b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
156s
max time network
170s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
01-03-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Size

8.6MB
MD5

ae747bc7fff9bc23f06635ef60ea0e8d
SHA1

64315e834f67905ed4e47f36155362a78ac23462
SHA256

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
SHA512

e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2
SSDEEP

98304:rDSceJ/GqDu6P0ypQ0Qv5knSTH20ejwBcHjI7Xk:rDSceJ/GqD18RZv5knS720e7s

Score

8^/10

antivm infostealer persistence

Malware Config

Signatures

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

Processes:

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

description	ioc	process
File opened for modification	/root/.ssh/authorized_keys	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
File opened for modification	/root/.ssh/authorized_keys

Deletes itself 1 IoCs

Processes:

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

pid process

1476 103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Reads EFI boot settings 1 IoCs
Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
infostealer

Processes:

journalctl

description ioc process

File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 journalctl
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

pid	process
1476	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

description	ioc	process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Deletes log files 1 TTPs 2 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

description	ioc	process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

pspspkillpspspspkillpkillpspkillpspkillpspspkillpkillpspspsfreepspkillfreepspspkillpspspkillpspspspkillpkillpspspkillpspspkillpspspspkill

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery
T1082

Processes:

journalctl

description ioc process

File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 journalctl

description	ioc	process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpkillkillallpssudokillallkillallkillallkillallpspspspskillallpspspkillkillallkillallpidofpspkillpkillkillallpkillpspspspkillpkillpkillpspskillallpkillkillallkillallpspskillall

description	ioc	process
File opened for reading	/proc/93/status	pkill
File opened for reading	/proc/456/status
File opened for reading	/proc/453/stat
File opened for reading	/proc/533/status	pkill
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/975/status
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/166/stat	killall
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/1133/stat	killall
File opened for reading	/proc/273/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/77/cmdline
File opened for reading	/proc/441/cmdline	ps
File opened for reading	/proc/634/status	ps
File opened for reading	/proc/935/stat	ps
File opened for reading	/proc/1457/status	ps
File opened for reading	/proc/763/stat
File opened for reading	/proc/491/stat	killall
File opened for reading	/proc/811/stat	killall
File opened for reading	/proc/564/stat
File opened for reading	/proc/852/stat
File opened for reading	/proc/453/status	ps
File opened for reading	/proc/2242/cmdline	ps
File opened for reading	/proc/932/status	pkill
File opened for reading	/proc/1117/stat
File opened for reading	/proc/1451/status
File opened for reading	/proc/946/status
File opened for reading	/proc/7/cmdline
File opened for reading	/proc/1204/stat	killall
File opened for reading	/proc/173/stat	killall
File opened for reading	/proc/1123/cmdline	pidof
File opened for reading	/proc/75/cmdline
File opened for reading	/proc/172/status
File opened for reading	/proc/82/stat
File opened for reading	/proc/636/cmdline	ps
File opened for reading	/proc/636/cmdline	ps
File opened for reading	/proc/454/status	pkill
File opened for reading	/proc/1123/status	pkill
File opened for reading	/proc/589/stat	killall
File opened for reading	/proc/535/cmdline	pkill
File opened for reading	/proc/501/cmdline
File opened for reading	/proc/975/cmdline
File opened for reading	/proc/566/status	ps
File opened for reading	/proc/2261/status	ps
File opened for reading	/proc/1091/status	ps
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/456/cmdline	pkill
File opened for reading	/proc/1305/status	pkill
File opened for reading	/proc/399/stat
File opened for reading	/proc/634/cmdline
File opened for reading	/proc/1099/cmdline	ps
File opened for reading	/proc/1457/status	ps
File opened for reading	/proc/566/stat	killall
File opened for reading	/proc/2692/cmdline	pkill
File opened for reading	/proc/170/stat	killall
File opened for reading	/proc/1142/stat	killall
File opened for reading	/proc/495/cmdline	ps
File opened for reading	/proc/self/stat
File opened for reading	/proc/3828/cmdline
File opened for reading	/proc/2719/status	pkill
File opened for reading	/proc/273/stat	ps
File opened for reading	/proc/6/stat	killall

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

Processes:

touchtouchtouchtouchtouchtouchtouchtouchtouchtouchtouch

description	ioc	process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_10592
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_14852
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_21139	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_1252	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_3864	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_16214	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_16840	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_28068	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_5245	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_774	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_14759	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_5796
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_2276
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_27942
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_26978	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_18183
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_16274	touch

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
PID:1476

/usr/bin/uname
uname -a
2⤵
PID:1490

/usr/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1491

/usr/bin/cat
cat /etc/issue
2⤵
PID:1493

/usr/bin/free
free -m
2⤵
PID:1494

/usr/bin/uptime
uptime
2⤵
PID:1495

/usr/bin/journalctl
journalctl -S "@0" -u sshd
2⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
PID:1511

/usr/bin/cat
cat "/var/log/auth*"
2⤵
PID:1535

/usr/bin/zcat
zcat "/var/log/auth*"
2⤵
PID:1538

/usr/local/sbin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1538

/usr/local/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1538

/usr/sbin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1538

/usr/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1538

/bin/bash
/bin/bash -
2⤵
PID:2301

/usr/bin/sudo
sudo -S touch .local_3864
3⤵
PID:2306

/usr/bin/touch
touch .local_3864
4⤵
- Writes file to tmp directory
PID:2307

/usr/bin/sudo
sudo rm .local_3864
3⤵
PID:2311

/usr/bin/rm
rm .local_3864
4⤵
PID:2312

/usr/bin/sudo
sudo killall -9 bssh
3⤵
PID:2319

/usr/bin/killall
killall -9 bssh
4⤵
PID:2320

/usr/bin/sudo
sudo rm -rf /tmp/.an
3⤵
PID:2321

/usr/bin/rm
rm -rf /tmp/.an
4⤵
PID:2322

/usr/bin/sudo
sudo killall -9 xm64
3⤵
PID:2323

/usr/bin/killall
killall -9 xm64
4⤵
PID:2324

/usr/bin/sudo
sudo killall -9 rpc.idmapd
3⤵
PID:2325

/usr/bin/killall
killall -9 rpc.idmapd
4⤵
PID:2326

/usr/bin/sudo
sudo rm -rf /tmp/.m2
3⤵
PID:2327

/usr/bin/rm
rm -rf /tmp/.m2
4⤵
PID:2328

/usr/bin/sudo
sudo killall -9 xorgg
3⤵
PID:2329

/usr/bin/killall
killall -9 xorgg
4⤵
PID:2330

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
3⤵
PID:2331

/usr/bin/rm
rm -rf /tmp/seconfig
4⤵
PID:2332

/usr/bin/sudo
sudo killall -9 crond64
3⤵
PID:2333

/usr/bin/killall
killall -9 crond64
4⤵
- Reads runtime system information
PID:2335

/usr/bin/sudo
sudo killall -9 tsm
3⤵
PID:2336

/usr/bin/killall
killall -9 tsm
4⤵
PID:2337

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
3⤵
PID:2338

/usr/bin/rm
rm -rf /tmp/.ssh
4⤵
PID:2339

/usr/bin/sudo
sudo rm -rf /tmp/.java
3⤵
PID:2340

/usr/bin/rm
rm -rf /tmp/.java
4⤵
PID:2341

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
3⤵
PID:2342

/usr/bin/rm
rm -rf /tmp/.iolanda
4⤵
PID:2343

/usr/bin/sudo
sudo pkill test.mod
3⤵
PID:2344

/usr/bin/pkill
pkill test.mod
4⤵
PID:2345

/usr/bin/sudo
sudo pkill daemon.i686.mod
3⤵
PID:2346

/usr/bin/pkill
pkill daemon.i686.mod
4⤵
PID:2347

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
3⤵
PID:2348

/usr/bin/pkill
pkill daemon.armv4l.mod
4⤵
- Reads CPU attributes
PID:2349

/usr/bin/sudo
sudo pkill daemon.mips.mod
3⤵
PID:2350

/usr/bin/pkill
pkill daemon.mips.mod
4⤵
PID:2351

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
3⤵
PID:2352

/usr/bin/pkill
pkill daemon.mipsel.mod
4⤵
PID:2353

/usr/bin/sudo
sudo rm -rf /tmp/.xs
3⤵
PID:2354

/usr/bin/rm
rm -rf /tmp/.xs
4⤵
PID:2355

/usr/bin/sudo
sudo pkill ld-linux-x86-64
3⤵
PID:2356

/usr/bin/pkill
pkill ld-linux-x86-64
4⤵
PID:2357

/usr/bin/rm
rm -rf "/var/tmp/. *"
3⤵
PID:2358

/usr/bin/sudo
sudo killall -9 "[atd]"
3⤵
PID:2397

/usr/bin/killall
killall -9 "[atd]"
4⤵
PID:2398

/usr/bin/sudo
sudo rm -rf /tmp/.jk
3⤵
PID:2399

/usr/bin/rm
rm -rf /tmp/.jk
4⤵
PID:2400

/usr/bin/sudo
sudo killall -9 "[ntpd]"
3⤵
PID:2401

/usr/bin/killall
killall -9 "[ntpd]"
4⤵
- Reads runtime system information
PID:2402

/usr/bin/sudo
sudo killall -9 "[rpciod]"
3⤵
PID:2403

/usr/bin/killall
killall -9 "[rpciod]"
4⤵
PID:2404

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
3⤵
PID:2405

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
4⤵
PID:2406

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
3⤵
PID:2407

/usr/bin/rm
rm -rf "/tmp/.xm*"
4⤵
PID:2408

/usr/bin/pidof
pidof libexec
3⤵
PID:2409

/usr/bin/free
free -m
2⤵
PID:2365

/usr/bin/uptime
uptime
2⤵
PID:2366

/bin/bash
/bin/bash -
2⤵
PID:2974

/usr/bin/sudo
sudo -S touch .local_28068
3⤵
PID:2979

/usr/bin/touch
touch .local_28068
4⤵
- Writes file to tmp directory
PID:2980

/usr/bin/sudo
sudo rm .local_28068
3⤵
PID:2984

/usr/bin/rm
rm .local_28068
4⤵
PID:2985

/usr/bin/sudo
sudo killall -9 bssh
3⤵
PID:2992

/usr/bin/killall
killall -9 bssh
4⤵
PID:2993

/usr/bin/sudo
sudo rm -rf /tmp/.an
3⤵
PID:2994

/usr/bin/rm
rm -rf /tmp/.an
4⤵
PID:2995

/usr/bin/sudo
sudo killall -9 xm64
3⤵
PID:2996

/usr/bin/killall
killall -9 xm64
4⤵
PID:2997

/usr/bin/sudo
sudo killall -9 rpc.idmapd
3⤵
PID:2998

/usr/bin/killall
killall -9 rpc.idmapd
4⤵
PID:2999

/usr/bin/sudo
sudo rm -rf /tmp/.m2
3⤵
PID:3000

/usr/bin/rm
rm -rf /tmp/.m2
4⤵
PID:3001

/usr/bin/sudo
sudo killall -9 xorgg
3⤵
PID:3002

/usr/bin/killall
killall -9 xorgg
4⤵
- Reads runtime system information
PID:3003

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
3⤵
PID:3004

/usr/bin/rm
rm -rf /tmp/seconfig
4⤵
PID:3005

/usr/bin/sudo
sudo killall -9 crond64
3⤵
PID:3006

/usr/bin/killall
killall -9 crond64
4⤵
- Reads runtime system information
PID:3007

/usr/bin/sudo
sudo killall -9 tsm
3⤵
PID:3008

/usr/bin/killall
killall -9 tsm
4⤵
PID:3009

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
3⤵
PID:3010

/usr/bin/rm
rm -rf /tmp/.ssh
4⤵
PID:3011

/usr/bin/sudo
sudo rm -rf /tmp/.java
3⤵
PID:3012

/usr/bin/rm
rm -rf /tmp/.java
4⤵
PID:3013

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
3⤵
PID:3014

/usr/bin/rm
rm -rf /tmp/.iolanda
4⤵
PID:3015

/usr/bin/sudo
sudo pkill test.mod
3⤵
PID:3016

/usr/bin/pkill
pkill test.mod
4⤵
PID:3017

/usr/bin/sudo
sudo pkill daemon.i686.mod
3⤵
PID:3018

/usr/bin/pkill
pkill daemon.i686.mod
4⤵
PID:3019

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
3⤵
PID:3020

/usr/bin/pkill
pkill daemon.armv4l.mod
4⤵
PID:3021

/usr/bin/sudo
sudo pkill daemon.mips.mod
3⤵
PID:3022

/usr/bin/pkill
pkill daemon.mips.mod
4⤵
PID:3023

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
3⤵
PID:3024

/usr/bin/pkill
pkill daemon.mipsel.mod
4⤵
- Reads CPU attributes
PID:3025

/usr/bin/sudo
sudo rm -rf /tmp/.xs
3⤵
PID:3026

/usr/bin/rm
rm -rf /tmp/.xs
4⤵
PID:3027

/usr/bin/sudo
sudo pkill ld-linux-x86-64
3⤵
PID:3028

/usr/bin/pkill
pkill ld-linux-x86-64
4⤵
- Reads CPU attributes
PID:3029

/usr/bin/rm
rm -rf "/var/tmp/. *"
3⤵
PID:3030

/usr/bin/sudo
sudo killall -9 "[atd]"
3⤵
PID:3067

/usr/bin/killall
killall -9 "[atd]"
4⤵
- Reads runtime system information
PID:3068

/usr/bin/sudo
sudo rm -rf /tmp/.jk
3⤵
PID:3069

/usr/bin/rm
rm -rf /tmp/.jk
4⤵
PID:3070

/usr/bin/sudo
sudo killall -9 "[ntpd]"
3⤵
PID:3071

/usr/bin/killall
killall -9 "[ntpd]"
4⤵
PID:3072

/usr/bin/sudo
sudo killall -9 "[rpciod]"
3⤵
PID:3073

/usr/bin/killall
killall -9 "[rpciod]"
4⤵
PID:3074

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
3⤵
PID:3075

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
4⤵
PID:3076

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
3⤵
PID:3077

/usr/bin/rm
rm -rf "/tmp/.xm*"
4⤵
PID:3078

/usr/bin/pidof
pidof libexec
3⤵
- Reads runtime system information
PID:3079

/bin/bash
/bin/bash -
2⤵
PID:3080

/usr/bin/sudo
sudo -S touch .local_5245
3⤵
PID:3085

/usr/bin/touch
touch .local_5245
4⤵
- Writes file to tmp directory
PID:3086

/usr/bin/sudo
sudo rm .local_5245
3⤵
PID:3090

/usr/bin/rm
rm .local_5245
4⤵
PID:3091

/usr/bin/sudo
sudo killall -9 bssh
3⤵
PID:3098

/usr/bin/killall
killall -9 bssh
4⤵
PID:3099

/usr/bin/sudo
sudo rm -rf /tmp/.an
3⤵
PID:3100

/usr/bin/rm
rm -rf /tmp/.an
4⤵
PID:3101

/usr/bin/sudo
sudo killall -9 xm64
3⤵
PID:3102

/usr/bin/killall
killall -9 xm64
4⤵
PID:3103

/usr/bin/sudo
sudo killall -9 rpc.idmapd
3⤵
PID:3104

/usr/bin/killall
killall -9 rpc.idmapd
4⤵
PID:3105

/usr/bin/sudo
sudo rm -rf /tmp/.m2
3⤵
PID:3106

/usr/bin/rm
rm -rf /tmp/.m2
4⤵
PID:3107

/usr/bin/sudo
sudo killall -9 xorgg
3⤵
PID:3108

/usr/bin/killall
killall -9 xorgg
4⤵
PID:3109

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
3⤵
PID:3110

/usr/bin/rm
rm -rf /tmp/seconfig
4⤵
PID:3111

/usr/bin/sudo
sudo killall -9 crond64
3⤵
PID:3112

/usr/bin/killall
killall -9 crond64
4⤵
PID:3113

/usr/bin/sudo
sudo killall -9 tsm
3⤵
PID:3114

/usr/bin/killall
killall -9 tsm
4⤵
PID:3115

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
3⤵
PID:3116

/usr/bin/rm
rm -rf /tmp/.ssh
4⤵
PID:3117

/usr/bin/sudo
sudo rm -rf /tmp/.java
3⤵
PID:3118

/usr/bin/rm
rm -rf /tmp/.java
4⤵
PID:3119

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
3⤵
PID:3120

/usr/bin/rm
rm -rf /tmp/.iolanda
4⤵
PID:3121

/usr/bin/sudo
sudo pkill test.mod
3⤵
PID:3122

/usr/bin/pkill
pkill test.mod
4⤵
- Reads CPU attributes
- Reads runtime system information
PID:3123

/usr/bin/sudo
sudo pkill daemon.i686.mod
3⤵
PID:3124

/usr/bin/pkill
pkill daemon.i686.mod
4⤵
- Reads runtime system information
PID:3125

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
3⤵
PID:3126

/usr/bin/pkill
pkill daemon.armv4l.mod
4⤵
PID:3127

/usr/bin/sudo
sudo pkill daemon.mips.mod
3⤵
PID:3128

/usr/bin/pkill
pkill daemon.mips.mod
4⤵
PID:3143

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
3⤵
PID:3144

/usr/bin/pkill
pkill daemon.mipsel.mod
4⤵
- Reads CPU attributes
- Reads runtime system information
PID:3145

/usr/bin/sudo
sudo rm -rf /tmp/.xs
3⤵
PID:3146

/usr/bin/rm
rm -rf /tmp/.xs
4⤵
PID:3147

/usr/bin/sudo
sudo pkill ld-linux-x86-64
3⤵
PID:3148

/usr/bin/pkill
pkill ld-linux-x86-64
4⤵
- Reads CPU attributes
PID:3149

/usr/bin/rm
rm -rf "/var/tmp/. *"
3⤵
PID:3150

/usr/bin/sudo
sudo killall -9 "[atd]"
3⤵
PID:3187

/usr/bin/killall
killall -9 "[atd]"
4⤵
PID:3188

/usr/bin/sudo
sudo rm -rf /tmp/.jk
3⤵
PID:3189

/usr/bin/rm
rm -rf /tmp/.jk
4⤵
PID:3190

/usr/bin/sudo
sudo killall -9 "[ntpd]"
3⤵
PID:3191

/usr/bin/killall
killall -9 "[ntpd]"
4⤵
PID:3192

/usr/bin/sudo
sudo killall -9 "[rpciod]"
3⤵
PID:3193

/usr/bin/killall
killall -9 "[rpciod]"
4⤵
PID:3194

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
3⤵
PID:3195

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
4⤵
PID:3196

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
3⤵
PID:3197

/usr/bin/rm
rm -rf "/tmp/.xm*"
4⤵
PID:3198

/usr/bin/pidof
pidof libexec
3⤵
PID:3200

/usr/bin/free
free -m
2⤵
PID:3199

/usr/bin/uptime
uptime
2⤵
PID:3201

/bin/bash
/bin/bash -
2⤵
PID:3202

/usr/bin/sudo
sudo -S touch .local_774
3⤵
PID:3207

/usr/bin/touch
touch .local_774
4⤵
- Writes file to tmp directory
PID:3208

/usr/bin/sudo
sudo rm .local_774
3⤵
PID:3212

/usr/bin/rm
rm .local_774
4⤵
PID:3213

/usr/bin/sudo
sudo killall -9 bssh
3⤵
PID:3220

/usr/bin/killall
killall -9 bssh
4⤵
- Reads runtime system information
PID:3221

/usr/bin/sudo
sudo rm -rf /tmp/.an
3⤵
PID:3222

/usr/bin/rm
rm -rf /tmp/.an
4⤵
PID:3223

/usr/bin/sudo
sudo killall -9 xm64
3⤵
PID:3224

/usr/bin/killall
killall -9 xm64
4⤵
PID:3225

/usr/bin/sudo
sudo killall -9 rpc.idmapd
3⤵
PID:3226

/usr/bin/killall
killall -9 rpc.idmapd
4⤵
PID:3227

/usr/bin/sudo
sudo rm -rf /tmp/.m2
3⤵
PID:3228

/usr/bin/rm
rm -rf /tmp/.m2
4⤵
PID:3229

/usr/bin/sudo
sudo killall -9 xorgg
3⤵
PID:3230

/usr/bin/killall
killall -9 xorgg
4⤵
PID:3231

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
3⤵
PID:3232

/usr/bin/rm
rm -rf /tmp/seconfig
4⤵
PID:3233

/usr/bin/sudo
sudo killall -9 crond64
3⤵
PID:3234

/usr/bin/killall
killall -9 crond64
4⤵
PID:3235

/usr/bin/sudo
sudo killall -9 tsm
3⤵
PID:3236

/usr/bin/killall
killall -9 tsm
4⤵
PID:3237

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
3⤵
PID:3238

/bin/bash
/bin/bash -
1⤵
PID:1527

/usr/bin/sudo
sudo -S touch .local_14759
2⤵
PID:1534

/usr/bin/touch
touch .local_14759
3⤵
- Writes file to tmp directory
PID:1548

/usr/bin/sudo
sudo rm .local_14759
2⤵
PID:1552

/usr/bin/rm
rm .local_14759
3⤵
PID:1554

/usr/bin/sudo
sudo killall -9 bssh
2⤵
PID:1591

/usr/bin/killall
killall -9 bssh
3⤵
PID:1610

/usr/bin/sudo
sudo rm -rf /tmp/.an
2⤵
PID:1626

/usr/bin/rm
rm -rf /tmp/.an
3⤵
PID:1631

/usr/bin/sudo
sudo killall -9 xm64
2⤵
PID:1635

/usr/bin/killall
killall -9 xm64
3⤵
PID:1640

/usr/bin/sudo
sudo killall -9 rpc.idmapd
2⤵
PID:1646

/usr/bin/killall
killall -9 rpc.idmapd
3⤵
PID:1652

/usr/bin/sudo
sudo rm -rf /tmp/.m2
2⤵
PID:1660

/usr/bin/rm
rm -rf /tmp/.m2
3⤵
PID:1686

/usr/bin/sudo
sudo killall -9 xorgg
2⤵
PID:1689

/usr/bin/killall
killall -9 xorgg
3⤵
PID:1697

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
2⤵
PID:1702

/usr/bin/rm
rm -rf /tmp/seconfig
3⤵
PID:1708

/usr/bin/sudo
sudo killall -9 crond64
2⤵
PID:1709

/usr/bin/killall
killall -9 crond64
3⤵
PID:1722

/usr/bin/sudo
sudo killall -9 tsm
2⤵
PID:1729

/usr/bin/killall
killall -9 tsm
3⤵
PID:1736

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
2⤵
PID:1743

/usr/bin/rm
rm -rf /tmp/.ssh
3⤵
PID:1748

/usr/bin/sudo
sudo rm -rf /tmp/.java
2⤵
PID:1750

/usr/bin/rm
rm -rf /tmp/.java
3⤵
PID:1763

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
2⤵
PID:1772

/usr/bin/rm
rm -rf /tmp/.iolanda
3⤵
PID:1790

/usr/bin/sudo
sudo pkill test.mod
2⤵
PID:1791

/usr/bin/pkill
pkill test.mod
3⤵
PID:1794

/usr/bin/sudo
sudo pkill daemon.i686.mod
2⤵
PID:1795

/usr/bin/pkill
pkill daemon.i686.mod
3⤵
PID:1796

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
2⤵
PID:1797

/usr/bin/pkill
pkill daemon.armv4l.mod
3⤵
- Reads CPU attributes
PID:1799

/usr/bin/sudo
sudo pkill daemon.mips.mod
2⤵
PID:1803

/usr/bin/pkill
pkill daemon.mips.mod
3⤵
PID:1805

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
2⤵
PID:1809

/usr/bin/pkill
pkill daemon.mipsel.mod
3⤵
PID:1810

/usr/bin/sudo
sudo rm -rf /tmp/.xs
2⤵
PID:1813

/usr/bin/rm
rm -rf /tmp/.xs
3⤵
PID:1816

/usr/bin/sudo
sudo pkill ld-linux-x86-64
2⤵
PID:1818

/usr/bin/pkill
pkill ld-linux-x86-64
3⤵
PID:1819

/usr/bin/rm
rm -rf "/var/tmp/. *"
2⤵
PID:1823

/usr/bin/sudo
sudo killall -9 "[atd]"
2⤵
PID:1903

/usr/bin/killall
killall -9 "[atd]"
3⤵
PID:1904

/usr/bin/sudo
sudo rm -rf /tmp/.jk
2⤵
PID:1905

/usr/bin/rm
rm -rf /tmp/.jk
3⤵
PID:1906

/usr/bin/sudo
sudo killall -9 "[ntpd]"
2⤵
PID:1907

/usr/bin/killall
killall -9 "[ntpd]"
3⤵
PID:1908

/usr/bin/sudo
sudo killall -9 "[rpciod]"
2⤵
PID:1909

/usr/bin/killall
killall -9 "[rpciod]"
3⤵
PID:1910

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
2⤵
PID:1911

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
3⤵
PID:1912

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
2⤵
PID:1913

/usr/bin/rm
rm -rf "/tmp/.xm*"
3⤵
PID:1914

/usr/bin/pidof
pidof libexec
2⤵
PID:1915

/usr/bin/wc
wc -l
1⤵
PID:1532

/usr/bin/which
which sudo
1⤵
PID:1531

/usr/bin/grep
grep -c root
1⤵
PID:1551

/usr/bin/ls
ls -l .local_14759
1⤵
PID:1550

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:1558

/usr/bin/sudo
sudo ps auxff
1⤵
PID:1557

/usr/bin/ps
ps auxff
2⤵
- Reads CPU attributes
PID:1565

/usr/bin/grep
grep -v grep
1⤵
PID:1559

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1560

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1825

/usr/bin/ps
ps auxf
2⤵
PID:1831

/usr/bin/grep
grep xmr
1⤵
PID:1826

/usr/bin/grep
grep -v grep
1⤵
PID:1827

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1828

/usr/bin/sudo
sudo ps auxf
1⤵
- Reads runtime system information
PID:1841

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:1847

/usr/bin/grep
grep cryptonight
1⤵
PID:1842

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1844

/usr/bin/grep
grep -v grep
1⤵
PID:1843

/usr/bin/grep
grep -v grep
1⤵
PID:1866

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1864

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:1877

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1867

/usr/bin/grep
grep stratum
1⤵
PID:1865

/usr/bin/grep
grep -v grep
1⤵
PID:1886

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:1885

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1887

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1884

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:1888

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1890

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:1896

/usr/bin/grep
grep -v grep
1⤵
PID:1892

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:1891

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1893

/usr/bin/free
free -m
1⤵
PID:1894

/usr/bin/uptime
uptime
1⤵
PID:1895

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1901

/usr/bin/grep
grep -v grep
1⤵
PID:1900

/usr/bin/grep
grep xm64
1⤵
PID:1899

/usr/bin/sudo
sudo ps auxf
1⤵
PID:1898

/usr/bin/ps
ps auxf
2⤵
PID:1902

/usr/bin/free
free -m
1⤵
PID:2026

/usr/bin/uptime
uptime
1⤵
PID:2027

/bin/bash
/bin/bash -
1⤵
PID:2028

/usr/bin/sudo
sudo -S touch .local_16274
2⤵
PID:2033

/usr/bin/touch
touch .local_16274
3⤵
- Writes file to tmp directory
PID:2034

/usr/bin/sudo
sudo rm .local_16274
2⤵
PID:2038

/usr/bin/rm
rm .local_16274
3⤵
PID:2039

/usr/bin/sudo
sudo killall -9 bssh
2⤵
PID:2046

/usr/bin/killall
killall -9 bssh
3⤵
PID:2047

/usr/bin/sudo
sudo rm -rf /tmp/.an
2⤵
PID:2048

/usr/bin/rm
rm -rf /tmp/.an
3⤵
PID:2049

/usr/bin/sudo
sudo killall -9 xm64
2⤵
PID:2050

/usr/bin/killall
killall -9 xm64
3⤵
PID:2051

/usr/bin/sudo
sudo killall -9 rpc.idmapd
2⤵
PID:2052

/usr/bin/killall
killall -9 rpc.idmapd
3⤵
- Reads runtime system information
PID:2053

/usr/bin/sudo
sudo rm -rf /tmp/.m2
2⤵
PID:2054

/usr/bin/rm
rm -rf /tmp/.m2
3⤵
PID:2055

/usr/bin/sudo
sudo killall -9 xorgg
2⤵
PID:2056

/usr/bin/killall
killall -9 xorgg
3⤵
PID:2057

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
2⤵
PID:2058

/usr/bin/rm
rm -rf /tmp/seconfig
3⤵
PID:2059

/usr/bin/sudo
sudo killall -9 crond64
2⤵
PID:2060

/usr/bin/killall
killall -9 crond64
3⤵
PID:2061

/usr/bin/sudo
sudo killall -9 tsm
2⤵
PID:2062

/usr/bin/killall
killall -9 tsm
3⤵
PID:2063

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
2⤵
PID:2064

/usr/bin/rm
rm -rf /tmp/.ssh
3⤵
PID:2065

/usr/bin/sudo
sudo rm -rf /tmp/.java
2⤵
PID:2066

/usr/bin/rm
rm -rf /tmp/.java
3⤵
PID:2067

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
2⤵
PID:2068

/usr/bin/rm
rm -rf /tmp/.iolanda
3⤵
PID:2069

/usr/bin/sudo
sudo pkill test.mod
2⤵
PID:2070

/usr/bin/pkill
pkill test.mod
3⤵
PID:2071

/usr/bin/sudo
sudo pkill daemon.i686.mod
2⤵
PID:2072

/usr/bin/pkill
pkill daemon.i686.mod
3⤵
PID:2073

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
2⤵
PID:2074

/usr/bin/pkill
pkill daemon.armv4l.mod
3⤵
PID:2075

/usr/bin/sudo
sudo pkill daemon.mips.mod
2⤵
PID:2076

/usr/bin/pkill
pkill daemon.mips.mod
3⤵
PID:2077

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
2⤵
PID:2078

/usr/bin/pkill
pkill daemon.mipsel.mod
3⤵
PID:2079

/usr/bin/sudo
sudo rm -rf /tmp/.xs
2⤵
PID:2080

/usr/bin/rm
rm -rf /tmp/.xs
3⤵
PID:2081

/usr/bin/sudo
sudo pkill ld-linux-x86-64
2⤵
PID:2082

/usr/bin/pkill
pkill ld-linux-x86-64
3⤵
PID:2083

/usr/bin/rm
rm -rf "/var/tmp/. *"
2⤵
PID:2084

/usr/bin/sudo
sudo killall -9 "[atd]"
2⤵
PID:2121

/usr/bin/killall
killall -9 "[atd]"
3⤵
PID:2122

/usr/bin/sudo
sudo rm -rf /tmp/.jk
2⤵
PID:2123

/usr/bin/rm
rm -rf /tmp/.jk
3⤵
PID:2124

/usr/bin/sudo
sudo killall -9 "[ntpd]"
2⤵
PID:2125

/usr/bin/killall
killall -9 "[ntpd]"
3⤵
PID:2126

/usr/bin/sudo
sudo killall -9 "[rpciod]"
2⤵
PID:2127

/usr/bin/killall
killall -9 "[rpciod]"
3⤵
PID:2128

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
2⤵
PID:2129

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
3⤵
PID:2130

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
2⤵
PID:2131

/usr/bin/rm
rm -rf "/tmp/.xm*"
3⤵
PID:2132

/usr/bin/pidof
pidof libexec
2⤵
PID:2133

/usr/bin/wc
wc -l
1⤵
PID:2031

/usr/bin/which
which sudo
1⤵
PID:2030

/usr/bin/grep
grep -c root
1⤵
PID:2037

/usr/bin/ls
ls -l .local_16274
1⤵
PID:2036

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2044

/usr/bin/grep
grep -v grep
1⤵
PID:2043

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2042

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2041

/usr/bin/ps
ps auxff
2⤵
PID:2045

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2089

/usr/bin/grep
grep -v grep
1⤵
PID:2088

/usr/bin/grep
grep xmr
1⤵
PID:2087

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2086

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2090

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2095

/usr/bin/grep
grep -v grep
1⤵
PID:2094

/usr/bin/grep
grep cryptonight
1⤵
PID:2093

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2092

/usr/bin/ps
ps auxf
2⤵
PID:2096

/usr/bin/grep
grep -v grep
1⤵
PID:2100

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2101

/usr/bin/grep
grep stratum
1⤵
PID:2099

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2098

/usr/bin/ps
ps auxf
2⤵
PID:2102

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2107

/usr/bin/grep
grep -v grep
1⤵
PID:2106

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2105

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2104

/usr/bin/ps
ps auxf
2⤵
PID:2108

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2113

/usr/bin/grep
grep -v grep
1⤵
PID:2112

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2111

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2110

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2114

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2119

/usr/bin/grep
grep -v grep
1⤵
PID:2118

/usr/bin/grep
grep xm64
1⤵
PID:2117

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2116

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2120

/bin/bash
/bin/bash -
1⤵
PID:2134

/usr/bin/sudo
sudo -S touch .local_1252
2⤵
PID:2139

/usr/bin/touch
touch .local_1252
3⤵
- Writes file to tmp directory
PID:2140

/usr/bin/sudo
sudo rm .local_1252
2⤵
PID:2144

/usr/bin/rm
rm .local_1252
3⤵
PID:2145

/usr/bin/sudo
sudo killall -9 bssh
2⤵
PID:2152

/usr/bin/killall
killall -9 bssh
3⤵
PID:2153

/usr/bin/sudo
sudo rm -rf /tmp/.an
2⤵
PID:2154

/usr/bin/rm
rm -rf /tmp/.an
3⤵
PID:2155

/usr/bin/sudo
sudo killall -9 xm64
2⤵
PID:2156

/usr/bin/killall
killall -9 xm64
3⤵
PID:2157

/usr/bin/sudo
sudo killall -9 rpc.idmapd
2⤵
PID:2158

/usr/bin/killall
killall -9 rpc.idmapd
3⤵
PID:2159

/usr/bin/sudo
sudo rm -rf /tmp/.m2
2⤵
PID:2160

/usr/bin/rm
rm -rf /tmp/.m2
3⤵
PID:2161

/usr/bin/sudo
sudo killall -9 xorgg
2⤵
PID:2162

/usr/bin/killall
killall -9 xorgg
3⤵
PID:2163

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
2⤵
PID:2164

/usr/bin/rm
rm -rf /tmp/seconfig
3⤵
PID:2165

/usr/bin/sudo
sudo killall -9 crond64
2⤵
PID:2166

/usr/bin/killall
killall -9 crond64
3⤵
PID:2167

/usr/bin/sudo
sudo killall -9 tsm
2⤵
PID:2168

/usr/bin/killall
killall -9 tsm
3⤵
PID:2169

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
2⤵
PID:2170

/usr/bin/rm
rm -rf /tmp/.ssh
3⤵
PID:2171

/usr/bin/sudo
sudo rm -rf /tmp/.java
2⤵
PID:2172

/usr/bin/rm
rm -rf /tmp/.java
3⤵
PID:2173

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
2⤵
PID:2174

/usr/bin/rm
rm -rf /tmp/.iolanda
3⤵
PID:2175

/usr/bin/sudo
sudo pkill test.mod
2⤵
PID:2176

/usr/bin/pkill
pkill test.mod
3⤵
PID:2177

/usr/bin/sudo
sudo pkill daemon.i686.mod
2⤵
PID:2178

/usr/bin/pkill
pkill daemon.i686.mod
3⤵
PID:2179

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
2⤵
PID:2180

/usr/bin/pkill
pkill daemon.armv4l.mod
3⤵
PID:2181

/usr/bin/sudo
sudo pkill daemon.mips.mod
2⤵
PID:2182

/usr/bin/pkill
pkill daemon.mips.mod
3⤵
PID:2183

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
2⤵
PID:2184

/usr/bin/pkill
pkill daemon.mipsel.mod
3⤵
- Reads CPU attributes
PID:2185

/usr/bin/sudo
sudo rm -rf /tmp/.xs
2⤵
PID:2186

/usr/bin/rm
rm -rf /tmp/.xs
3⤵
PID:2187

/usr/bin/sudo
sudo pkill ld-linux-x86-64
2⤵
PID:2188

/usr/bin/pkill
pkill ld-linux-x86-64
3⤵
PID:2189

/usr/bin/rm
rm -rf "/var/tmp/. *"
2⤵
PID:2190

/usr/bin/sudo
sudo killall -9 "[atd]"
2⤵
PID:2227

/usr/bin/killall
killall -9 "[atd]"
3⤵
PID:2228

/usr/bin/sudo
sudo rm -rf /tmp/.jk
2⤵
PID:2229

/usr/bin/rm
rm -rf /tmp/.jk
3⤵
PID:2230

/usr/bin/sudo
sudo killall -9 "[ntpd]"
2⤵
PID:2231

/usr/bin/killall
killall -9 "[ntpd]"
3⤵
PID:2232

/usr/bin/sudo
sudo killall -9 "[rpciod]"
2⤵
PID:2233

/usr/bin/killall
killall -9 "[rpciod]"
3⤵
PID:2234

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
2⤵
PID:2235

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
3⤵
PID:2236

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
2⤵
PID:2237

/usr/bin/rm
rm -rf "/tmp/.xm*"
3⤵
PID:2238

/usr/bin/pidof
pidof libexec
2⤵
PID:2239

/usr/bin/wc
wc -l
1⤵
PID:2137

/usr/bin/which
which sudo
1⤵
PID:2136

/usr/bin/grep
grep -c root
1⤵
PID:2143

/usr/bin/ls
ls -l .local_1252
1⤵
PID:2142

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2150

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2148

/usr/bin/grep
grep -v grep
1⤵
PID:2149

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2147

/usr/bin/ps
ps auxff
2⤵
- Reads runtime system information
PID:2151

/usr/bin/grep
grep -v grep
1⤵
PID:2194

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2195

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2192

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2196

/usr/bin/grep
grep xmr
1⤵
PID:2193

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2201

/usr/bin/grep
grep -v grep
1⤵
PID:2200

/usr/bin/grep
grep cryptonight
1⤵
PID:2199

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2198

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2202

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2207

/usr/bin/grep
grep -v grep
1⤵
PID:2206

/usr/bin/grep
grep stratum
1⤵
PID:2205

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2204

/usr/bin/ps
ps auxf
2⤵
PID:2208

/usr/bin/grep
grep -v grep
1⤵
PID:2212

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2211

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2210

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:2214

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2213

/usr/bin/grep
grep -v grep
1⤵
PID:2218

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2219

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2217

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2216

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2220

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2225

/usr/bin/grep
grep -v grep
1⤵
PID:2224

/usr/bin/grep
grep xm64
1⤵
PID:2223

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2222

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:2226

/usr/bin/free
free -m
1⤵
PID:2240

/usr/bin/uptime
uptime
1⤵
PID:2241

/usr/bin/wc
wc -l
1⤵
PID:2304

/usr/bin/which
which sudo
1⤵
PID:2303

/usr/bin/grep
grep -c root
1⤵
PID:2310

/usr/bin/ls
ls -l .local_3864
1⤵
PID:2309

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2314

/usr/bin/ps
ps auxff
2⤵
PID:2318

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2315

/usr/bin/grep
grep -v grep
1⤵
PID:2316

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2317

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2363

/usr/bin/grep
grep -v grep
1⤵
PID:2362

/usr/bin/grep
grep xmr
1⤵
PID:2361

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2360

/usr/bin/ps
ps auxf
2⤵
PID:2364

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2368

/usr/bin/ps
ps auxf
2⤵
PID:2372

/usr/bin/grep
grep -v grep
1⤵
PID:2370

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2371

/usr/bin/grep
grep cryptonight
1⤵
PID:2369

/usr/bin/grep
grep -v grep
1⤵
PID:2376

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2377

/usr/bin/grep
grep stratum
1⤵
PID:2375

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2374

/usr/bin/ps
ps auxf
2⤵
PID:2378

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2383

/usr/bin/grep
grep -v grep
1⤵
PID:2382

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2381

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2380

/usr/bin/ps
ps auxf
2⤵
PID:2384

/usr/bin/grep
grep -v grep
1⤵
PID:2388

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2386

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:2390

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2387

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2389

/usr/bin/grep
grep xm64
1⤵
PID:2393

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2392

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2396

/usr/bin/grep
grep -v grep
1⤵
PID:2394

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2395

/bin/bash
/bin/bash -
1⤵
PID:2410

/usr/bin/sudo
sudo -S touch .local_26978
2⤵
PID:2417

/usr/bin/touch
touch .local_26978
3⤵
- Writes file to tmp directory
PID:2418

/usr/bin/sudo
sudo rm .local_26978
2⤵
PID:2422

/usr/bin/rm
rm .local_26978
3⤵
PID:2423

/usr/bin/sudo
sudo killall -9 bssh
2⤵
PID:2436

/usr/bin/killall
killall -9 bssh
3⤵
PID:2437

/usr/bin/sudo
sudo rm -rf /tmp/.an
2⤵
PID:2438

/usr/bin/rm
rm -rf /tmp/.an
3⤵
PID:2439

/usr/bin/sudo
sudo killall -9 xm64
2⤵
PID:2440

/usr/bin/killall
killall -9 xm64
3⤵
PID:2441

/usr/bin/sudo
sudo killall -9 rpc.idmapd
2⤵
PID:2442

/usr/bin/killall
killall -9 rpc.idmapd
3⤵
PID:2443

/usr/bin/sudo
sudo rm -rf /tmp/.m2
2⤵
PID:2444

/usr/bin/rm
rm -rf /tmp/.m2
3⤵
PID:2445

/usr/bin/sudo
sudo killall -9 xorgg
2⤵
PID:2446

/usr/bin/killall
killall -9 xorgg
3⤵
PID:2447

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
2⤵
PID:2448

/usr/bin/rm
rm -rf /tmp/seconfig
3⤵
PID:2449

/usr/bin/sudo
sudo killall -9 crond64
2⤵
PID:2450

/usr/bin/killall
killall -9 crond64
3⤵
- Reads runtime system information
PID:2451

/usr/bin/sudo
sudo killall -9 tsm
2⤵
PID:2452

/usr/bin/killall
killall -9 tsm
3⤵
PID:2453

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
2⤵
PID:2454

/usr/bin/rm
rm -rf /tmp/.ssh
3⤵
PID:2455

/usr/bin/sudo
sudo rm -rf /tmp/.java
2⤵
PID:2456

/usr/bin/rm
rm -rf /tmp/.java
3⤵
PID:2457

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
2⤵
PID:2458

/usr/bin/rm
rm -rf /tmp/.iolanda
3⤵
PID:2459

/usr/bin/sudo
sudo pkill test.mod
2⤵
PID:2460

/usr/bin/pkill
pkill test.mod
3⤵
PID:2461

/usr/bin/sudo
sudo pkill daemon.i686.mod
2⤵
PID:2462

/usr/bin/pkill
pkill daemon.i686.mod
3⤵
PID:2463

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
2⤵
PID:2464

/usr/bin/pkill
pkill daemon.armv4l.mod
3⤵
PID:2465

/usr/bin/sudo
sudo pkill daemon.mips.mod
2⤵
PID:2466

/usr/bin/pkill
pkill daemon.mips.mod
3⤵
PID:2467

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
2⤵
PID:2468

/usr/bin/pkill
pkill daemon.mipsel.mod
3⤵
- Reads runtime system information
PID:2469

/usr/bin/sudo
sudo rm -rf /tmp/.xs
2⤵
PID:2470

/usr/bin/rm
rm -rf /tmp/.xs
3⤵
PID:2471

/usr/bin/sudo
sudo pkill ld-linux-x86-64
2⤵
PID:2472

/usr/bin/pkill
pkill ld-linux-x86-64
3⤵
PID:2473

/usr/bin/rm
rm -rf "/var/tmp/. *"
2⤵
PID:2474

/usr/bin/sudo
sudo killall -9 "[atd]"
2⤵
PID:2513

/usr/bin/killall
killall -9 "[atd]"
3⤵
PID:2514

/usr/bin/sudo
sudo rm -rf /tmp/.jk
2⤵
PID:2515

/usr/bin/rm
rm -rf /tmp/.jk
3⤵
PID:2516

/usr/bin/sudo
sudo killall -9 "[ntpd]"
2⤵
PID:2517

/usr/bin/killall
killall -9 "[ntpd]"
3⤵
- Reads runtime system information
PID:2518

/usr/bin/sudo
sudo killall -9 "[rpciod]"
2⤵
PID:2519

/usr/bin/killall
killall -9 "[rpciod]"
3⤵
PID:2520

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
2⤵
PID:2521

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
3⤵
PID:2522

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
2⤵
PID:2523

/usr/bin/rm
rm -rf "/tmp/.xm*"
3⤵
PID:2524

/usr/bin/pidof
pidof libexec
2⤵
PID:2525

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:2411

/usr/bin/uptime
uptime
1⤵
PID:2412

/usr/bin/wc
wc -l
1⤵
PID:2415

/usr/bin/which
which sudo
1⤵
PID:2414

/usr/bin/grep
grep -c root
1⤵
PID:2421

/usr/bin/ls
ls -l .local_26978
1⤵
PID:2420

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2425

/usr/bin/ps
ps auxff
2⤵
- Reads runtime system information
PID:2435

/usr/bin/grep
grep -v grep
1⤵
PID:2427

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2426

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2428

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2479

/usr/bin/grep
grep -v grep
1⤵
PID:2478

/usr/bin/grep
grep xmr
1⤵
PID:2477

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2476

/usr/bin/ps
ps auxf
2⤵
PID:2480

/usr/bin/grep
grep cryptonight
1⤵
PID:2483

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2485

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2482

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:2486

/usr/bin/grep
grep -v grep
1⤵
PID:2484

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2492

/usr/bin/grep
grep -v grep
1⤵
PID:2491

/usr/bin/grep
grep stratum
1⤵
PID:2490

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2489

/usr/bin/ps
ps auxf
2⤵
PID:2493

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2499

/usr/bin/grep
grep -v grep
1⤵
PID:2498

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2497

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2496

/usr/bin/ps
ps auxf
2⤵
PID:2500

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2505

/usr/bin/grep
grep -v grep
1⤵
PID:2504

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2503

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2502

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:2506

/usr/bin/grep
grep xm64
1⤵
PID:2509

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2508

/usr/bin/ps
ps auxf
2⤵
PID:2512

/usr/bin/grep
grep -v grep
1⤵
PID:2510

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2511

/bin/bash
/bin/bash -
1⤵
PID:2531

/usr/bin/sudo
sudo -S touch .local_16214
2⤵
PID:2536

/usr/bin/touch
touch .local_16214
3⤵
- Writes file to tmp directory
PID:2537

/usr/bin/sudo
sudo rm .local_16214
2⤵
PID:2541

/usr/bin/rm
rm .local_16214
3⤵
PID:2542

/usr/bin/sudo
sudo killall -9 bssh
2⤵
PID:2551

/usr/bin/killall
killall -9 bssh
3⤵
PID:2552

/usr/bin/sudo
sudo rm -rf /tmp/.an
2⤵
PID:2553

/usr/bin/rm
rm -rf /tmp/.an
3⤵
PID:2554

/usr/bin/sudo
sudo killall -9 xm64
2⤵
PID:2555

/usr/bin/killall
killall -9 xm64
3⤵
PID:2556

/usr/bin/sudo
sudo killall -9 rpc.idmapd
2⤵
PID:2557

/usr/bin/killall
killall -9 rpc.idmapd
3⤵
PID:2558

/usr/bin/sudo
sudo rm -rf /tmp/.m2
2⤵
PID:2559

/usr/bin/rm
rm -rf /tmp/.m2
3⤵
PID:2560

/usr/bin/sudo
sudo killall -9 xorgg
2⤵
PID:2561

/usr/bin/killall
killall -9 xorgg
3⤵
PID:2562

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
2⤵
PID:2563

/usr/bin/rm
rm -rf /tmp/seconfig
3⤵
PID:2564

/usr/bin/sudo
sudo killall -9 crond64
2⤵
PID:2565

/usr/bin/killall
killall -9 crond64
3⤵
PID:2566

/usr/bin/sudo
sudo killall -9 tsm
2⤵
PID:2567

/usr/bin/killall
killall -9 tsm
3⤵
PID:2568

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
2⤵
PID:2569

/usr/bin/rm
rm -rf /tmp/.ssh
3⤵
PID:2570

/usr/bin/sudo
sudo rm -rf /tmp/.java
2⤵
PID:2571

/usr/bin/rm
rm -rf /tmp/.java
3⤵
PID:2572

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
2⤵
PID:2573

/usr/bin/rm
rm -rf /tmp/.iolanda
3⤵
PID:2574

/usr/bin/sudo
sudo pkill test.mod
2⤵
PID:2575

/usr/bin/pkill
pkill test.mod
3⤵
- Reads CPU attributes
PID:2576

/usr/bin/sudo
sudo pkill daemon.i686.mod
2⤵
PID:2577

/usr/bin/pkill
pkill daemon.i686.mod
3⤵
PID:2578

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
2⤵
PID:2579

/usr/bin/pkill
pkill daemon.armv4l.mod
3⤵
- Reads runtime system information
PID:2580

/usr/bin/sudo
sudo pkill daemon.mips.mod
2⤵
PID:2581

/usr/bin/pkill
pkill daemon.mips.mod
3⤵
- Reads CPU attributes
PID:2582

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
2⤵
PID:2584

/usr/bin/pkill
pkill daemon.mipsel.mod
3⤵
- Reads CPU attributes
- Reads runtime system information
PID:2585

/usr/bin/sudo
sudo rm -rf /tmp/.xs
2⤵
PID:2587

/usr/bin/rm
rm -rf /tmp/.xs
3⤵
PID:2588

/usr/bin/sudo
sudo pkill ld-linux-x86-64
2⤵
PID:2589

/usr/bin/pkill
pkill ld-linux-x86-64
3⤵
- Reads CPU attributes
PID:2590

/usr/bin/rm
rm -rf "/var/tmp/. *"
2⤵
PID:2592

/usr/bin/sudo
sudo killall -9 "[atd]"
2⤵
PID:2637

/usr/bin/killall
killall -9 "[atd]"
3⤵
- Reads runtime system information
PID:2638

/usr/bin/sudo
sudo rm -rf /tmp/.jk
2⤵
PID:2639

/usr/bin/rm
rm -rf /tmp/.jk
3⤵
PID:2641

/usr/bin/sudo
sudo killall -9 "[ntpd]"
2⤵
PID:2642

/usr/bin/killall
killall -9 "[ntpd]"
3⤵
PID:2643

/usr/bin/sudo
sudo killall -9 "[rpciod]"
2⤵
PID:2644

/usr/bin/killall
killall -9 "[rpciod]"
3⤵
PID:2645

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
2⤵
PID:2647

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
3⤵
PID:2648

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
2⤵
PID:2649

/usr/bin/rm
rm -rf "/tmp/.xm*"
3⤵
PID:2650

/usr/bin/pidof
pidof libexec
2⤵
PID:2651

/usr/bin/wc
wc -l
1⤵
PID:2534

/usr/bin/which
which sudo
1⤵
PID:2533

/usr/bin/grep
grep -c root
1⤵
PID:2540

/usr/bin/ls
ls -l .local_16214
1⤵
PID:2539

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2547

/usr/bin/grep
grep -v grep
1⤵
PID:2546

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2545

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2544

/usr/bin/ps
ps auxff
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2548

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:2549

/usr/bin/uptime
uptime
1⤵
PID:2550

/usr/bin/grep
grep -v grep
1⤵
PID:2596

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2597

/usr/bin/grep
grep xmr
1⤵
PID:2595

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2594

/usr/bin/ps
ps auxf
2⤵
PID:2598

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2604

/usr/bin/grep
grep -v grep
1⤵
PID:2603

/usr/bin/grep
grep cryptonight
1⤵
PID:2602

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2601

/usr/bin/ps
ps auxf
2⤵
PID:2605

/usr/bin/grep
grep -v grep
1⤵
PID:2610

/usr/bin/grep
grep stratum
1⤵
PID:2609

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2611

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2608

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2613

/usr/bin/grep
grep -v grep
1⤵
PID:2617

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2618

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2616

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2615

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2620

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2623

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2627

/usr/bin/grep
grep -v grep
1⤵
PID:2625

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2624

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2626

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2633

/usr/bin/grep
grep -v grep
1⤵
PID:2632

/usr/bin/grep
grep xm64
1⤵
PID:2631

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2630

/usr/bin/ps
ps auxf
2⤵
PID:2635

/bin/bash
/bin/bash -
1⤵
PID:2672

/usr/bin/sudo
sudo -S touch .local_16840
2⤵
PID:2677

/usr/bin/touch
touch .local_16840
3⤵
- Writes file to tmp directory
PID:2694

/usr/bin/sudo
sudo rm .local_16840
2⤵
PID:2718

/usr/bin/rm
rm .local_16840
3⤵
PID:2721

/usr/bin/sudo
sudo killall -9 bssh
2⤵
PID:2729

/usr/bin/killall
killall -9 bssh
3⤵
PID:2730

/usr/bin/sudo
sudo rm -rf /tmp/.an
2⤵
PID:2731

/usr/bin/rm
rm -rf /tmp/.an
3⤵
PID:2732

/usr/bin/sudo
sudo killall -9 xm64
2⤵
PID:2733

/usr/bin/killall
killall -9 xm64
3⤵
PID:2734

/usr/bin/sudo
sudo killall -9 rpc.idmapd
2⤵
PID:2735

/usr/bin/killall
killall -9 rpc.idmapd
3⤵
PID:2736

/usr/bin/sudo
sudo rm -rf /tmp/.m2
2⤵
PID:2737

/usr/bin/rm
rm -rf /tmp/.m2
3⤵
PID:2738

/usr/bin/sudo
sudo killall -9 xorgg
2⤵
PID:2739

/usr/bin/killall
killall -9 xorgg
3⤵
PID:2740

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
2⤵
PID:2741

/usr/bin/rm
rm -rf /tmp/seconfig
3⤵
PID:2742

/usr/bin/sudo
sudo killall -9 crond64
2⤵
PID:2743

/usr/bin/killall
killall -9 crond64
3⤵
PID:2746

/usr/bin/sudo
sudo killall -9 tsm
2⤵
PID:2747

/usr/bin/killall
killall -9 tsm
3⤵
PID:2748

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
2⤵
PID:2749

/usr/bin/rm
rm -rf /tmp/.ssh
3⤵
PID:2750

/usr/bin/sudo
sudo rm -rf /tmp/.java
2⤵
PID:2751

/usr/bin/rm
rm -rf /tmp/.java
3⤵
PID:2752

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
2⤵
PID:2753

/usr/bin/rm
rm -rf /tmp/.iolanda
3⤵
PID:2754

/usr/bin/sudo
sudo pkill test.mod
2⤵
PID:2755

/usr/bin/pkill
pkill test.mod
3⤵
- Reads runtime system information
PID:2756

/usr/bin/sudo
sudo pkill daemon.i686.mod
2⤵
PID:2757

/usr/bin/pkill
pkill daemon.i686.mod
3⤵
- Reads CPU attributes
PID:2758

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
2⤵
PID:2759

/usr/bin/pkill
pkill daemon.armv4l.mod
3⤵
PID:2760

/usr/bin/sudo
sudo pkill daemon.mips.mod
2⤵
PID:2761

/usr/bin/pkill
pkill daemon.mips.mod
3⤵
PID:2762

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
2⤵
PID:2763

/usr/bin/pkill
pkill daemon.mipsel.mod
3⤵
- Reads CPU attributes
PID:2765

/usr/bin/sudo
sudo rm -rf /tmp/.xs
2⤵
PID:2766

/usr/bin/rm
rm -rf /tmp/.xs
3⤵
PID:2767

/usr/bin/sudo
sudo pkill ld-linux-x86-64
2⤵
PID:2768

/usr/bin/pkill
pkill ld-linux-x86-64
3⤵
PID:2769

/usr/bin/rm
rm -rf "/var/tmp/. *"
2⤵
PID:2770

/usr/bin/sudo
sudo killall -9 "[atd]"
2⤵
PID:2807

/usr/bin/killall
killall -9 "[atd]"
3⤵
- Reads runtime system information
PID:2808

/usr/bin/sudo
sudo rm -rf /tmp/.jk
2⤵
PID:2809

/usr/bin/rm
rm -rf /tmp/.jk
3⤵
PID:2810

/usr/bin/sudo
sudo killall -9 "[ntpd]"
2⤵
PID:2811

/usr/bin/killall
killall -9 "[ntpd]"
3⤵
PID:2812

/usr/bin/sudo
sudo killall -9 "[rpciod]"
2⤵
PID:2813

/usr/bin/killall
killall -9 "[rpciod]"
3⤵
PID:2814

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
2⤵
PID:2815

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
3⤵
PID:2816

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
2⤵
PID:2817

/usr/bin/rm
rm -rf "/tmp/.xm*"
3⤵
PID:2818

/usr/bin/pidof
pidof libexec
2⤵
PID:2819

/usr/bin/wc
wc -l
1⤵
PID:2675

/usr/bin/which
which sudo
1⤵
PID:2674

/usr/bin/grep
grep -c root
1⤵
PID:2715

/usr/bin/ls
ls -l .local_16840
1⤵
PID:2714

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2726

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2724

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2723

/usr/bin/ps
ps auxff
2⤵
PID:2728

/usr/bin/grep
grep -v grep
1⤵
PID:2725

/usr/bin/free
free -m
1⤵
PID:2744

/usr/bin/uptime
uptime
1⤵
PID:2745

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2775

/usr/bin/grep
grep -v grep
1⤵
PID:2774

/usr/bin/grep
grep xmr
1⤵
PID:2773

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2772

/usr/bin/ps
ps auxf
2⤵
PID:2776

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2781

/usr/bin/grep
grep -v grep
1⤵
PID:2780

/usr/bin/grep
grep cryptonight
1⤵
PID:2779

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2778

/usr/bin/ps
ps auxf
2⤵
PID:2782

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2787

/usr/bin/grep
grep -v grep
1⤵
PID:2786

/usr/bin/grep
grep stratum
1⤵
PID:2785

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2784

/usr/bin/ps
ps auxf
2⤵
PID:2788

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2793

/usr/bin/grep
grep -v grep
1⤵
PID:2792

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2791

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2790

/usr/bin/ps
ps auxf
2⤵
PID:2794

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2799

/usr/bin/grep
grep -v grep
1⤵
PID:2798

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2797

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2796

/usr/bin/ps
ps auxf
2⤵
PID:2800

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2805

/usr/bin/grep
grep -v grep
1⤵
PID:2804

/usr/bin/grep
grep xm64
1⤵
PID:2803

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2802

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2806

/bin/bash
/bin/bash -
1⤵
PID:2866

/usr/bin/sudo
sudo -S touch .local_21139
2⤵
PID:2871

/usr/bin/touch
touch .local_21139
3⤵
- Writes file to tmp directory
PID:2872

/usr/bin/sudo
sudo rm .local_21139
2⤵
PID:2876

/usr/bin/rm
rm .local_21139
3⤵
PID:2877

/usr/bin/sudo
sudo killall -9 bssh
2⤵
PID:2884

/usr/bin/killall
killall -9 bssh
3⤵
PID:2885

/usr/bin/sudo
sudo rm -rf /tmp/.an
2⤵
PID:2886

/usr/bin/rm
rm -rf /tmp/.an
3⤵
PID:2887

/usr/bin/sudo
sudo killall -9 xm64
2⤵
PID:2888

/usr/bin/killall
killall -9 xm64
3⤵
- Reads runtime system information
PID:2889

/usr/bin/sudo
sudo killall -9 rpc.idmapd
2⤵
PID:2890

/usr/bin/killall
killall -9 rpc.idmapd
3⤵
PID:2891

/usr/bin/sudo
sudo rm -rf /tmp/.m2
2⤵
PID:2892

/usr/bin/rm
rm -rf /tmp/.m2
3⤵
PID:2893

/usr/bin/sudo
sudo killall -9 xorgg
2⤵
PID:2894

/usr/bin/killall
killall -9 xorgg
3⤵
PID:2895

/usr/bin/sudo
sudo rm -rf /tmp/seconfig
2⤵
PID:2896

/usr/bin/rm
rm -rf /tmp/seconfig
3⤵
PID:2897

/usr/bin/sudo
sudo killall -9 crond64
2⤵
PID:2898

/usr/bin/killall
killall -9 crond64
3⤵
- Reads runtime system information
PID:2899

/usr/bin/sudo
sudo killall -9 tsm
2⤵
PID:2900

/usr/bin/killall
killall -9 tsm
3⤵
PID:2901

/usr/bin/sudo
sudo rm -rf /tmp/.ssh
2⤵
PID:2902

/usr/bin/rm
rm -rf /tmp/.ssh
3⤵
PID:2903

/usr/bin/sudo
sudo rm -rf /tmp/.java
2⤵
PID:2904

/usr/bin/rm
rm -rf /tmp/.java
3⤵
PID:2905

/usr/bin/sudo
sudo rm -rf /tmp/.iolanda
2⤵
PID:2906

/usr/bin/rm
rm -rf /tmp/.iolanda
3⤵
PID:2907

/usr/bin/sudo
sudo pkill test.mod
2⤵
PID:2908

/usr/bin/pkill
pkill test.mod
3⤵
- Reads runtime system information
PID:2909

/usr/bin/sudo
sudo pkill daemon.i686.mod
2⤵
PID:2910

/usr/bin/pkill
pkill daemon.i686.mod
3⤵
PID:2911

/usr/bin/sudo
sudo pkill daemon.armv4l.mod
2⤵
PID:2912

/usr/bin/pkill
pkill daemon.armv4l.mod
3⤵
- Reads runtime system information
PID:2913

/usr/bin/sudo
sudo pkill daemon.mips.mod
2⤵
PID:2914

/usr/bin/pkill
pkill daemon.mips.mod
3⤵
- Reads runtime system information
PID:2915

/usr/bin/sudo
sudo pkill daemon.mipsel.mod
2⤵
PID:2916

/usr/bin/pkill
pkill daemon.mipsel.mod
3⤵
PID:2917

/usr/bin/sudo
sudo rm -rf /tmp/.xs
2⤵
PID:2918

/usr/bin/rm
rm -rf /tmp/.xs
3⤵
PID:2919

/usr/bin/sudo
sudo pkill ld-linux-x86-64
2⤵
PID:2920

/usr/bin/pkill
pkill ld-linux-x86-64
3⤵
- Reads CPU attributes
PID:2921

/usr/bin/rm
rm -rf "/var/tmp/. *"
2⤵
PID:2922

/usr/bin/sudo
sudo killall -9 "[atd]"
2⤵
PID:2959

/usr/bin/killall
killall -9 "[atd]"
3⤵
PID:2960

/usr/bin/sudo
sudo rm -rf /tmp/.jk
2⤵
PID:2961

/usr/bin/rm
rm -rf /tmp/.jk
3⤵
PID:2962

/usr/bin/sudo
sudo killall -9 "[ntpd]"
2⤵
PID:2963

/usr/bin/killall
killall -9 "[ntpd]"
3⤵
PID:2964

/usr/bin/sudo
sudo killall -9 "[rpciod]"
2⤵
PID:2965

/usr/bin/killall
killall -9 "[rpciod]"
3⤵
PID:2966

/usr/bin/sudo
sudo killall -9 "[ext4-dio-unwrit]"
2⤵
PID:2967

/usr/bin/killall
killall -9 "[ext4-dio-unwrit]"
3⤵
PID:2968

/usr/bin/sudo
sudo rm -rf "/tmp/.xm*"
2⤵
PID:2969

/usr/bin/rm
rm -rf "/tmp/.xm*"
3⤵
PID:2970

/usr/bin/pidof
pidof libexec
2⤵
PID:2971

/usr/bin/wc
wc -l
1⤵
PID:2869

/usr/bin/which
which sudo
1⤵
PID:2868

/usr/bin/grep
grep -c root
1⤵
PID:2875

/usr/bin/ls
ls -l .local_21139
1⤵
PID:2874

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2882

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2880

/usr/bin/grep
grep -v grep
1⤵
PID:2881

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2879

/usr/bin/ps
ps auxff
2⤵
PID:2883

/usr/bin/grep
grep -v grep
1⤵
PID:2926

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2927

/usr/bin/grep
grep xmr
1⤵
PID:2925

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2924

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2928

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2930

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2934

/usr/bin/grep
grep -v grep
1⤵
PID:2932

/usr/bin/grep
grep cryptonight
1⤵
PID:2931

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2933

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2939

/usr/bin/grep
grep -v grep
1⤵
PID:2938

/usr/bin/grep
grep stratum
1⤵
PID:2937

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2936

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2940

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2945

/usr/bin/grep
grep -v grep
1⤵
PID:2944

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2943

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2942

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2946

/usr/bin/grep
grep -v grep
1⤵
PID:2950

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2951

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2949

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2948

/usr/bin/ps
ps auxf
2⤵
PID:2952

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2957

/usr/bin/grep
grep -v grep
1⤵
PID:2956

/usr/bin/grep
grep xm64
1⤵
PID:2955

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2954

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:2958

/usr/bin/free
free -m
1⤵
PID:2972

/usr/bin/uptime
uptime
1⤵
PID:2973

/usr/bin/wc
wc -l
1⤵
PID:2977

/usr/bin/which
which sudo
1⤵
PID:2976

/usr/bin/grep
grep -c root
1⤵
PID:2983

/usr/bin/ls
ls -l .local_28068
1⤵
PID:2982

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2990

/usr/bin/grep
grep -v grep
1⤵
PID:2989

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2988

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2987

/usr/bin/ps
ps auxff
2⤵
- Reads CPU attributes
PID:2991

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3035

/usr/bin/grep
grep -v grep
1⤵
PID:3034

/usr/bin/grep
grep xmr
1⤵
PID:3033

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3032

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:3036

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3041

/usr/bin/grep
grep -v grep
1⤵
PID:3040

/usr/bin/grep
grep cryptonight
1⤵
PID:3039

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3038

/usr/bin/ps
ps auxf
2⤵
PID:3042

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3047

/usr/bin/grep
grep -v grep
1⤵
PID:3046

/usr/bin/grep
grep stratum
1⤵
PID:3045

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3044

/usr/bin/ps
ps auxf
2⤵
PID:3048

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3053

/usr/bin/grep
grep -v grep
1⤵
PID:3052

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:3051

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3050

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:3054

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3059

/usr/bin/grep
grep -v grep
1⤵
PID:3058

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:3057

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3056

/usr/bin/ps
ps auxf
2⤵
- Reads runtime system information
PID:3060

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3065

/usr/bin/grep
grep -v grep
1⤵
PID:3064

/usr/bin/grep
grep xm64
1⤵
PID:3063

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3062

/usr/bin/ps
ps auxf
2⤵
PID:3066

/usr/bin/wc
wc -l
1⤵
PID:3083

/usr/bin/which
which sudo
1⤵
PID:3082

/usr/bin/grep
grep -c root
1⤵
PID:3089

/usr/bin/ls
ls -l .local_5245
1⤵
PID:3088

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3096

/usr/bin/grep
grep -v grep
1⤵
PID:3095

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:3094

/usr/bin/sudo
sudo ps auxff
1⤵
PID:3093

/usr/bin/ps
ps auxff
2⤵
- Reads CPU attributes
PID:3097

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3155

/usr/bin/grep
grep -v grep
1⤵
PID:3154

/usr/bin/grep
grep xmr
1⤵
PID:3153

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3152

/usr/bin/ps
ps auxf
2⤵
PID:3156

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3161

/usr/bin/grep
grep -v grep
1⤵
PID:3160

/usr/bin/grep
grep cryptonight
1⤵
PID:3159

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3158

/usr/bin/ps
ps auxf
2⤵
PID:3162

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3167

/usr/bin/grep
grep -v grep
1⤵
PID:3166

/usr/bin/grep
grep stratum
1⤵
PID:3165

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3164

/usr/bin/ps
ps auxf
2⤵
PID:3168

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3173

/usr/bin/grep
grep -v grep
1⤵
PID:3172

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:3171

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3170

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:3174

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3179

/usr/bin/grep
grep -v grep
1⤵
PID:3178

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:3177

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3176

/usr/bin/ps
ps auxf
2⤵
PID:3180

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3185

/usr/bin/grep
grep -v grep
1⤵
PID:3184

/usr/bin/grep
grep xm64
1⤵
PID:3183

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3182

/usr/bin/ps
ps auxf
2⤵
- Reads CPU attributes
PID:3186

/usr/bin/wc
wc -l
1⤵
PID:3205

/usr/bin/which
which sudo
1⤵
PID:3204

/usr/bin/grep
grep -c root
1⤵
PID:3211

/usr/bin/ls
ls -l .local_774
1⤵
PID:3210

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3218

/usr/bin/grep
grep -v grep
1⤵
PID:3217

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:3216

/usr/bin/sudo
sudo ps auxff
1⤵
PID:3215

/usr/bin/ps
ps auxff
2⤵
- Reads CPU attributes
PID:3219

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Indicator Removal

T1070

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys
Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit