/7182⤵PID:1275
-
-
/bin/grepgrep -a donate-level /proc/718/exe2⤵PID:1277
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1280
-
-
/bin/grepgrep exe2⤵PID:1279
-
-
/bin/lsls -al /proc/7182⤵PID:1278
-
-
/bin/grepgrep unifiw2⤵PID:1282
-
-
/bin/lsls -al /proc/722⤵PID:1281
-
-
/bin/grepgrep -a donate-level /proc/72/exe2⤵PID:1283
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1286
-
-
/bin/grepgrep exe2⤵PID:1285
-
-
/bin/lsls -al /proc/722⤵PID:1284
-
-
/bin/grepgrep unifiw2⤵PID:1288
-
-
/bin/lsls -al /proc/7272⤵PID:1287
-
-
/bin/grepgrep -a donate-level /proc/727/exe2⤵PID:1289
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1292
-
-
/bin/grepgrep exe2⤵PID:1291
-
-
/bin/lsls -al /proc/7272⤵PID:1290
-
-
/bin/lsls -al /proc/732⤵PID:1295
-
-
/bin/grepgrep unifiw2⤵PID:1296
-
-
/bin/grepgrep -a donate-level /proc/73/exe2⤵PID:1300
-
-
/bin/grepgrep exe2⤵PID:1302
-
-
/bin/lsls -al /proc/732⤵PID:1301
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1303
-
-
/bin/grepgrep unifiw2⤵PID:1305
-
-
/bin/lsls -al /proc/742⤵PID:1304
-
-
/bin/grepgrep -a donate-level /proc/74/exe2⤵PID:1306
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1309
-
-
/bin/grepgrep exe2⤵PID:1308
-
-
/bin/lsls -al /proc/742⤵PID:1307
-
-
/bin/grepgrep unifiw2⤵PID:1311
-
-
/bin/lsls -al /proc/752⤵PID:1310
-
-
/bin/grepgrep -a donate-level /proc/75/exe2⤵PID:1313
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1316
-
-
/bin/grepgrep exe2⤵PID:1315
-
-
/bin/lsls -al /proc/752⤵PID:1314
-
-
/bin/grepgrep unifiw2⤵PID:1318
-
-
/bin/lsls -al /proc/762⤵PID:1317
-
-
/bin/grepgrep -a donate-level /proc/76/exe2⤵PID:1319
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1322
-
-
/bin/grepgrep exe2⤵PID:1321
-
-
/bin/lsls -al /proc/762⤵PID:1320
-
-
/bin/grepgrep unifiw2⤵PID:1325
-
-
/bin/lsls -al /proc/772⤵PID:1324
-
-
/bin/grepgrep -a donate-level /proc/77/exe2⤵PID:1326
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1329
-
-
/bin/grepgrep exe2⤵PID:1328
-
-
/bin/lsls -al /proc/772⤵PID:1327
-
-
/bin/grepgrep unifiw2⤵PID:1331
-
-
/bin/lsls -al /proc/792⤵PID:1330
-
-
/bin/grepgrep -a donate-level /proc/79/exe2⤵PID:1333
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1336
-
-
/bin/grepgrep exe2⤵PID:1335
-
-
/bin/lsls -al /proc/792⤵PID:1334
-
-
/bin/grepgrep unifiw2⤵PID:1338
-
-
/bin/lsls -al /proc/82⤵PID:1337
-
-
/bin/grepgrep -a donate-level /proc/8/exe2⤵PID:1339
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1342
-
-
/bin/grepgrep exe2⤵PID:1341
-
-
/bin/lsls -al /proc/82⤵PID:1340
-
-
/bin/grepgrep unifiw2⤵PID:1344
-
-
/bin/lsls -al /proc/812⤵PID:1343
-
-
/bin/grepgrep -a donate-level /proc/81/exe2⤵PID:1345
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1348
-
-
/bin/grepgrep exe2⤵PID:1347
-
-
/bin/lsls -al /proc/812⤵PID:1346
-
-
/bin/grepgrep unifiw2⤵PID:1350
-
-
/bin/lsls -al /proc/832⤵PID:1349
-
-
/bin/grepgrep -a donate-level /proc/83/exe2⤵PID:1351
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1354
-
-
/bin/grepgrep exe2⤵PID:1353
-
-
/bin/lsls -al /proc/832⤵PID:1352
-
-
/bin/grepgrep unifiw2⤵PID:1356
-
-
/bin/lsls -al /proc/8572⤵PID:1355
-
-
/bin/grepgrep -a donate-level /proc/857/exe2⤵PID:1357
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1360
-
-
/bin/grepgrep exe2⤵PID:1359
-
-
/bin/lsls -al /proc/8572⤵PID:1358
-
-
/bin/grepgrep unifiw2⤵PID:1362
-
-
/bin/lsls -al /proc/8672⤵PID:1361
-
-
/bin/grepgrep -a donate-level /proc/867/exe2⤵PID:1363
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1366
-
-
/bin/grepgrep exe2⤵PID:1365
-
-
/bin/lsls -al /proc/8672⤵PID:1364
-
-
/bin/grepgrep unifiw2⤵PID:1368
-
-
/bin/lsls -al /proc/8812⤵PID:1367
-
-
/bin/grepgrep -a donate-level /proc/881/exe2⤵PID:1369
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1372
-
-
/bin/grepgrep exe2⤵PID:1371
-
-
/bin/lsls -al /proc/8812⤵PID:1370
-
-
/bin/grepgrep unifiw2⤵PID:1374
-
-
/bin/lsls -al /proc/92⤵PID:1373
-
-
/bin/grepgrep -a donate-level /proc/9/exe2⤵PID:1375
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1378
-
-
/bin/grepgrep exe2⤵PID:1377
-
-
/bin/lsls -al /proc/92⤵PID:1376
-
-
/bin/grepgrep unifiw2⤵PID:1380
-
-
/bin/lsls -al /proc/9362⤵PID:1379
-
-
/bin/grepgrep -a donate-level /proc/936/exe2⤵PID:1381
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1384
-
-
/bin/grepgrep exe2⤵PID:1383
-
-
/bin/lsls -al /proc/9362⤵PID:1382
-
-
/bin/grepgrep unifiw2⤵PID:1386
-
-
/bin/lsls -al /proc/9372⤵PID:1385
-
-
/bin/grepgrep -a donate-level /proc/937/exe2⤵PID:1387
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1390
-
-
/bin/grepgrep exe2⤵PID:1389
-
-
/bin/lsls -al /proc/9372⤵PID:1388
-
-
/bin/grepgrep unifiw2⤵PID:1392
-
-
/bin/lsls -al /proc/9382⤵PID:1391
-
-
/bin/grepgrep -a donate-level /proc/938/exe2⤵PID:1393
-
-
/bin/grepgrep "/var/tmp\\|/tmp\\|/dev/shm\\|/var/log/gitlab/gitlab-rails\\|/opt/backup/git_lab_backup"2⤵PID:1396
-
-
/bin/grepgrep exe2⤵PID:1395
-
-
/bin/lsls -al /proc/9382⤵PID:1394
-
-
/usr/bin/xargsxargs kill -92⤵PID:1400
-
/usr/local/sbin/killkill -93⤵PID:1401
-
-
/usr/local/bin/killkill -93⤵PID:1401
-
-
/usr/sbin/killkill -93⤵PID:1401
-
-
/usr/bin/killkill -93⤵PID:1401
-
-
/sbin/killkill -93⤵PID:1401
-
-
/bin/killkill -93⤵
- Reads CPU attributes
PID:1401
-
-
-
/usr/bin/awkawk "{if(\$3>=70.0) print \$2}"2⤵PID:1399
-
-
/bin/grepgrep -v grep2⤵PID:1398
-
-
/bin/psps auxf2⤵PID:1397
-
-
/usr/bin/pkillpkill -f /tmp/.solr2⤵
- Reads CPU attributes
PID:1402
-
-
/bin/mkdirmkdir /tmp/.ICEd-unix2⤵PID:1403
-
-
/bin/chmodchmod +xwr /tmp/.ICEd-unix2⤵PID:1408
-
-
/bin/chmodchmod +xwr "/tmp/.ICEd-unix/*"2⤵PID:1409
-
-
/bin/chmodchmod +x /tmp/.ICEd-unix/unifiw2⤵PID:1410
-
-
/bin/chmodchmod -w /tmp/.ICEd-unix2⤵PID:1413
-
-
/usr/bin/nohupnohup bash "��Dg�6"2⤵PID:1412
-
-
/usr/bin/nohupnohup /tmp/.ICEd-unix/unifiw2⤵PID:1411
-
-
/usr/local/sbin/bashbash "��Dg�6"2⤵PID:1412
-
-
/usr/local/bin/bashbash "��Dg�6"2⤵PID:1412
-
-
/usr/sbin/bashbash "��Dg�6"2⤵PID:1412
-
-
/usr/bin/bashbash "��Dg�6"2⤵PID:1412
-
-
/sbin/bashbash "��Dg�6"2⤵PID:1412
-
-
/bin/bashbash "��Dg�6"2⤵PID:1412
-
-
/tmp/.ICEd-unix/unifiw/tmp/.ICEd-unix/unifiw2⤵PID:1411
-
-
/bin/sleepsleep 52⤵PID:1414
-
-
/bin/rmrm -f "/tmp/��Dg�6"2⤵PID:1415
-
-
/bin/grepgrep -v grep1⤵PID:933
-
/bin/psps auxf1⤵
- Reads runtime system information
PID:932
-
/bin/grepgrep unifiw1⤵PID:934
-
/usr/bin/awkawk "{if(\$3>=50.0) print \$2}"1⤵PID:935
-
/bin/lsls /proc1⤵PID:937
-
/bin/grepgrep "[0-9]"1⤵PID:938
-
/usr/bin/trtr -cd "[:alnum:]"1⤵PID:1406
-
/usr/bin/cutcut -c -61⤵PID:1407
-
/usr/bin/headhead -3 /dev/urandom1⤵PID:1405
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388B
MD59d6d02523b64149c9d15e2c55c1cbe18
SHA1895cd621485c7898dbcd312eb3cf7d2ef328a506
SHA25680b5681a749fb49e1d3be5eaeca3cc4be3744c7bf174b254c2f1bf8706f2018f
SHA512add084eef31b9da9c167c53463ec2dad8c91955c7e92a394f7b2627a2d2183a07310327fdc7f94afb477112a6da1f0b8967f765134a8f765911ed0721b852f62