b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
153s
max time network
143s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
03-03-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Size

8.6MB
MD5

ae747bc7fff9bc23f06635ef60ea0e8d
SHA1

64315e834f67905ed4e47f36155362a78ac23462
SHA256

103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
SHA512

e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2
SSDEEP

98304:rDSceJ/GqDu6P0ypQ0Qv5knSTH20ejwBcHjI7Xk:rDSceJ/GqD18RZv5knS720e7s

Score

8^/10

antivm infostealer persistence

Malware Config

Signatures

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	Process not Found
File opened for modification	/root/.ssh/authorized_keys	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

Deletes itself 1 IoCs

pid	Process
1912	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046

Reads EFI boot settings 1 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

infostealer

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	cat

Deletes log files 1 TTPs 2 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046	103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/3758/status	Process not Found
File opened for reading	/proc/77/cmdline	pkill
File opened for reading	/proc/632/cmdline	Process not Found
File opened for reading	/proc/828/status	ps
File opened for reading	/proc/1081/stat	killall
File opened for reading	/proc/1054/stat	ps
File opened for reading	/proc/451/status	ps
File opened for reading	/proc/496/status	Process not Found
File opened for reading	/proc/1912/cmdline	Process not Found
File opened for reading	/proc/794/cmdline	Process not Found
File opened for reading	/proc/794/stat	ps
File opened for reading	/proc/967/cmdline	Process not Found
File opened for reading	/proc/1318/cmdline	Process not Found
File opened for reading	/proc/1305/cmdline	Process not Found
File opened for reading	/proc/803/stat	killall
File opened for reading	/proc/175/cmdline	Process not Found
File opened for reading	/proc/7/stat	Process not Found
File opened for reading	/proc/1926/status	ps
File opened for reading	/proc/803/cmdline	pkill
File opened for reading	/proc/498/cmdline	ps
File opened for reading	/proc/584/stat	Process not Found
File opened for reading	/proc/270/status	ps
File opened for reading	/proc/438/status	Process not Found
File opened for reading	/proc/22/stat	Process not Found
File opened for reading	/proc/1179/status	Process not Found
File opened for reading	/proc/87/stat	Process not Found
File opened for reading	/proc/972/cmdline	ps
File opened for reading	/proc/2953/stat	ps
File opened for reading	/proc/904/stat	killall
File opened for reading	/proc/616/cmdline	Process not Found
File opened for reading	/proc/441/status	pkill
File opened for reading	/proc/493/cmdline	Process not Found
File opened for reading	/proc/393/stat	Process not Found
File opened for reading	/proc/102/stat	Process not Found
File opened for reading	/proc/79/stat	Process not Found
File opened for reading	/proc/73/stat	Process not Found
File opened for reading	/proc/1033/cmdline	Process not Found
File opened for reading	/proc/1128/cmdline	Process not Found
File opened for reading	/proc/23/cmdline	Process not Found
File opened for reading	/proc/158/status	pkill
File opened for reading	/proc/1179/cmdline	Process not Found
File opened for reading	/proc/175/stat	Process not Found
File opened for reading	/proc/1155/cmdline	Process not Found
File opened for reading	/proc/88/cmdline	Process not Found
File opened for reading	/proc/614/status	Process not Found
File opened for reading	/proc/614/cmdline	Process not Found
File opened for reading	/proc/175/stat	ps
File opened for reading	/proc/668/status	Process not Found
File opened for reading	/proc/1102/cmdline	ps
File opened for reading	/proc/81/cmdline	Process not Found
File opened for reading	/proc/1079/cmdline	ps
File opened for reading	/proc/70/status	Process not Found
File opened for reading	/proc/88/cmdline	ps
File opened for reading	/proc/1192/stat	Process not Found
File opened for reading	/proc/1401/cmdline	Process not Found
File opened for reading	/proc/996/stat	Process not Found
File opened for reading	/proc/1926/status	ps
File opened for reading	/proc/70/cmdline	Process not Found
File opened for reading	/proc/483/status	Process not Found
File opened for reading	/proc/1137/cmdline	Process not Found
File opened for reading	/proc/158/status	Process not Found
File opened for reading	/proc/523/status	Process not Found
File opened for reading	/proc/242/status	Process not Found
File opened for reading	/proc/960/cmdline	ps

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_21495	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_27544	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_25600	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_9723	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_31567	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_8413	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_28961	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_8931	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_3783	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_11204	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_5187	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_19706	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_8425	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_15174	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_13500	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_9233	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_3221	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_29319	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_22687	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_2799	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_4031	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_24805	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_16608	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_6662	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_2780	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_12335	touch
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_12483	Process not Found
File opened for modification	/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/.local_30076	Process not Found

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
PID:1912
- /usr/bin/uname
  uname -a
  2⤵
  PID:1925
- /usr/bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1929
- /usr/bin/cat
  cat /etc/issue
  2⤵
  PID:1930
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1931
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1932
- /usr/bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  - Reads EFI boot settings
  - Enumerates kernel/hardware configuration
  PID:1933
- /usr/bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:1934
- /usr/bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:1935
- /usr/local/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1935
- /usr/local/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1935
- /usr/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1935
- /usr/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1935
- /bin/bash
  /bin/bash -
  2⤵
  PID:1976
- - /usr/bin/sudo
    sudo -S touch .local_28961
    3⤵
    PID:1981
  - - /usr/bin/touch
      touch .local_28961
      4⤵
      Writes file to tmp directory
      PID:1982
- - /usr/bin/sudo
    sudo rm .local_28961
    3⤵
    PID:1986
  - - /usr/bin/rm
      rm .local_28961
      4⤵
      PID:1987
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:1994
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:1995
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:1996
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:1997
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:1998
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:1999
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2000
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2001
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2002
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2003
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2004
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2005
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2006
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2007
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2008
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2009
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2010
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2011
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2012
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2013
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2014
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2015
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2016
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2017
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2018
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:2019
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2020
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2021
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2022
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2023
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2024
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:2025
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2026
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2027
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2028
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2031
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2032
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      Reads CPU attributes
      PID:2033
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2034
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2071
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2072
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2073
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2074
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2075
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2076
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2077
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2078
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2079
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2080
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2081
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2082
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2083
- /usr/bin/free
  free -m
  2⤵
  PID:2186
- /usr/bin/uptime
  uptime
  2⤵
  PID:2187
- /bin/bash
  /bin/bash -
  2⤵
  PID:2188
- - /usr/bin/sudo
    sudo -S touch .local_22687
    3⤵
    PID:2193
  - - /usr/bin/touch
      touch .local_22687
      4⤵
      Writes file to tmp directory
      PID:2194
- - /usr/bin/sudo
    sudo rm .local_22687
    3⤵
    PID:2198
  - - /usr/bin/rm
      rm .local_22687
      4⤵
      PID:2199
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2206
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2207
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2208
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2209
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2210
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2211
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2212
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2213
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2214
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2215
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2216
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2217
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2218
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2219
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2220
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2221
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2222
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2223
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2224
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2225
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2226
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2227
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2228
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2229
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2230
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads CPU attributes
      PID:2231
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2232
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2233
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2234
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2235
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2236
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:2237
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2238
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      Reads runtime system information
      PID:2239
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2240
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2241
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2242
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:2243
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2244
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2281
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2282
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2283
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2284
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2285
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2286
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2287
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2288
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2289
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2290
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2291
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2292
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2293
- /bin/bash
  /bin/bash -
  2⤵
  PID:2294
- - /usr/bin/sudo
    sudo -S touch .local_24805
    3⤵
    PID:2299
  - - /usr/bin/touch
      touch .local_24805
      4⤵
      Writes file to tmp directory
      PID:2300
- - /usr/bin/sudo
    sudo rm .local_24805
    3⤵
    PID:2304
  - - /usr/bin/rm
      rm .local_24805
      4⤵
      PID:2305
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2312
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2313
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2314
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2315
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2316
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2317
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2318
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2319
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2320
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2321
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2322
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2323
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2324
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2325
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2326
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2327
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2328
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2329
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2330
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2331
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2332
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2333
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2334
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2335
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2336
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:2337
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2338
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2339
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2340
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2341
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2342
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:2343
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2344
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      Reads CPU attributes
      PID:2345
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2346
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2347
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2348
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:2349
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2350
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2387
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2388
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2389
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2390
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2391
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      Reads runtime system information
      PID:2392
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2393
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2394
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2395
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2396
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2397
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2398
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2399
- /usr/bin/free
  free -m
  2⤵
  PID:2400
- /usr/bin/uptime
  uptime
  2⤵
  PID:2401
- /bin/bash
  /bin/bash -
  2⤵
  PID:2633
- - /usr/bin/sudo
    sudo -S touch .local_3783
    3⤵
    PID:2638
  - - /usr/bin/touch
      touch .local_3783
      4⤵
      Writes file to tmp directory
      PID:2639
- - /usr/bin/sudo
    sudo rm .local_3783
    3⤵
    PID:2643
  - - /usr/bin/rm
      rm .local_3783
      4⤵
      PID:2644
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2651
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2652
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2653
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2654
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2655
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2656
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2657
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2658
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2659
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2660
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2661
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2662
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2663
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2664
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2665
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2666
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2667
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2668
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2669
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2670
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2671
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2672
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2673
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2674
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2675
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      Reads CPU attributes
      PID:2676
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2677
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2678
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2679
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads runtime system information
      PID:2680
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2681
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      PID:2682
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2683
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2684
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2685
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2686
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2687
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:2688
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2689
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2726
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2727
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2728
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2729
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2730
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2731
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2732
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2733
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2734
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2735
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2736
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2737
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2738
- /bin/bash
  /bin/bash -
  2⤵
  PID:2739
- - /usr/bin/sudo
    sudo -S touch .local_16608
    3⤵
    PID:2744
  - - /usr/bin/touch
      touch .local_16608
      4⤵
      Writes file to tmp directory
      PID:2745
- - /usr/bin/sudo
    sudo rm .local_16608
    3⤵
    PID:2749
  - - /usr/bin/rm
      rm .local_16608
      4⤵
      PID:2750
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:2757
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:2758
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:2759
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:2760
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:2761
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:2762
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:2763
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:2764
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:2765
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:2766
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:2767
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:2768
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:2769
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:2770
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:2771
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:2772
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:2773
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:2774
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:2775
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:2776
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:2777
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:2778
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:2779
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:2780
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:2781
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:2782
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:2783
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      PID:2784
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:2785
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      PID:2786
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:2787
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads CPU attributes
      PID:2788
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:2789
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:2790
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:2791
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:2792
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:2793
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:2794
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:2795
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:2832
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:2833
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:2834
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:2835
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:2836
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:2837
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:2838
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:2839
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2840
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:2841
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:2842
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:2843
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:2844
- /usr/bin/free
  free -m
  2⤵
  PID:2845
- /usr/bin/uptime
  uptime
  2⤵
  PID:2846
- /bin/bash
  /bin/bash -
  2⤵
  PID:3061
- - /usr/bin/sudo
    sudo -S touch .local_2799
    3⤵
    PID:3066
  - - /usr/bin/touch
      touch .local_2799
      4⤵
      Writes file to tmp directory
      PID:3067
- - /usr/bin/sudo
    sudo rm .local_2799
    3⤵
    PID:3071
  - - /usr/bin/rm
      rm .local_2799
      4⤵
      PID:3072
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:3079
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:3080
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:3081
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:3082
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:3083
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:3084
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:3085
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      PID:3086
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:3087
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:3088
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:3089
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:3090
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:3091
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:3092
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:3093
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:3094
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:3095
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:3096
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:3097
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:3098
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:3099
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:3100
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:3101
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:3102
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:3103
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:3104
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:3105
  - - /usr/bin/pkill
      pkill daemon.i686.mod
      4⤵
      Reads CPU attributes
      PID:3106
- - /usr/bin/sudo
    sudo pkill daemon.armv4l.mod
    3⤵
    PID:3107
  - - /usr/bin/pkill
      pkill daemon.armv4l.mod
      4⤵
      Reads CPU attributes
      PID:3108
- - /usr/bin/sudo
    sudo pkill daemon.mips.mod
    3⤵
    PID:3109
  - - /usr/bin/pkill
      pkill daemon.mips.mod
      4⤵
      Reads runtime system information
      PID:3110
- - /usr/bin/sudo
    sudo pkill daemon.mipsel.mod
    3⤵
    PID:3111
  - - /usr/bin/pkill
      pkill daemon.mipsel.mod
      4⤵
      PID:3112
- - /usr/bin/sudo
    sudo rm -rf /tmp/.xs
    3⤵
    PID:3113
  - - /usr/bin/rm
      rm -rf /tmp/.xs
      4⤵
      PID:3114
- - /usr/bin/sudo
    sudo pkill ld-linux-x86-64
    3⤵
    PID:3115
  - - /usr/bin/pkill
      pkill ld-linux-x86-64
      4⤵
      PID:3116
- - /usr/bin/rm
    rm -rf "/var/tmp/. *"
    3⤵
    PID:3117
- - /usr/bin/sudo
    sudo killall -9 "[atd]"
    3⤵
    PID:3154
  - - /usr/bin/killall
      killall -9 "[atd]"
      4⤵
      PID:3155
- - /usr/bin/sudo
    sudo rm -rf /tmp/.jk
    3⤵
    PID:3156
  - - /usr/bin/rm
      rm -rf /tmp/.jk
      4⤵
      PID:3157
- - /usr/bin/sudo
    sudo killall -9 "[ntpd]"
    3⤵
    PID:3158
  - - /usr/bin/killall
      killall -9 "[ntpd]"
      4⤵
      PID:3159
- - /usr/bin/sudo
    sudo killall -9 "[rpciod]"
    3⤵
    PID:3160
  - - /usr/bin/killall
      killall -9 "[rpciod]"
      4⤵
      PID:3161
- - /usr/bin/sudo
    sudo killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:3162
  - - /usr/bin/killall
      killall -9 "[ext4-dio-unwrit]"
      4⤵
      PID:3163
- - /usr/bin/sudo
    sudo rm -rf "/tmp/.xm*"
    3⤵
    PID:3164
  - - /usr/bin/rm
      rm -rf "/tmp/.xm*"
      4⤵
      PID:3165
- - /usr/bin/pidof
    pidof libexec
    3⤵
    PID:3166
- /bin/bash
  /bin/bash -
  2⤵
  PID:3173
- - /usr/bin/sudo
    sudo -S touch .local_13500
    3⤵
    PID:3178
  - - /usr/bin/touch
      touch .local_13500
      4⤵
      Writes file to tmp directory
      PID:3179
- - /usr/bin/sudo
    sudo rm .local_13500
    3⤵
    PID:3183
  - - /usr/bin/rm
      rm .local_13500
      4⤵
      PID:3184
- - /usr/bin/sudo
    sudo killall -9 bssh
    3⤵
    PID:3191
  - - /usr/bin/killall
      killall -9 bssh
      4⤵
      PID:3192
- - /usr/bin/sudo
    sudo rm -rf /tmp/.an
    3⤵
    PID:3193
  - - /usr/bin/rm
      rm -rf /tmp/.an
      4⤵
      PID:3194
- - /usr/bin/sudo
    sudo killall -9 xm64
    3⤵
    PID:3195
  - - /usr/bin/killall
      killall -9 xm64
      4⤵
      PID:3196
- - /usr/bin/sudo
    sudo killall -9 rpc.idmapd
    3⤵
    PID:3197
  - - /usr/bin/killall
      killall -9 rpc.idmapd
      4⤵
      Reads runtime system information
      PID:3198
- - /usr/bin/sudo
    sudo rm -rf /tmp/.m2
    3⤵
    PID:3199
  - - /usr/bin/rm
      rm -rf /tmp/.m2
      4⤵
      PID:3200
- - /usr/bin/sudo
    sudo killall -9 xorgg
    3⤵
    PID:3201
  - - /usr/bin/killall
      killall -9 xorgg
      4⤵
      PID:3202
- - /usr/bin/sudo
    sudo rm -rf /tmp/seconfig
    3⤵
    PID:3203
  - - /usr/bin/rm
      rm -rf /tmp/seconfig
      4⤵
      PID:3204
- - /usr/bin/sudo
    sudo killall -9 crond64
    3⤵
    PID:3205
  - - /usr/bin/killall
      killall -9 crond64
      4⤵
      PID:3206
- - /usr/bin/sudo
    sudo killall -9 tsm
    3⤵
    PID:3207
  - - /usr/bin/killall
      killall -9 tsm
      4⤵
      PID:3208
- - /usr/bin/sudo
    sudo rm -rf /tmp/.ssh
    3⤵
    PID:3209
  - - /usr/bin/rm
      rm -rf /tmp/.ssh
      4⤵
      PID:3210
- - /usr/bin/sudo
    sudo rm -rf /tmp/.java
    3⤵
    PID:3211
  - - /usr/bin/rm
      rm -rf /tmp/.java
      4⤵
      PID:3212
- - /usr/bin/sudo
    sudo rm -rf /tmp/.iolanda
    3⤵
    PID:3213
  - - /usr/bin/rm
      rm -rf /tmp/.iolanda
      4⤵
      PID:3214
- - /usr/bin/sudo
    sudo pkill test.mod
    3⤵
    PID:3215
  - - /usr/bin/pkill
      pkill test.mod
      4⤵
      PID:3216
- - /usr/bin/sudo
    sudo pkill daemon.i686.mod
    3⤵
    PID:3217

/usr/bin/wc
wc -l
1⤵
PID:1979

/usr/bin/which
which sudo
1⤵
PID:1978

/usr/bin/grep
grep -c root
1⤵
PID:1985

/usr/bin/ls
ls -l .local_28961
1⤵
PID:1984

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:1992

/usr/bin/grep
grep -v grep
1⤵
PID:1991

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:1990

/usr/bin/sudo
sudo ps auxff
1⤵
PID:1989
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads runtime system information
  PID:1993

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2039

/usr/bin/grep
grep -v grep
1⤵
PID:2038

/usr/bin/grep
grep xmr
1⤵
PID:2037

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2036
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2040

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2045

/usr/bin/grep
grep -v grep
1⤵
PID:2044

/usr/bin/grep
grep cryptonight
1⤵
PID:2043

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2042
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2046

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2051

/usr/bin/grep
grep -v grep
1⤵
PID:2050

/usr/bin/grep
grep stratum
1⤵
PID:2049

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2048
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2052

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2057

/usr/bin/grep
grep -v grep
1⤵
PID:2056

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2055

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2054
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2058

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2063

/usr/bin/grep
grep -v grep
1⤵
PID:2062

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2061

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2060
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2064

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2069

/usr/bin/grep
grep -v grep
1⤵
PID:2068

/usr/bin/grep
grep xm64
1⤵
PID:2067

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2066
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2070

/usr/bin/wc
wc -l
1⤵
PID:2191

/usr/bin/which
which sudo
1⤵
PID:2190

/usr/bin/grep
grep -c root
1⤵
PID:2197

/usr/bin/ls
ls -l .local_22687
1⤵
PID:2196

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2204

/usr/bin/grep
grep -v grep
1⤵
PID:2203

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2202

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2201
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads runtime system information
  PID:2205

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2249

/usr/bin/grep
grep -v grep
1⤵
PID:2248

/usr/bin/grep
grep xmr
1⤵
PID:2247

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2246
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2250

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2255

/usr/bin/grep
grep -v grep
1⤵
PID:2254

/usr/bin/grep
grep cryptonight
1⤵
PID:2253

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2252
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2256

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2261

/usr/bin/grep
grep -v grep
1⤵
PID:2260

/usr/bin/grep
grep stratum
1⤵
PID:2259

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2258
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2262

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2267

/usr/bin/grep
grep -v grep
1⤵
PID:2266

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2265

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2264
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2268

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2273

/usr/bin/grep
grep -v grep
1⤵
PID:2272

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2271

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2270
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2274

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2279

/usr/bin/grep
grep -v grep
1⤵
PID:2278

/usr/bin/grep
grep xm64
1⤵
PID:2277

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2276
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2280

/usr/bin/wc
wc -l
1⤵
PID:2297

/usr/bin/which
which sudo
1⤵
PID:2296

/usr/bin/grep
grep -c root
1⤵
PID:2303

/usr/bin/ls
ls -l .local_24805
1⤵
PID:2302

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2310

/usr/bin/grep
grep -v grep
1⤵
PID:2309

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2308

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2307
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  PID:2311

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2355

/usr/bin/grep
grep -v grep
1⤵
PID:2354

/usr/bin/grep
grep xmr
1⤵
PID:2353

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2352
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2356

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2361

/usr/bin/grep
grep -v grep
1⤵
PID:2360

/usr/bin/grep
grep cryptonight
1⤵
PID:2359

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2358
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2362

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2367

/usr/bin/grep
grep -v grep
1⤵
PID:2366

/usr/bin/grep
grep stratum
1⤵
PID:2365

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2364
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2368

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2373

/usr/bin/grep
grep -v grep
1⤵
PID:2372

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2371

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2370
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2374

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2379

/usr/bin/grep
grep -v grep
1⤵
PID:2378

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2377

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2376
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2380

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2385

/usr/bin/grep
grep -v grep
1⤵
PID:2384

/usr/bin/grep
grep xm64
1⤵
PID:2383

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2382
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2386

/bin/bash
/bin/bash -
1⤵
PID:2402
- /usr/bin/sudo
  sudo -S touch .local_21495
  2⤵
  PID:2407
- - /usr/bin/touch
    touch .local_21495
    3⤵
    - Writes file to tmp directory
    PID:2408
- /usr/bin/sudo
  sudo rm .local_21495
  2⤵
  PID:2412
- - /usr/bin/rm
    rm .local_21495
    3⤵
    PID:2413
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2420
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2421
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2422
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2423
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2424
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2425
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2426
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2427
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2428
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2429
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2430
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2431
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2432
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2433
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2434
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2435
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2436
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2437
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2438
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2439
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2440
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2441
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2442
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2443
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2444
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:2445
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2446
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2447
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2448
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    - Reads runtime system information
    PID:2449
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2450
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:2451
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2452
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    PID:2453
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2454
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2455
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2456
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    - Reads CPU attributes
    PID:2457
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2458
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2495
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    - Reads runtime system information
    PID:2496
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2497
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2498
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2499
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2500
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2501
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2502
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2503
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2504
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2505
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2506
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2507

/usr/bin/wc
wc -l
1⤵
PID:2405

/usr/bin/which
which sudo
1⤵
PID:2404

/usr/bin/grep
grep -c root
1⤵
PID:2411

/usr/bin/ls
ls -l .local_21495
1⤵
PID:2410

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2418

/usr/bin/grep
grep -v grep
1⤵
PID:2417

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2416

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2415
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2419

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2463

/usr/bin/grep
grep -v grep
1⤵
PID:2462

/usr/bin/grep
grep xmr
1⤵
PID:2461

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2460
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2464

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2469

/usr/bin/grep
grep -v grep
1⤵
PID:2468

/usr/bin/grep
grep cryptonight
1⤵
PID:2467

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2466
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2470

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2475

/usr/bin/grep
grep -v grep
1⤵
PID:2474

/usr/bin/grep
grep stratum
1⤵
PID:2473

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2472
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2476

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2481

/usr/bin/grep
grep -v grep
1⤵
PID:2480

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2479

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2478
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2482

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2487

/usr/bin/grep
grep -v grep
1⤵
PID:2486

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2485

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2484
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2488

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2493

/usr/bin/grep
grep -v grep
1⤵
PID:2492

/usr/bin/grep
grep xm64
1⤵
PID:2491

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2490
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2494

/bin/bash
/bin/bash -
1⤵
PID:2525
- /usr/bin/sudo
  sudo -S touch .local_8931
  2⤵
  PID:2530
- - /usr/bin/touch
    touch .local_8931
    3⤵
    - Writes file to tmp directory
    PID:2531
- /usr/bin/sudo
  sudo rm .local_8931
  2⤵
  PID:2535
- - /usr/bin/rm
    rm .local_8931
    3⤵
    PID:2536
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2543
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2544
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2545
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2546
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2547
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2548
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2549
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2550
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2551
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2552
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2553
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2554
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2555
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2556
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2557
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2558
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2559
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2560
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2561
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2562
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2563
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2564
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2565
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2566
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2567
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:2568
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2569
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2570
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2571
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    - Reads CPU attributes
    PID:2572
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2573
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:2574
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2575
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    PID:2576
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2577
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2578
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2579
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:2580
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2581
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2618
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:2619
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2620
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2621
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2622
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2623
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2624
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2625
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2626
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2627
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2628
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2629
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2630

/usr/bin/wc
wc -l
1⤵
PID:2528

/usr/bin/which
which sudo
1⤵
PID:2527

/usr/bin/grep
grep -c root
1⤵
PID:2534

/usr/bin/ls
ls -l .local_8931
1⤵
PID:2533

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2541

/usr/bin/grep
grep -v grep
1⤵
PID:2540

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2539

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2538
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  PID:2542

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2586

/usr/bin/grep
grep -v grep
1⤵
PID:2585

/usr/bin/grep
grep xmr
1⤵
PID:2584

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2583
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2587

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2592

/usr/bin/grep
grep -v grep
1⤵
PID:2591

/usr/bin/grep
grep cryptonight
1⤵
PID:2590

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2589
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2593

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2598

/usr/bin/grep
grep -v grep
1⤵
PID:2597

/usr/bin/grep
grep stratum
1⤵
PID:2596

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2595
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2599

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2604

/usr/bin/grep
grep -v grep
1⤵
PID:2603

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2602

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2601
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2605

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2610

/usr/bin/grep
grep -v grep
1⤵
PID:2609

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2608

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2607
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2611

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2616

/usr/bin/grep
grep -v grep
1⤵
PID:2615

/usr/bin/grep
grep xm64
1⤵
PID:2614

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2613
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2617

/usr/bin/free
free -m
1⤵
PID:2631

/usr/bin/uptime
uptime
1⤵
PID:2632

/usr/bin/wc
wc -l
1⤵
PID:2636

/usr/bin/which
which sudo
1⤵
PID:2635

/usr/bin/grep
grep -c root
1⤵
PID:2642

/usr/bin/ls
ls -l .local_3783
1⤵
PID:2641

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2649

/usr/bin/grep
grep -v grep
1⤵
PID:2648

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2647

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2646
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2650

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2694

/usr/bin/grep
grep -v grep
1⤵
PID:2693

/usr/bin/grep
grep xmr
1⤵
PID:2692

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2691
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2695

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2700

/usr/bin/grep
grep -v grep
1⤵
PID:2699

/usr/bin/grep
grep cryptonight
1⤵
PID:2698

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2697
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2701

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2706

/usr/bin/grep
grep -v grep
1⤵
PID:2705

/usr/bin/grep
grep stratum
1⤵
PID:2704

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2703
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2707

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2712

/usr/bin/grep
grep -v grep
1⤵
PID:2711

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2710

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2709
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2713

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2718

/usr/bin/grep
grep -v grep
1⤵
PID:2717

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2716

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2715
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2719

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2724

/usr/bin/grep
grep -v grep
1⤵
PID:2723

/usr/bin/grep
grep xm64
1⤵
PID:2722

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2721
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2725

/usr/bin/wc
wc -l
1⤵
PID:2742

/usr/bin/which
which sudo
1⤵
PID:2741

/usr/bin/grep
grep -c root
1⤵
PID:2748

/usr/bin/ls
ls -l .local_16608
1⤵
PID:2747

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2755

/usr/bin/grep
grep -v grep
1⤵
PID:2754

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2753

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2752
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2756

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2800

/usr/bin/grep
grep -v grep
1⤵
PID:2799

/usr/bin/grep
grep xmr
1⤵
PID:2798

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2797
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2801

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2806

/usr/bin/grep
grep -v grep
1⤵
PID:2805

/usr/bin/grep
grep cryptonight
1⤵
PID:2804

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2803
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2807

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2812

/usr/bin/grep
grep -v grep
1⤵
PID:2811

/usr/bin/grep
grep stratum
1⤵
PID:2810

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2809
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2813

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2818

/usr/bin/grep
grep -v grep
1⤵
PID:2817

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2816

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2815
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2819

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2824

/usr/bin/grep
grep -v grep
1⤵
PID:2823

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2822

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2821
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2825

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2830

/usr/bin/grep
grep -v grep
1⤵
PID:2829

/usr/bin/grep
grep xm64
1⤵
PID:2828

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2827
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2831

/bin/bash
/bin/bash -
1⤵
PID:2847
- /usr/bin/sudo
  sudo -S touch .local_6662
  2⤵
  PID:2852
- - /usr/bin/touch
    touch .local_6662
    3⤵
    - Writes file to tmp directory
    PID:2853
- /usr/bin/sudo
  sudo rm .local_6662
  2⤵
  PID:2857
- - /usr/bin/rm
    rm .local_6662
    3⤵
    PID:2858
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2865
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2866
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2867
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2868
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2869
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2870
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2871
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2872
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2873
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2874
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2875
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2876
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2877
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2878
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2879
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2880
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2881
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2882
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2883
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2884
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2885
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2886
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2887
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2888
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2889
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:2890
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2891
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2892
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2893
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    PID:2894
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:2895
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:2896
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:2897
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    PID:2898
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:2899
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:2900
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:2901
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:2902
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:2903
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:2940
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:2941
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:2942
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:2943
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:2944
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:2945
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:2946
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:2947
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:2948
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:2949
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:2950
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:2951
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:2952

/usr/bin/wc
wc -l
1⤵
PID:2850

/usr/bin/which
which sudo
1⤵
PID:2849

/usr/bin/grep
grep -c root
1⤵
PID:2856

/usr/bin/ls
ls -l .local_6662
1⤵
PID:2855

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2863

/usr/bin/grep
grep -v grep
1⤵
PID:2862

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2861

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2860
- /usr/bin/ps
  ps auxff
  2⤵
  PID:2864

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2908

/usr/bin/grep
grep -v grep
1⤵
PID:2907

/usr/bin/grep
grep xmr
1⤵
PID:2906

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2905
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2909

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2914

/usr/bin/grep
grep -v grep
1⤵
PID:2913

/usr/bin/grep
grep cryptonight
1⤵
PID:2912

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2911
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2915

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2920

/usr/bin/grep
grep -v grep
1⤵
PID:2919

/usr/bin/grep
grep stratum
1⤵
PID:2918

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2917
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2921

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2926

/usr/bin/grep
grep -v grep
1⤵
PID:2925

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:2924

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2923
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2927

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2932

/usr/bin/grep
grep -v grep
1⤵
PID:2931

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:2930

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2929
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2933

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2938

/usr/bin/grep
grep -v grep
1⤵
PID:2937

/usr/bin/grep
grep xm64
1⤵
PID:2936

/usr/bin/sudo
sudo ps auxf
1⤵
PID:2935
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2939

/bin/bash
/bin/bash -
1⤵
PID:2953
- /usr/bin/sudo
  sudo -S touch .local_12335
  2⤵
  PID:2958
- - /usr/bin/touch
    touch .local_12335
    3⤵
    - Writes file to tmp directory
    PID:2959
- /usr/bin/sudo
  sudo rm .local_12335
  2⤵
  PID:2963
- - /usr/bin/rm
    rm .local_12335
    3⤵
    PID:2964
- /usr/bin/sudo
  sudo killall -9 bssh
  2⤵
  PID:2971
- - /usr/bin/killall
    killall -9 bssh
    3⤵
    PID:2972
- /usr/bin/sudo
  sudo rm -rf /tmp/.an
  2⤵
  PID:2973
- - /usr/bin/rm
    rm -rf /tmp/.an
    3⤵
    PID:2974
- /usr/bin/sudo
  sudo killall -9 xm64
  2⤵
  PID:2975
- - /usr/bin/killall
    killall -9 xm64
    3⤵
    PID:2976
- /usr/bin/sudo
  sudo killall -9 rpc.idmapd
  2⤵
  PID:2977
- - /usr/bin/killall
    killall -9 rpc.idmapd
    3⤵
    PID:2978
- /usr/bin/sudo
  sudo rm -rf /tmp/.m2
  2⤵
  PID:2979
- - /usr/bin/rm
    rm -rf /tmp/.m2
    3⤵
    PID:2980
- /usr/bin/sudo
  sudo killall -9 xorgg
  2⤵
  PID:2981
- - /usr/bin/killall
    killall -9 xorgg
    3⤵
    PID:2982
- /usr/bin/sudo
  sudo rm -rf /tmp/seconfig
  2⤵
  PID:2983
- - /usr/bin/rm
    rm -rf /tmp/seconfig
    3⤵
    PID:2984
- /usr/bin/sudo
  sudo killall -9 crond64
  2⤵
  PID:2985
- - /usr/bin/killall
    killall -9 crond64
    3⤵
    PID:2986
- /usr/bin/sudo
  sudo killall -9 tsm
  2⤵
  PID:2987
- - /usr/bin/killall
    killall -9 tsm
    3⤵
    PID:2988
- /usr/bin/sudo
  sudo rm -rf /tmp/.ssh
  2⤵
  PID:2989
- - /usr/bin/rm
    rm -rf /tmp/.ssh
    3⤵
    PID:2990
- /usr/bin/sudo
  sudo rm -rf /tmp/.java
  2⤵
  PID:2991
- - /usr/bin/rm
    rm -rf /tmp/.java
    3⤵
    PID:2992
- /usr/bin/sudo
  sudo rm -rf /tmp/.iolanda
  2⤵
  PID:2993
- - /usr/bin/rm
    rm -rf /tmp/.iolanda
    3⤵
    PID:2994
- /usr/bin/sudo
  sudo pkill test.mod
  2⤵
  PID:2995
- - /usr/bin/pkill
    pkill test.mod
    3⤵
    PID:2996
- /usr/bin/sudo
  sudo pkill daemon.i686.mod
  2⤵
  PID:2997
- - /usr/bin/pkill
    pkill daemon.i686.mod
    3⤵
    PID:2998
- /usr/bin/sudo
  sudo pkill daemon.armv4l.mod
  2⤵
  PID:2999
- - /usr/bin/pkill
    pkill daemon.armv4l.mod
    3⤵
    PID:3000
- /usr/bin/sudo
  sudo pkill daemon.mips.mod
  2⤵
  PID:3001
- - /usr/bin/pkill
    pkill daemon.mips.mod
    3⤵
    PID:3002
- /usr/bin/sudo
  sudo pkill daemon.mipsel.mod
  2⤵
  PID:3003
- - /usr/bin/pkill
    pkill daemon.mipsel.mod
    3⤵
    PID:3004
- /usr/bin/sudo
  sudo rm -rf /tmp/.xs
  2⤵
  PID:3005
- - /usr/bin/rm
    rm -rf /tmp/.xs
    3⤵
    PID:3006
- /usr/bin/sudo
  sudo pkill ld-linux-x86-64
  2⤵
  PID:3007
- - /usr/bin/pkill
    pkill ld-linux-x86-64
    3⤵
    PID:3008
- /usr/bin/rm
  rm -rf "/var/tmp/. *"
  2⤵
  PID:3009
- /usr/bin/sudo
  sudo killall -9 "[atd]"
  2⤵
  PID:3046
- - /usr/bin/killall
    killall -9 "[atd]"
    3⤵
    PID:3047
- /usr/bin/sudo
  sudo rm -rf /tmp/.jk
  2⤵
  PID:3048
- - /usr/bin/rm
    rm -rf /tmp/.jk
    3⤵
    PID:3049
- /usr/bin/sudo
  sudo killall -9 "[ntpd]"
  2⤵
  PID:3050
- - /usr/bin/killall
    killall -9 "[ntpd]"
    3⤵
    PID:3051
- /usr/bin/sudo
  sudo killall -9 "[rpciod]"
  2⤵
  PID:3052
- - /usr/bin/killall
    killall -9 "[rpciod]"
    3⤵
    PID:3053
- /usr/bin/sudo
  sudo killall -9 "[ext4-dio-unwrit]"
  2⤵
  PID:3054
- - /usr/bin/killall
    killall -9 "[ext4-dio-unwrit]"
    3⤵
    PID:3055
- /usr/bin/sudo
  sudo rm -rf "/tmp/.xm*"
  2⤵
  PID:3056
- - /usr/bin/rm
    rm -rf "/tmp/.xm*"
    3⤵
    PID:3057
- /usr/bin/pidof
  pidof libexec
  2⤵
  PID:3058

/usr/bin/wc
wc -l
1⤵
PID:2956

/usr/bin/which
which sudo
1⤵
PID:2955

/usr/bin/grep
grep -c root
1⤵
PID:2962

/usr/bin/ls
ls -l .local_12335
1⤵
PID:2961

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:2969

/usr/bin/grep
grep -v grep
1⤵
PID:2968

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:2967

/usr/bin/sudo
sudo ps auxff
1⤵
PID:2966
- /usr/bin/ps
  ps auxff
  2⤵
  - Reads CPU attributes
  PID:2970

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3014

/usr/bin/grep
grep -v grep
1⤵
PID:3013

/usr/bin/grep
grep xmr
1⤵
PID:3012

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3011
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3015

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3020

/usr/bin/grep
grep -v grep
1⤵
PID:3019

/usr/bin/grep
grep cryptonight
1⤵
PID:3018

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3017
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3021

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3026

/usr/bin/grep
grep -v grep
1⤵
PID:3025

/usr/bin/grep
grep stratum
1⤵
PID:3024

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3023
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:3027

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3032

/usr/bin/grep
grep -v grep
1⤵
PID:3031

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:3030

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3029
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:3033

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3038

/usr/bin/grep
grep -v grep
1⤵
PID:3037

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:3036

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3035
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3039

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3044

/usr/bin/grep
grep -v grep
1⤵
PID:3043

/usr/bin/grep
grep xm64
1⤵
PID:3042

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3041
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3045

/usr/bin/free
free -m
1⤵
- Reads CPU attributes
PID:3059

/usr/bin/uptime
uptime
1⤵
PID:3060

/usr/bin/wc
wc -l
1⤵
PID:3064

/usr/bin/which
which sudo
1⤵
PID:3063

/usr/bin/grep
grep -c root
1⤵
PID:3070

/usr/bin/ls
ls -l .local_2799
1⤵
PID:3069

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3077

/usr/bin/grep
grep -v grep
1⤵
PID:3076

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:3075

/usr/bin/sudo
sudo ps auxff
1⤵
PID:3074
- /usr/bin/ps
  ps auxff
  2⤵
  PID:3078

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3122

/usr/bin/grep
grep -v grep
1⤵
PID:3121

/usr/bin/grep
grep xmr
1⤵
PID:3120

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3119
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3123

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3128

/usr/bin/grep
grep -v grep
1⤵
PID:3127

/usr/bin/grep
grep cryptonight
1⤵
PID:3126

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3125
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3129

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3134

/usr/bin/grep
grep -v grep
1⤵
PID:3133

/usr/bin/grep
grep stratum
1⤵
PID:3132

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3131
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3135

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3140

/usr/bin/grep
grep -v grep
1⤵
PID:3139

/usr/bin/grep
grep dbus-daemon--system
1⤵
PID:3138

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3137
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:3141

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3146

/usr/bin/grep
grep -v grep
1⤵
PID:3145

/usr/bin/grep
grep "\\[\\]"
1⤵
PID:3144

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3143
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3147

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3152

/usr/bin/grep
grep -v grep
1⤵
PID:3151

/usr/bin/grep
grep xm64
1⤵
PID:3150

/usr/bin/sudo
sudo ps auxf
1⤵
PID:3149
- /usr/bin/ps
  ps auxf
  2⤵
  PID:3153

/usr/bin/wc
wc -l
1⤵
PID:3176

/usr/bin/which
which sudo
1⤵
PID:3175

/usr/bin/grep
grep -c root
1⤵
PID:3182

/usr/bin/ls
ls -l .local_13500
1⤵
PID:3181

/usr/bin/awk
awk "{ print \$2 }"
1⤵
PID:3189

/usr/bin/grep
grep -v grep
1⤵
PID:3188

/usr/bin/grep
grep "./crond -t=all"
1⤵
PID:3187

/usr/bin/sudo
sudo ps auxff
1⤵
PID:3186
- /usr/bin/ps
  ps auxff
  2⤵
  PID:3190

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys

Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads