471c70b6764c6f719bab35b92678e323d53928a14617737a6fc994dc27d2a12e

General

Target

5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
Size

8.1MB
MD5

e0efd46445731c6c35deffe8d9e47888
SHA1

219a2cc1df97fe0b51244f7238aa4114e858f1d0
SHA256

471c70b6764c6f719bab35b92678e323d53928a14617737a6fc994dc27d2a12e
SHA512

92a5438489316593f45f4afeca6e2a1654e75480f4670f58df5cb63091ec52dd8279b156a3949e2243dc350dbe31220b2ac433abb4250ddc238f70d295d1949d
SSDEEP

49152:az1q8M+srb/TIvO90dL3BmAFd4A64nsfJrYJaRM6CxN4+WqFottdpaCEy4SahdBV:auM2GebQyF66rNdvEoS5

Score

7^/10

antivm infostealer

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

pid

1479
Reads EFI boot settings 1 IoCs
Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
infostealer

Processes:

journalctl

description ioc process

File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 journalctl
Attempts to change immutable files 17 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.

Processes:

chattrchattrchattrchattrchattrchattr

pid process

1507 chattr
2353 chattr
3110
4787
5497
2261 chattr
3120
3608
4781
1501 chattr
1503 chattr
2387 chattr
3945
3115
3865
3870
4792
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat
Enumerates running processes
Discovers information about currently running processes on the system

pid
1479

pid	process
1507	chattr
2353	chattr
3110
4787
5497
2261	chattr
3120
3608
4781
1501	chattr
1503	chattr
2387	chattr
3945
3115
3865
3870
4792

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 30 IoCs

System Information Discovery

T1082

Processes:

uptimefreefreefreeuptimefreeuptimeuptime

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	uptime

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

journalctl5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5

description	ioc	process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

ididididid5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5uptimeididididid

description	ioc	process
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/1421/stat
File opened for reading	/proc/82/stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/1471/cmdline
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/1042/cmdline
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/799/cmdline
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/174/cmdline
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/1097/cmdline
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/72/stat
File opened for reading	/proc/73/stat
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/270/stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/1476/cmdline	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/1445/stat
File opened for reading	/proc/926/stat
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/86/stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/1113/cmdline
File opened for reading	/proc/85/stat
File opened for reading	/proc/985/stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems
File opened for reading	/proc/filesystems	id

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

description ioc

File opened for modification /tmp/.ssh/authorized_keys

description	ioc
File opened for modification	/tmp/.ssh/authorized_keys

/tmp/5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
/tmp/5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1471

/usr/bin/uname
uname -a
2⤵
PID:1481

/usr/bin/cat
cat /etc/issue
2⤵
PID:1482

/usr/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1486

/bin/sh
/bin/sh -
2⤵
PID:1488

/usr/bin/whoami
whoami
3⤵
PID:1489

/bin/sh
/bin/sh -
2⤵
PID:1490

/bin/sh
/bin/sh -
1⤵
PID:1492

/usr/bin/id
id -n -u 0
2⤵
PID:1494

/usr/bin/free
free -h
1⤵
- Reads CPU attributes
PID:1493

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
PID:1495

/bin/sh
/bin/sh -
1⤵
PID:1496

/bin/sh
/bin/sh -
1⤵
PID:1497

/bin/sh
/bin/sh -
1⤵
PID:1498

/usr/bin/chattr
chattr -ia .ssh/authorized_keys
2⤵
- Attempts to change immutable files
PID:1501

/bin/sh
/bin/sh -
1⤵
PID:1499

/usr/bin/id
id -n -u 0
2⤵
PID:1502

/bin/sh
/bin/sh -
1⤵
PID:1500

/usr/bin/chattr
chattr -ia .ssh/authorized_keys
2⤵
- Attempts to change immutable files
PID:1503

/bin/sh
/bin/sh -
1⤵
PID:1504

/usr/bin/chattr
chattr +ia .ssh/authorized_keys
2⤵
- Attempts to change immutable files
PID:1507

/usr/bin/journalctl
journalctl -S "@0" -u sshd
1⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
PID:1505

/bin/sh
/bin/sh -
1⤵
PID:1506

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:1508

/bin/sh
/bin/sh -
1⤵
PID:1509

/usr/bin/id
id -n -u 0
2⤵
PID:1510

/usr/bin/cat
cat "/var/log/auth*"
1⤵
PID:1511

/usr/bin/zcat
zcat "/var/log/auth*"
1⤵
PID:1512

/usr/local/sbin/gzip
gzip -cd "/var/log/auth*"
1⤵
PID:1512

/usr/local/bin/gzip
gzip -cd "/var/log/auth*"
1⤵
PID:1512

/usr/sbin/gzip
gzip -cd "/var/log/auth*"
1⤵
PID:1512

/usr/bin/gzip
gzip -cd "/var/log/auth*"
1⤵
PID:1512

/bin/sh
/bin/sh -
1⤵
PID:1513

/usr/bin/cat
cat "~/.ssh/known_hosts"
2⤵
PID:1515

/bin/sh
/bin/sh -
1⤵
PID:1514

/usr/bin/id
id -n -u 0
2⤵
PID:1516

/bin/sh
/bin/sh -
1⤵
PID:1523

/usr/bin/grep
grep -E "(scp|ssh)"
2⤵
PID:1528

/bin/sh
/bin/sh -
1⤵
PID:1527

/usr/bin/id
id -n -u 0
2⤵
PID:1529

/bin/sh
/bin/sh -
1⤵
PID:1530

/usr/bin/id
id -n -u 0
2⤵
PID:1531

/bin/sh
/bin/sh -
1⤵
PID:1532

/usr/bin/id
id -n -u 0
2⤵
PID:1533

/bin/sh
/bin/sh -
1⤵
PID:1534

/usr/bin/id
id -n -u 0
2⤵
PID:1535

/bin/sh
/bin/sh -
1⤵
PID:1536

/usr/bin/id
id -n -u 0
2⤵
PID:1537

/bin/sh
/bin/sh -
1⤵
PID:1538

/usr/bin/id
id -n -u 0
2⤵
PID:1539

/bin/sh
/bin/sh -
1⤵
PID:1541

/usr/bin/id
id -n -u 0
2⤵
PID:1542

/bin/sh
/bin/sh -
1⤵
PID:1543

/usr/bin/id
id -n -u 0
2⤵
PID:1544

/bin/sh
/bin/sh -
1⤵
PID:1545

/usr/bin/id
id -n -u 0
2⤵
PID:1546

/bin/sh
/bin/sh -
1⤵
PID:1547

/usr/bin/id
id -n -u 0
2⤵
PID:1548

/bin/sh
/bin/sh -
1⤵
PID:1549

/usr/bin/id
id -n -u 0
2⤵
PID:1550

/bin/sh
/bin/sh -
1⤵
PID:1551

/usr/bin/id
id -n -u 0
2⤵
PID:1552

/bin/sh
/bin/sh -
1⤵
PID:1553

/usr/bin/id
id -n -u 0
2⤵
PID:1556

/bin/sh
/bin/sh -
1⤵
PID:1558

/usr/bin/id
id -n -u 0
2⤵
PID:1559

/bin/sh
/bin/sh -
1⤵
PID:1561

/usr/bin/id
id -n -u 0
2⤵
PID:1563

/bin/sh
/bin/sh -
1⤵
PID:1566

/usr/bin/id
id -n -u 0
2⤵
PID:1567

/bin/sh
/bin/sh -
1⤵
PID:1570

/usr/bin/id
id -n -u 0
2⤵
PID:1571

/bin/sh
/bin/sh -
1⤵
PID:1573

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:1574

/bin/sh
/bin/sh -
1⤵
PID:1577

/usr/bin/id
id -n -u 0
2⤵
PID:1578

/bin/sh
/bin/sh -
1⤵
PID:1581

/usr/bin/id
id -n -u 0
2⤵
PID:1582

/bin/sh
/bin/sh -
1⤵
PID:1584

/usr/bin/id
id -n -u 0
2⤵
PID:1586

/bin/sh
/bin/sh -
1⤵
PID:1588

/usr/bin/id
id -n -u 0
2⤵
PID:1589

/bin/sh
/bin/sh -
1⤵
PID:1590

/usr/bin/id
id -n -u 0
2⤵
PID:1591

/bin/sh
/bin/sh -
1⤵
PID:1592

/usr/bin/id
id -n -u 0
2⤵
PID:1593

/bin/sh
/bin/sh -
1⤵
PID:1594

/usr/bin/id
id -n -u 0
2⤵
PID:1595

/bin/sh
/bin/sh -
1⤵
PID:1596

/usr/bin/id
id -n -u 0
2⤵
PID:1597

/bin/sh
/bin/sh -
1⤵
PID:1598

/usr/bin/id
id -n -u 0
2⤵
PID:1599

/bin/sh
/bin/sh -
1⤵
PID:1600

/usr/bin/id
id -n -u 0
2⤵
PID:1601

/bin/sh
/bin/sh -
1⤵
PID:1603

/usr/bin/id
id -n -u 0
2⤵
PID:1605

/bin/sh
/bin/sh -
1⤵
PID:1607

/usr/bin/id
id -n -u 0
2⤵
PID:1612

/bin/sh
/bin/sh -
1⤵
PID:1619

/usr/bin/id
id -n -u 0
2⤵
PID:1620

/bin/sh
/bin/sh -
1⤵
PID:1622

/usr/bin/id
id -n -u 0
2⤵
PID:1623

/bin/sh
/bin/sh -
1⤵
PID:1624

/usr/bin/id
id -n -u 123
2⤵
PID:1625

/bin/sh
/bin/sh -
1⤵
PID:1628

/usr/bin/id
id -n -u 0
2⤵
PID:1629

/bin/sh
/bin/sh -
1⤵
PID:1630

/usr/bin/id
id -n -u 0
2⤵
PID:1631

/bin/sh
/bin/sh -
1⤵
PID:1632

/usr/bin/id
id -n -u 0
2⤵
PID:1633

/bin/sh
/bin/sh -
1⤵
PID:1634

/usr/bin/id
id -n -u 0
2⤵
PID:1635

/bin/sh
/bin/sh -
1⤵
PID:1636

/usr/bin/id
id -n -u 0
2⤵
PID:1637

/bin/sh
/bin/sh -
1⤵
PID:1638

/usr/bin/id
id -n -u 0
2⤵
PID:1639

/bin/sh
/bin/sh -
1⤵
PID:1640

/usr/bin/id
id -n -u 0
2⤵
PID:1641

/bin/sh
/bin/sh -
1⤵
PID:1642

/usr/bin/id
id -n -u 0
2⤵
PID:1643

/bin/sh
/bin/sh -
1⤵
PID:1644

/usr/bin/id
id -n -u 0
2⤵
PID:1645

/bin/sh
/bin/sh -
1⤵
PID:1646

/usr/bin/id
id -n -u 0
2⤵
PID:1647

/bin/sh
/bin/sh -
1⤵
PID:1648

/usr/bin/id
id -n -u 0
2⤵
PID:1649

/bin/sh
/bin/sh -
1⤵
PID:1652

/usr/bin/id
id -n -u 0
2⤵
PID:1653

/bin/sh
/bin/sh -
1⤵
PID:1654

/usr/bin/id
id -n -u 0
2⤵
PID:1655

/bin/sh
/bin/sh -
1⤵
PID:1656

/usr/bin/id
id -n -u 0
2⤵
PID:1660

/bin/sh
/bin/sh -
1⤵
PID:1663

/usr/bin/id
id -n -u 0
2⤵
PID:1667

/bin/sh
/bin/sh -
1⤵
PID:1670

/usr/bin/id
id -n -u 0
2⤵
PID:1672

/bin/sh
/bin/sh -
1⤵
PID:1674

/usr/bin/id
id -n -u 0
2⤵
PID:1676

/bin/sh
/bin/sh -
1⤵
PID:1679

/usr/bin/id
id -n -u 0
2⤵
PID:1682

/bin/sh
/bin/sh -
1⤵
PID:1685

/usr/bin/id
id -n -u 0
2⤵
PID:1686

/bin/sh
/bin/sh -
1⤵
PID:1690

/usr/bin/id
id -n -u 0
2⤵
PID:1692

/bin/sh
/bin/sh -
1⤵
PID:1699

/usr/bin/id
id -n -u 0
2⤵
PID:1704

/bin/sh
/bin/sh -
1⤵
PID:1709

/usr/bin/id
id -n -u 0
2⤵
PID:1710

/bin/sh
/bin/sh -
1⤵
PID:1714

/usr/bin/id
id -n -u 0
2⤵
PID:1715

/bin/sh
/bin/sh -
1⤵
PID:1716

/usr/bin/id
id -n -u 0
2⤵
PID:1717

/bin/sh
/bin/sh -
1⤵
PID:1718

/usr/bin/id
id -n -u 121
2⤵
PID:1719

/bin/sh
/bin/sh -
1⤵
PID:1720

/usr/bin/id
id -n -u 0
2⤵
PID:1721

/bin/sh
/bin/sh -
1⤵
PID:1722

/usr/bin/id
id -n -u 0
2⤵
PID:1723

/bin/sh
/bin/sh -
1⤵
PID:1724

/usr/bin/id
id -n -u 0
2⤵
PID:1725

/bin/sh
/bin/sh -
1⤵
PID:1726

/usr/bin/id
id -n -u 0
2⤵
PID:1727

/bin/sh
/bin/sh -
1⤵
PID:1728

/usr/bin/id
id -n -u 0
2⤵
PID:1729

/bin/sh
/bin/sh -
1⤵
PID:1730

/usr/bin/id
id -n -u 0
2⤵
PID:1731

/bin/sh
/bin/sh -
1⤵
PID:1732

/usr/bin/id
id -n -u 0
2⤵
PID:1733

/bin/sh
/bin/sh -
1⤵
PID:1734

/usr/bin/id
id -n -u 0
2⤵
PID:1735

/bin/sh
/bin/sh -
1⤵
PID:1736

/usr/bin/id
id -n -u 0
2⤵
PID:1737

/bin/sh
/bin/sh -
1⤵
PID:1738

/usr/bin/id
id -n -u 0
2⤵
PID:1739

/bin/sh
/bin/sh -
1⤵
PID:1740

/usr/bin/id
id -n -u 0
2⤵
PID:1741

/bin/sh
/bin/sh -
1⤵
PID:1742

/usr/bin/id
id -n -u 0
2⤵
PID:1743

/bin/sh
/bin/sh -
1⤵
PID:1744

/usr/bin/id
id -n -u 0
2⤵
PID:1745

/bin/sh
/bin/sh -
1⤵
PID:1746

/usr/bin/id
id -n -u 0
2⤵
PID:1747

/bin/sh
/bin/sh -
1⤵
PID:1748

/usr/bin/id
id -n -u 0
2⤵
PID:1749

/bin/sh
/bin/sh -
1⤵
PID:1750

/usr/bin/id
id -n -u 0
2⤵
PID:1751

/bin/sh
/bin/sh -
1⤵
PID:1752

/usr/bin/id
id -n -u 0
2⤵
PID:1753

/bin/sh
/bin/sh -
1⤵
PID:1754

/usr/bin/id
id -n -u 0
2⤵
PID:1755

/bin/sh
/bin/sh -
1⤵
PID:1757

/usr/bin/id
id -n -u 0
2⤵
PID:1760

/bin/sh
/bin/sh -
1⤵
PID:1763

/usr/bin/id
id -n -u 0
2⤵
PID:1764

/bin/sh
/bin/sh -
1⤵
PID:1766

/usr/bin/id
id -n -u 0
2⤵
PID:1767

/bin/sh
/bin/sh -
1⤵
PID:1770

/usr/bin/id
id -n -u 0
2⤵
PID:1771

/bin/sh
/bin/sh -
1⤵
PID:1774

/usr/bin/id
id -n -u 0
2⤵
PID:1775

/bin/sh
/bin/sh -
1⤵
PID:1778

/usr/bin/id
id -n -u 0
2⤵
PID:1780

/bin/sh
/bin/sh -
1⤵
PID:1782

/usr/bin/id
id -n -u 0
2⤵
PID:1784

/bin/sh
/bin/sh -
1⤵
PID:1786

/usr/bin/id
id -n -u 0
2⤵
PID:1788

/bin/sh
/bin/sh -
1⤵
PID:1790

/usr/bin/id
id -n -u 0
2⤵
PID:1791

/bin/sh
/bin/sh -
1⤵
PID:1798

/usr/bin/id
id -n -u 0
2⤵
PID:1800

/bin/sh
/bin/sh -
1⤵
PID:1803

/usr/bin/id
id -n -u 0
2⤵
PID:1809

/bin/sh
/bin/sh -
1⤵
PID:1820

/usr/bin/id
id -n -u 0
2⤵
PID:1825

/bin/sh
/bin/sh -
1⤵
PID:1830

/usr/bin/id
id -n -u 0
2⤵
PID:1831

/bin/sh
/bin/sh -
1⤵
PID:1835

/usr/bin/id
id -n -u 0
2⤵
PID:1838

/bin/sh
/bin/sh -
1⤵
PID:1839

/usr/bin/id
id -n -u 0
2⤵
PID:1840

/bin/sh
/bin/sh -
1⤵
PID:1841

/usr/bin/id
id -n -u 0
2⤵
PID:1842

/bin/sh
/bin/sh -
1⤵
PID:1843

/usr/bin/id
id -n -u 0
2⤵
PID:1844

/bin/sh
/bin/sh -
1⤵
PID:1845

/usr/bin/id
id -n -u 0
2⤵
PID:1846

/bin/sh
/bin/sh -
1⤵
PID:1847

/usr/bin/id
id -n -u 0
2⤵
PID:1848

/bin/sh
/bin/sh -
1⤵
PID:1849

/usr/bin/id
id -n -u 0
2⤵
PID:1850

/bin/sh
/bin/sh -
1⤵
PID:1851

/usr/bin/id
id -n -u 0
2⤵
PID:1852

/bin/sh
/bin/sh -
1⤵
PID:1853

/usr/bin/id
id -n -u 0
2⤵
PID:1854

/bin/sh
/bin/sh -
1⤵
PID:1855

/usr/bin/id
id -n -u 0
2⤵
PID:1856

/bin/sh
/bin/sh -
1⤵
PID:1857

/usr/bin/id
id -n -u 0
2⤵
PID:1858

/bin/sh
/bin/sh -
1⤵
PID:1859

/usr/bin/id
id -n -u 0
2⤵
PID:1860

/bin/sh
/bin/sh -
1⤵
PID:1861

/usr/bin/id
id -n -u 0
2⤵
PID:1862

/bin/sh
/bin/sh -
1⤵
PID:1863

/usr/bin/id
id -n -u 0
2⤵
PID:1864

/bin/sh
/bin/sh -
1⤵
PID:1865

/usr/bin/id
id -n -u 0
2⤵
PID:1866

/bin/sh
/bin/sh -
1⤵
PID:1867

/usr/bin/id
id -n -u 101
2⤵
PID:1868

/bin/sh
/bin/sh -
1⤵
PID:1869

/usr/bin/id
id -n -u 0
2⤵
PID:1870

/bin/sh
/bin/sh -
1⤵
PID:1871

/usr/bin/id
id -n -u 0
2⤵
PID:1872

/bin/sh
/bin/sh -
1⤵
PID:1873

/usr/bin/id
id -n -u 0
2⤵
PID:1874

/bin/sh
/bin/sh -
1⤵
PID:1875

/usr/bin/id
id -n -u 0
2⤵
PID:1876

/bin/sh
/bin/sh -
1⤵
PID:1877

/usr/bin/id
id -n -u 0
2⤵
PID:1878

/bin/sh
/bin/sh -
1⤵
PID:1879

/usr/bin/id
id -n -u 0
2⤵
PID:1880

/bin/sh
/bin/sh -
1⤵
PID:1881

/usr/bin/id
id -n -u 0
2⤵
PID:1882

/bin/sh
/bin/sh -
1⤵
PID:1883

/usr/bin/id
id -n -u 0
2⤵
PID:1884

/bin/sh
/bin/sh -
1⤵
PID:1885

/usr/bin/id
id -n -u 0
2⤵
PID:1886

/bin/sh
/bin/sh -
1⤵
PID:1887

/usr/bin/id
id -n -u 0
2⤵
PID:1888

/bin/sh
/bin/sh -
1⤵
PID:1889

/usr/bin/id
id -n -u 0
2⤵
PID:1890

/bin/sh
/bin/sh -
1⤵
PID:1891

/usr/bin/id
id -n -u 0
2⤵
PID:1892

/bin/sh
/bin/sh -
1⤵
PID:1893

/usr/bin/id
id -n -u 0
2⤵
PID:1894

/bin/sh
/bin/sh -
1⤵
PID:1895

/usr/bin/id
id -n -u 0
2⤵
PID:1896

/bin/sh
/bin/sh -
1⤵
PID:1897

/usr/bin/id
id -n -u 0
2⤵
PID:1898

/bin/sh
/bin/sh -
1⤵
PID:1899

/usr/bin/id
id -n -u 0
2⤵
PID:1900

/bin/sh
/bin/sh -
1⤵
PID:1901

/usr/bin/id
id -n -u 0
2⤵
PID:1902

/bin/sh
/bin/sh -
1⤵
PID:1903

/usr/bin/id
id -n -u 0
2⤵
PID:1904

/bin/sh
/bin/sh -
1⤵
PID:1905

/usr/bin/id
id -n -u 0
2⤵
PID:1906

/bin/sh
/bin/sh -
1⤵
PID:1907

/usr/bin/id
id -n -u 0
2⤵
PID:1908

/bin/sh
/bin/sh -
1⤵
PID:1909

/usr/bin/id
id -n -u 0
2⤵
PID:1911

/bin/sh
/bin/sh -
1⤵
PID:1912

/usr/bin/id
id -n -u 0
2⤵
PID:1913

/bin/sh
/bin/sh -
1⤵
PID:1914

/usr/bin/id
id -n -u 0
2⤵
PID:1915

/bin/sh
/bin/sh -
1⤵
PID:1919

/usr/bin/id
id -n -u 0
2⤵
PID:1921

/bin/sh
/bin/sh -
1⤵
PID:1923

/usr/bin/id
id -n -u 0
2⤵
PID:1924

/bin/sh
/bin/sh -
1⤵
PID:1926

/usr/bin/id
id -n -u 0
2⤵
PID:1928

/bin/sh
/bin/sh -
1⤵
PID:1930

/usr/bin/id
id -n -u 0
2⤵
PID:1932

/bin/sh
/bin/sh -
1⤵
PID:1934

/usr/bin/id
id -n -u 0
2⤵
PID:1936

/bin/sh
/bin/sh -
1⤵
PID:1939

/usr/bin/id
id -n -u 119
2⤵
PID:1941

/bin/sh
/bin/sh -
1⤵
PID:1943

/usr/bin/id
id -n -u 116
2⤵
PID:1945

/bin/sh
/bin/sh -
1⤵
PID:1947

/usr/bin/id
id -n -u 116
2⤵
PID:1949

/bin/sh
/bin/sh -
1⤵
PID:1955

/usr/bin/id
id -n -u 0
2⤵
PID:1957

/bin/sh
/bin/sh -
1⤵
PID:1963

/usr/bin/id
id -n -u 0
2⤵
PID:1966

/bin/sh
/bin/sh -
1⤵
PID:1975

/usr/bin/id
id -n -u 0
2⤵
PID:1979

/bin/sh
/bin/sh -
1⤵
PID:1987

/usr/bin/id
id -n -u 0
2⤵
PID:1988

/bin/sh
/bin/sh -
1⤵
PID:1992

/usr/bin/id
id -n -u 0
2⤵
PID:1995

/bin/sh
/bin/sh -
1⤵
PID:1996

/usr/bin/id
id -n -u 0
2⤵
PID:1997

/bin/sh
/bin/sh -
1⤵
PID:1998

/usr/bin/id
id -n -u 0
2⤵
PID:1999

/bin/sh
/bin/sh -
1⤵
PID:2000

/usr/bin/id
id -n -u 0
2⤵
PID:2001

/bin/sh
/bin/sh -
1⤵
PID:2002

/usr/bin/id
id -n -u 0
2⤵
PID:2003

/bin/sh
/bin/sh -
1⤵
PID:2004

/usr/bin/id
id -n -u 0
2⤵
PID:2005

/bin/sh
/bin/sh -
1⤵
PID:2006

/usr/bin/id
id -n -u 0
2⤵
PID:2007

/bin/sh
/bin/sh -
1⤵
PID:2008

/usr/bin/id
id -n -u 0
2⤵
PID:2009

/bin/sh
/bin/sh -
1⤵
PID:2010

/usr/bin/id
id -n -u 0
2⤵
PID:2011

/bin/sh
/bin/sh -
1⤵
PID:2012

/usr/bin/id
id -n -u 0
2⤵
PID:2013

/bin/sh
/bin/sh -
1⤵
PID:2014

/usr/bin/id
id -n -u 0
2⤵
PID:2015

/bin/sh
/bin/sh -
1⤵
PID:2016

/usr/bin/id
id -n -u 0
2⤵
PID:2017

/bin/sh
/bin/sh -
1⤵
PID:2018

/usr/bin/id
id -n -u 0
2⤵
PID:2019

/bin/sh
/bin/sh -
1⤵
PID:2020

/usr/bin/id
id -n -u 0
2⤵
PID:2021

/bin/sh
/bin/sh -
1⤵
PID:2022

/usr/bin/id
id -n -u 0
2⤵
PID:2023

/bin/sh
/bin/sh -
1⤵
PID:2024

/usr/bin/id
id -n -u 0
2⤵
PID:2025

/bin/sh
/bin/sh -
1⤵
PID:2026

/usr/bin/id
id -n -u 0
2⤵
PID:2027

/bin/sh
/bin/sh -
1⤵
PID:2028

/usr/bin/id
id -n -u 0
2⤵
PID:2029

/bin/sh
/bin/sh -
1⤵
PID:2030

/usr/bin/id
id -n -u 0
2⤵
PID:2031

/bin/sh
/bin/sh -
1⤵
PID:2032

/usr/bin/id
id -n -u 0
2⤵
PID:2033

/bin/sh
/bin/sh -
1⤵
PID:2034

/usr/bin/id
id -n -u 0
2⤵
PID:2035

/bin/sh
/bin/sh -
1⤵
PID:2036

/usr/bin/id
id -n -u 0
2⤵
PID:2037

/bin/sh
/bin/sh -
1⤵
PID:2038

/usr/bin/id
id -n -u 0
2⤵
PID:2039

/bin/sh
/bin/sh -
1⤵
PID:2040

/usr/bin/id
id -n -u 0
2⤵
PID:2041

/bin/sh
/bin/sh -
1⤵
PID:2042

/usr/bin/id
id -n -u 0
2⤵
PID:2043

/bin/sh
/bin/sh -
1⤵
PID:2044

/usr/bin/id
id -n -u 0
2⤵
PID:2045

/bin/sh
/bin/sh -
1⤵
PID:2046

/usr/bin/id
id -n -u 0
2⤵
PID:2047

/bin/sh
/bin/sh -
1⤵
PID:2048

/usr/bin/id
id -n -u 0
2⤵
PID:2049

/bin/sh
/bin/sh -
1⤵
PID:2050

/usr/bin/id
id -n -u 0
2⤵
PID:2051

/bin/sh
/bin/sh -
1⤵
PID:2052

/usr/bin/id
id -n -u 0
2⤵
PID:2053

/bin/sh
/bin/sh -
1⤵
PID:2054

/usr/bin/id
id -n -u 0
2⤵
PID:2055

/bin/sh
/bin/sh -
1⤵
PID:2056

/usr/bin/id
id -n -u 0
2⤵
PID:2057

/bin/sh
/bin/sh -
1⤵
PID:2058

/usr/bin/id
id -n -u 0
2⤵
PID:2059

/bin/sh
/bin/sh -
1⤵
PID:2060

/usr/bin/id
id -n -u 0
2⤵
PID:2061

/bin/sh
/bin/sh -
1⤵
PID:2062

/usr/bin/id
id -n -u 0
2⤵
PID:2063

/bin/sh
/bin/sh -
1⤵
PID:2064

/usr/bin/id
id -n -u 0
2⤵
PID:2065

/bin/sh
/bin/sh -
1⤵
PID:2066

/usr/bin/id
id -n -u 0
2⤵
PID:2067

/bin/sh
/bin/sh -
1⤵
PID:2068

/usr/bin/id
id -n -u 0
2⤵
PID:2069

/bin/sh
/bin/sh -
1⤵
PID:2070

/usr/bin/id
id -n -u 0
2⤵
PID:2071

/bin/sh
/bin/sh -
1⤵
PID:2072

/usr/bin/id
id -n -u 0
2⤵
PID:2073

/bin/sh
/bin/sh -
1⤵
PID:2074

/usr/bin/id
id -n -u 0
2⤵
PID:2075

/bin/sh
/bin/sh -
1⤵
PID:2076

/usr/bin/id
id -n -u 0
2⤵
PID:2077

/bin/sh
/bin/sh -
1⤵
PID:2078

/usr/bin/id
id -n -u 0
2⤵
PID:2079

/bin/sh
/bin/sh -
1⤵
PID:2080

/usr/bin/id
id -n -u 0
2⤵
PID:2081

/bin/sh
/bin/sh -
1⤵
PID:2082

/usr/bin/id
id -n -u 0
2⤵
PID:2083

/bin/sh
/bin/sh -
1⤵
PID:2084

/usr/bin/id
id -n -u 0
2⤵
PID:2085

/bin/sh
/bin/sh -
1⤵
PID:2086

/usr/bin/id
id -n -u 0
2⤵
PID:2087

/bin/sh
/bin/sh -
1⤵
PID:2088

/usr/bin/id
id -n -u 0
2⤵
PID:2089

/bin/sh
/bin/sh -
1⤵
PID:2090

/usr/bin/id
id -n -u 0
2⤵
PID:2091

/usr/bin/free
free -h
1⤵
- Reads CPU attributes
PID:2257

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
PID:2258

/bin/sh
/bin/sh -
1⤵
PID:2259

/bin/sh
/bin/sh -
1⤵
PID:2260

/usr/bin/chattr
chattr -ia .ssh/authorized_keys
2⤵
- Attempts to change immutable files
PID:2261

/usr/bin/free
free -h
1⤵
- Reads CPU attributes
PID:2349

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
PID:2350

/bin/sh
/bin/sh -
1⤵
PID:2351

/bin/sh
/bin/sh -
1⤵
PID:2352

/usr/bin/chattr
chattr -ia .ssh/authorized_keys
2⤵
- Attempts to change immutable files
PID:2353

/usr/bin/free
free -h
1⤵
- Reads CPU attributes
PID:2383

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:2384

/bin/sh
/bin/sh -
1⤵
PID:2385

/bin/sh
/bin/sh -
1⤵
PID:2386

/usr/bin/chattr
chattr -ia .ssh/authorized_keys
2⤵
- Attempts to change immutable files
PID:2387

/bin/sh
/bin/sh -
1⤵
PID:2388

/usr/bin/id
id -n -u 0
2⤵
PID:2389

/bin/sh
/bin/sh -
1⤵
PID:2390

/usr/bin/id
id -n -u 0
2⤵
PID:2391

/bin/sh
/bin/sh -
1⤵
PID:2392

/usr/bin/id
id -n -u 0
2⤵
PID:2393

/bin/sh
/bin/sh -
1⤵
PID:2394

/usr/bin/id
id -n -u 0
2⤵
PID:2395

/bin/sh
/bin/sh -
1⤵
PID:2396

/usr/bin/id
id -n -u 0
2⤵
PID:2397

/bin/sh
/bin/sh -
1⤵
PID:2398

/usr/bin/id
id -n -u 0
2⤵
PID:2399

/bin/sh
/bin/sh -
1⤵
PID:2400

/usr/bin/id
id -n -u 0
2⤵
PID:2401

/bin/sh
/bin/sh -
1⤵
PID:2402

/usr/bin/id
id -n -u 0
2⤵
PID:2403

/bin/sh
/bin/sh -
1⤵
PID:2404

/usr/bin/id
id -n -u 0
2⤵
PID:2405

/bin/sh
/bin/sh -
1⤵
PID:2406

/usr/bin/id
id -n -u 0
2⤵
PID:2407

/bin/sh
/bin/sh -
1⤵
PID:2408

/usr/bin/id
id -n -u 0
2⤵
PID:2409

/bin/sh
/bin/sh -
1⤵
PID:2410

/usr/bin/id
id -n -u 0
2⤵
PID:2411

/bin/sh
/bin/sh -
1⤵
PID:2412

/usr/bin/id
id -n -u 0
2⤵
PID:2413

/bin/sh
/bin/sh -
1⤵
PID:2414

/usr/bin/id
id -n -u 0
2⤵
PID:2415

/bin/sh
/bin/sh -
1⤵
PID:2416

/usr/bin/id
id -n -u 0
2⤵
PID:2417

/bin/sh
/bin/sh -
1⤵
PID:2418

/usr/bin/id
id -n -u 0
2⤵
PID:2419

/bin/sh
/bin/sh -
1⤵
PID:2420

/usr/bin/id
id -n -u 0
2⤵
PID:2421

/bin/sh
/bin/sh -
1⤵
PID:2422

/usr/bin/id
id -n -u 0
2⤵
PID:2423

/bin/sh
/bin/sh -
1⤵
PID:2424

/usr/bin/id
id -n -u 0
2⤵
PID:2425

/bin/sh
/bin/sh -
1⤵
PID:2426

/usr/bin/id
id -n -u 0
2⤵
PID:2427

/bin/sh
/bin/sh -
1⤵
PID:2428

/usr/bin/id
id -n -u 0
2⤵
PID:2429

/bin/sh
/bin/sh -
1⤵
PID:2430

/usr/bin/id
id -n -u 0
2⤵
PID:2431

/bin/sh
/bin/sh -
1⤵
PID:2432

/usr/bin/id
id -n -u 0
2⤵
PID:2433

/bin/sh
/bin/sh -
1⤵
PID:2434

/usr/bin/id
id -n -u 0
2⤵
PID:2435

/bin/sh
/bin/sh -
1⤵
PID:2436

/usr/bin/id
id -n -u 0
2⤵
PID:2437

/bin/sh
/bin/sh -
1⤵
PID:2438

/usr/bin/id
id -n -u 0
2⤵
PID:2439

/bin/sh
/bin/sh -
1⤵
PID:2440

/usr/bin/id
id -n -u 0
2⤵
PID:2441

/bin/sh
/bin/sh -
1⤵
PID:2442

/usr/bin/id
id -n -u 0
2⤵
PID:2443

/bin/sh
/bin/sh -
1⤵
PID:2444

/usr/bin/id
id -n -u 0
2⤵
PID:2445

/bin/sh
/bin/sh -
1⤵
PID:2446

/usr/bin/id
id -n -u 0
2⤵
PID:2447

/bin/sh
/bin/sh -
1⤵
PID:2448

/usr/bin/id
id -n -u 0
2⤵
PID:2449

/bin/sh
/bin/sh -
1⤵
PID:2450

/usr/bin/id
id -n -u 0
2⤵
PID:2451

/bin/sh
/bin/sh -
1⤵
PID:2452

/usr/bin/id
id -n -u 0
2⤵
PID:2453

/bin/sh
/bin/sh -
1⤵
PID:2454

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2455

/bin/sh
/bin/sh -
1⤵
PID:2456

/usr/bin/id
id -n -u 0
2⤵
PID:2457

/bin/sh
/bin/sh -
1⤵
PID:2458

/usr/bin/id
id -n -u 0
2⤵
PID:2459

/bin/sh
/bin/sh -
1⤵
PID:2460

/usr/bin/id
id -n -u 123
2⤵
PID:2461

/bin/sh
/bin/sh -
1⤵
PID:2462

/usr/bin/id
id -n -u 0
2⤵
PID:2463

/bin/sh
/bin/sh -
1⤵
PID:2464

/usr/bin/id
id -n -u 0
2⤵
PID:2465

/bin/sh
/bin/sh -
1⤵
PID:2466

/usr/bin/id
id -n -u 0
2⤵
PID:2467

/bin/sh
/bin/sh -
1⤵
PID:2468

/usr/bin/id
id -n -u 0
2⤵
PID:2469

/bin/sh
/bin/sh -
1⤵
PID:2470

/usr/bin/id
id -n -u 0
2⤵
PID:2471

/bin/sh
/bin/sh -
1⤵
PID:2472

/usr/bin/id
id -n -u 0
2⤵
PID:2473

/bin/sh
/bin/sh -
1⤵
PID:2474

/usr/bin/id
id -n -u 0
2⤵
PID:2475

/bin/sh
/bin/sh -
1⤵
PID:2476

/usr/bin/id
id -n -u 0
2⤵
PID:2477

/bin/sh
/bin/sh -
1⤵
PID:2478

/usr/bin/id
id -n -u 0
2⤵
PID:2479

/bin/sh
/bin/sh -
1⤵
PID:2480

/usr/bin/id
id -n -u 0
2⤵
PID:2481

/bin/sh
/bin/sh -
1⤵
PID:2482

/usr/bin/id
id -n -u 0
2⤵
PID:2483

/bin/sh
/bin/sh -
1⤵
PID:2484

/usr/bin/id
id -n -u 0
2⤵
PID:2485

/bin/sh
/bin/sh -
1⤵
PID:2486

/usr/bin/id
id -n -u 0
2⤵
PID:2487

/bin/sh
/bin/sh -
1⤵
PID:2488

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2489

/bin/sh
/bin/sh -
1⤵
PID:2490

/usr/bin/id
id -n -u 0
2⤵
PID:2491

/bin/sh
/bin/sh -
1⤵
PID:2492

/usr/bin/id
id -n -u 0
2⤵
PID:2493

/bin/sh
/bin/sh -
1⤵
PID:2494

/usr/bin/id
id -n -u 0
2⤵
PID:2495

/bin/sh
/bin/sh -
1⤵
PID:2496

/usr/bin/id
id -n -u 0
2⤵
PID:2497

/bin/sh
/bin/sh -
1⤵
PID:2498

/usr/bin/id
id -n -u 0
2⤵
PID:2499

/bin/sh
/bin/sh -
1⤵
PID:2500

/usr/bin/id
id -n -u 0
2⤵
PID:2501

/bin/sh
/bin/sh -
1⤵
PID:2502

/usr/bin/id
id -n -u 0
2⤵
PID:2503

/bin/sh
/bin/sh -
1⤵
PID:2504

/usr/bin/id
id -n -u 0
2⤵
PID:2505

/bin/sh
/bin/sh -
1⤵
PID:2506

/usr/bin/id
id -n -u 0
2⤵
PID:2507

/bin/sh
/bin/sh -
1⤵
PID:2508

/usr/bin/id
id -n -u 0
2⤵
PID:2509

/bin/sh
/bin/sh -
1⤵
PID:2510

/usr/bin/id
id -n -u 0
2⤵
PID:2511

/bin/sh
/bin/sh -
1⤵
PID:2512

/usr/bin/id
id -n -u 0
2⤵
PID:2513

/bin/sh
/bin/sh -
1⤵
PID:2514

/usr/bin/id
id -n -u 0
2⤵
PID:2515

/bin/sh
/bin/sh -
1⤵
PID:2516

/usr/bin/id
id -n -u 0
2⤵
PID:2517

/bin/sh
/bin/sh -
1⤵
PID:2518

/usr/bin/id
id -n -u 0
2⤵
PID:2519

/bin/sh
/bin/sh -
1⤵
PID:2520

/usr/bin/id
id -n -u 0
2⤵
PID:2521

/bin/sh
/bin/sh -
1⤵
PID:2522

/usr/bin/id
id -n -u 0
2⤵
PID:2523

/bin/sh
/bin/sh -
1⤵
PID:2524

/usr/bin/id
id -n -u 0
2⤵
PID:2525

/bin/sh
/bin/sh -
1⤵
PID:2526

/usr/bin/id
id -n -u 0
2⤵
PID:2527

/bin/sh
/bin/sh -
1⤵
PID:2528

/usr/bin/id
id -n -u 0
2⤵
PID:2529

/bin/sh
/bin/sh -
1⤵
PID:2530

/usr/bin/id
id -n -u 0
2⤵
PID:2531

/bin/sh
/bin/sh -
1⤵
PID:2532

/usr/bin/id
id -n -u 0
2⤵
PID:2533

/bin/sh
/bin/sh -
1⤵
PID:2534

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2535

/bin/sh
/bin/sh -
1⤵
PID:2536

/usr/bin/id
id -n -u 0
2⤵
PID:2537

/bin/sh
/bin/sh -
1⤵
PID:2538

/usr/bin/id
id -n -u 0
2⤵
PID:2539

/bin/sh
/bin/sh -
1⤵
PID:2540

/usr/bin/id
id -n -u 0
2⤵
PID:2541

/bin/sh
/bin/sh -
1⤵
PID:2542

/usr/bin/id
id -n -u 0
2⤵
PID:2543

/bin/sh
/bin/sh -
1⤵
PID:2544

/usr/bin/id
id -n -u 0
2⤵
PID:2545

/bin/sh
/bin/sh -
1⤵
PID:2546

/usr/bin/id
id -n -u 0
2⤵
PID:2547

/bin/sh
/bin/sh -
1⤵
PID:2548

/usr/bin/id
id -n -u 0
2⤵
PID:2549

/bin/sh
/bin/sh -
1⤵
PID:2550

/usr/bin/id
id -n -u 0
2⤵
PID:2551

/bin/sh
/bin/sh -
1⤵
PID:2552

/usr/bin/id
id -n -u 0
2⤵
PID:2553

/bin/sh
/bin/sh -
1⤵
PID:2554

/usr/bin/id
id -n -u 0
2⤵
PID:2555

/bin/sh
/bin/sh -
1⤵
PID:2556

/usr/bin/id
id -n -u 0
2⤵
PID:2557

/bin/sh
/bin/sh -
1⤵
PID:2558

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2559

/bin/sh
/bin/sh -
1⤵
PID:2560

/usr/bin/id
id -n -u 0
2⤵
PID:2561

/bin/sh
/bin/sh -
1⤵
PID:2562

/usr/bin/id
id -n -u 0
2⤵
PID:2563

/bin/sh
/bin/sh -
1⤵
PID:2564

/usr/bin/id
id -n -u 0
2⤵
PID:2565

/bin/sh
/bin/sh -
1⤵
PID:2566

/usr/bin/id
id -n -u 0
2⤵
PID:2567

/bin/sh
/bin/sh -
1⤵
PID:2568

/usr/bin/id
id -n -u 0
2⤵
PID:2569

/bin/sh
/bin/sh -
1⤵
PID:2570

/usr/bin/id
id -n -u 101
2⤵
PID:2571

/bin/sh
/bin/sh -
1⤵
PID:2572

/usr/bin/id
id -n -u 0
2⤵
PID:2573

/bin/sh
/bin/sh -
1⤵
PID:2574

/usr/bin/id
id -n -u 0
2⤵
PID:2575

/bin/sh
/bin/sh -
1⤵
PID:2576

/usr/bin/id
id -n -u 0
2⤵
PID:2577

/bin/sh
/bin/sh -
1⤵
PID:2578

/usr/bin/id
id -n -u 0
2⤵
PID:2579

/bin/sh
/bin/sh -
1⤵
PID:2580

/usr/bin/id
id -n -u 0
2⤵
PID:2581

/bin/sh
/bin/sh -
1⤵
PID:2582

/usr/bin/id
id -n -u 0
2⤵
PID:2583

/bin/sh
/bin/sh -
1⤵
PID:2584

/usr/bin/id
id -n -u 0
2⤵
PID:2585

/bin/sh
/bin/sh -
1⤵
PID:2586

/usr/bin/id
id -n -u 0
2⤵
PID:2587

/bin/sh
/bin/sh -
1⤵
PID:2588

/usr/bin/id
id -n -u 0
2⤵
PID:2589

/bin/sh
/bin/sh -
1⤵
PID:2590

/usr/bin/id
id -n -u 0
2⤵
PID:2591

/bin/sh
/bin/sh -
1⤵
PID:2592

/usr/bin/id
id -n -u 0
2⤵
PID:2593

/bin/sh
/bin/sh -
1⤵
PID:2594

/usr/bin/id
id -n -u 0
2⤵
PID:2595

/bin/sh
/bin/sh -
1⤵
PID:2596

/usr/bin/id
id -n -u 0
2⤵
PID:2597

/bin/sh
/bin/sh -
1⤵
PID:2598

/usr/bin/id
id -n -u 0
2⤵
PID:2599

/bin/sh
/bin/sh -
1⤵
PID:2600

/usr/bin/id
id -n -u 0
2⤵
PID:2601

/bin/sh
/bin/sh -
1⤵
PID:2602

/usr/bin/id
id -n -u 0
2⤵
PID:2603

/bin/sh
/bin/sh -
1⤵
PID:2604

/usr/bin/id
id -n -u 0
2⤵
PID:2605

/bin/sh
/bin/sh -
1⤵
PID:2606

/usr/bin/id
id -n -u 0
2⤵
PID:2607

/bin/sh
/bin/sh -
1⤵
PID:2608

/usr/bin/id
id -n -u 0
2⤵
PID:2609

/bin/sh
/bin/sh -
1⤵
PID:2610

/usr/bin/id
id -n -u 0
2⤵
PID:2611

/bin/sh
/bin/sh -
1⤵
PID:2612

/usr/bin/id
id -n -u 0
2⤵
PID:2613

/bin/sh
/bin/sh -
1⤵
PID:2614

/usr/bin/id
id -n -u 0
2⤵
PID:2615

/bin/sh
/bin/sh -
1⤵
PID:2616

/usr/bin/id
id -n -u 0
2⤵
PID:2617

/bin/sh
/bin/sh -
1⤵
PID:2618

/usr/bin/id
id -n -u 0
2⤵
PID:2619

/bin/sh
/bin/sh -
1⤵
PID:2620

/usr/bin/id
id -n -u 0
2⤵
PID:2621

/bin/sh
/bin/sh -
1⤵
PID:2622

/usr/bin/id
id -n -u 0
2⤵
PID:2623

/bin/sh
/bin/sh -
1⤵
PID:2624

/usr/bin/id
id -n -u 0
2⤵
PID:2625

/bin/sh
/bin/sh -
1⤵
PID:2626

/usr/bin/id
id -n -u 0
2⤵
PID:2627

/bin/sh
/bin/sh -
1⤵
PID:2628

/usr/bin/id
id -n -u 119
2⤵
PID:2629

/bin/sh
/bin/sh -
1⤵
PID:2630

/usr/bin/id
id -n -u 116
2⤵
PID:2631

/bin/sh
/bin/sh -
1⤵
PID:2632

/usr/bin/id
id -n -u 116
2⤵
PID:2633

/bin/sh
/bin/sh -
1⤵
PID:2634

/usr/bin/id
id -n -u 0
2⤵
PID:2635

/bin/sh
/bin/sh -
1⤵
PID:2636

/usr/bin/id
id -n -u 0
2⤵
PID:2637

/bin/sh
/bin/sh -
1⤵
PID:2638

/usr/bin/id
id -n -u 0
2⤵
PID:2639

/bin/sh
/bin/sh -
1⤵
PID:2640

/usr/bin/id
id -n -u 0
2⤵
PID:2641

/bin/sh
/bin/sh -
1⤵
PID:2642

/usr/bin/id
id -n -u 0
2⤵
PID:2643

/bin/sh
/bin/sh -
1⤵
PID:2644

/usr/bin/id
id -n -u 0
2⤵
PID:2645

/bin/sh
/bin/sh -
1⤵
PID:2646

/usr/bin/id
id -n -u 0
2⤵
PID:2647

/bin/sh
/bin/sh -
1⤵
PID:2648

/usr/bin/id
id -n -u 0
2⤵
PID:2649

/bin/sh
/bin/sh -
1⤵
PID:2650

/usr/bin/id
id -n -u 0
2⤵
PID:2651

/bin/sh
/bin/sh -
1⤵
PID:2652

/usr/bin/id
id -n -u 0
2⤵
PID:2653

/bin/sh
/bin/sh -
1⤵
PID:2654

/usr/bin/id
id -n -u 0
2⤵
PID:2655

/bin/sh
/bin/sh -
1⤵
PID:2656

/usr/bin/id
id -n -u 0
2⤵
PID:2657

/bin/sh
/bin/sh -
1⤵
PID:2658

/usr/bin/id
id -n -u 0
2⤵
PID:2659

/bin/sh
/bin/sh -
1⤵
PID:2660

/usr/bin/id
id -n -u 0
2⤵
PID:2661

/bin/sh
/bin/sh -
1⤵
PID:2662

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2663

/bin/sh
/bin/sh -
1⤵
PID:2664

/usr/bin/id
id -n -u 0
2⤵
PID:2665

/bin/sh
/bin/sh -
1⤵
PID:2666

/usr/bin/id
id -n -u 0
2⤵
PID:2667

/bin/sh
/bin/sh -
1⤵
PID:2668

/usr/bin/id
id -n -u 0
2⤵
PID:2669

/bin/sh
/bin/sh -
1⤵
PID:2670

/usr/bin/id
id -n -u 0
2⤵
PID:2671

/bin/sh
/bin/sh -
1⤵
PID:2672

/usr/bin/id
id -n -u 0
2⤵
PID:2673

/bin/sh
/bin/sh -
1⤵
PID:2674

/usr/bin/id
id -n -u 0
2⤵
PID:2675

/bin/sh
/bin/sh -
1⤵
PID:2676

/usr/bin/id
id -n -u 0
2⤵
PID:2677

/bin/sh
/bin/sh -
1⤵
PID:2678

/usr/bin/id
id -n -u 0
2⤵
PID:2679

/bin/sh
/bin/sh -
1⤵
PID:2680

/usr/bin/id
id -n -u 0
2⤵
PID:2681

/bin/sh
/bin/sh -
1⤵
PID:2682

/usr/bin/id
id -n -u 0
2⤵
PID:2683

/bin/sh
/bin/sh -
1⤵
PID:2684

/usr/bin/id
id -n -u 0
2⤵
PID:2685

/bin/sh
/bin/sh -
1⤵
PID:2686

/usr/bin/id
id -n -u 0
2⤵
PID:2687

/bin/sh
/bin/sh -
1⤵
PID:2688

/usr/bin/id
id -n -u 0
2⤵
PID:2689

/bin/sh
/bin/sh -
1⤵
PID:2690

/usr/bin/id
id -n -u 0
2⤵
PID:2691

/bin/sh
/bin/sh -
1⤵
PID:2692

/usr/bin/id
id -n -u 0
2⤵
PID:2693

/bin/sh
/bin/sh -
1⤵
PID:2694

/usr/bin/id
id -n -u 0
2⤵
PID:2695

/bin/sh
/bin/sh -
1⤵
PID:2696

/usr/bin/id
id -n -u 0
2⤵
PID:2697

/bin/sh
/bin/sh -
1⤵
PID:2698

/usr/bin/id
id -n -u 0
2⤵
PID:2699

/bin/sh
/bin/sh -
1⤵
PID:2700

/usr/bin/id
id -n -u 0
2⤵
PID:2701

/bin/sh
/bin/sh -
1⤵
PID:2702

/usr/bin/id
id -n -u 0
2⤵
PID:2703

/bin/sh
/bin/sh -
1⤵
PID:2704

/usr/bin/id
id -n -u 0
2⤵
PID:2705

/bin/sh
/bin/sh -
1⤵
PID:2706

/usr/bin/id
id -n -u 0
2⤵
PID:2707

/bin/sh
/bin/sh -
1⤵
PID:2708

/usr/bin/id
id -n -u 0
2⤵
PID:2709

/bin/sh
/bin/sh -
1⤵
PID:2710

/usr/bin/id
id -n -u 0
2⤵
PID:2711

/bin/sh
/bin/sh -
1⤵
PID:2712

/usr/bin/id
id -n -u 0
2⤵
PID:2713

/bin/sh
/bin/sh -
1⤵
PID:2714

/usr/bin/id
id -n -u 0
2⤵
PID:2715

/bin/sh
/bin/sh -
1⤵
PID:2716

/usr/bin/id
id -n -u 0
2⤵
PID:2717

/bin/sh
/bin/sh -
1⤵
PID:2718

/usr/bin/id
id -n -u 0
2⤵
PID:2719

/bin/sh
/bin/sh -
1⤵
PID:2720

/usr/bin/id
id -n -u 0
2⤵
PID:2721

/bin/sh
/bin/sh -
1⤵
PID:2722

/usr/bin/id
id -n -u 0
2⤵
PID:2723

/bin/sh
/bin/sh -
1⤵
PID:2724

/usr/bin/id
id -n -u 0
2⤵
PID:2725

/bin/sh
/bin/sh -
1⤵
PID:2726

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2727

/bin/sh
/bin/sh -
1⤵
PID:2728

/usr/bin/id
id -n -u 0
2⤵
PID:2729

/bin/sh
/bin/sh -
1⤵
PID:2730

/usr/bin/id
id -n -u 0
2⤵
PID:2731

/bin/sh
/bin/sh -
1⤵
PID:2732

/usr/bin/id
id -n -u 0
2⤵
PID:2733

/bin/sh
/bin/sh -
1⤵
PID:2734

/usr/bin/id
id -n -u 0
2⤵
PID:2735

/bin/sh
/bin/sh -
1⤵
PID:2736

/usr/bin/id
id -n -u 0
2⤵
PID:2737

/bin/sh
/bin/sh -
1⤵
PID:2738

/usr/bin/id
id -n -u 0
2⤵
PID:2739

/bin/sh
/bin/sh -
1⤵
PID:2740

/usr/bin/id
id -n -u 0
2⤵
PID:2741

/bin/sh
/bin/sh -
1⤵
PID:2742

/usr/bin/id
id -n -u 0
2⤵
PID:2743

/bin/sh
/bin/sh -
1⤵
PID:2744

/usr/bin/id
id -n -u 0
2⤵
PID:2745

/bin/sh
/bin/sh -
1⤵
PID:2746

/usr/bin/id
id -n -u 0
2⤵
PID:2747

/bin/sh
/bin/sh -
1⤵
PID:2748

/usr/bin/id
id -n -u 0
2⤵
PID:2749

/bin/sh
/bin/sh -
1⤵
PID:2750

/usr/bin/id
id -n -u 0
2⤵
PID:2751

/bin/sh
/bin/sh -
1⤵
PID:2752

/usr/bin/id
id -n -u 0
2⤵
PID:2753

/bin/sh
/bin/sh -
1⤵
PID:2754

/usr/bin/id
id -n -u 0
2⤵
PID:2755

/bin/sh
/bin/sh -
1⤵
PID:2756

/usr/bin/id
id -n -u 0
2⤵
PID:2757

/bin/sh
/bin/sh -
1⤵
PID:2758

/usr/bin/id
id -n -u 0
2⤵
PID:2759

/bin/sh
/bin/sh -
1⤵
PID:2760

/usr/bin/id
id -n -u 0
2⤵
PID:2761

/bin/sh
/bin/sh -
1⤵
PID:2762

/usr/bin/id
id -n -u 0
2⤵
PID:2763

/bin/sh
/bin/sh -
1⤵
PID:2764

/usr/bin/id
id -n -u 0
2⤵
PID:2765

/bin/sh
/bin/sh -
1⤵
PID:2766

/usr/bin/id
id -n -u 0
2⤵
PID:2767

/bin/sh
/bin/sh -
1⤵
PID:2768

/usr/bin/id
id -n -u 0
2⤵
PID:2769

/bin/sh
/bin/sh -
1⤵
PID:2770

/usr/bin/id
id -n -u 0
2⤵
PID:2771

/bin/sh
/bin/sh -
1⤵
PID:2772

/usr/bin/id
id -n -u 0
2⤵
PID:2773

/bin/sh
/bin/sh -
1⤵
PID:2774

/usr/bin/id
id -n -u 0
2⤵
PID:2775

/bin/sh
/bin/sh -
1⤵
PID:2776

/usr/bin/id
id -n -u 0
2⤵
PID:2777

/bin/sh
/bin/sh -
1⤵
PID:2778

/usr/bin/id
id -n -u 0
2⤵
PID:2779

/bin/sh
/bin/sh -
1⤵
PID:2780

/usr/bin/id
id -n -u 0
2⤵
PID:2781

/bin/sh
/bin/sh -
1⤵
PID:2782

/usr/bin/id
id -n -u 0
2⤵
PID:2783

/bin/sh
/bin/sh -
1⤵
PID:2784

/usr/bin/id
id -n -u 0
2⤵
PID:2785

/bin/sh
/bin/sh -
1⤵
PID:2786

/usr/bin/id
id -n -u 0
2⤵
PID:2787

/bin/sh
/bin/sh -
1⤵
PID:2788

/usr/bin/id
id -n -u 0
2⤵
PID:2789

/bin/sh
/bin/sh -
1⤵
PID:2790

/usr/bin/id
id -n -u 0
2⤵
PID:2791

/bin/sh
/bin/sh -
1⤵
PID:2792

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2793

/bin/sh
/bin/sh -
1⤵
PID:2794

/usr/bin/id
id -n -u 0
2⤵
PID:2795

/bin/sh
/bin/sh -
1⤵
PID:2796

/usr/bin/id
id -n -u 0
2⤵
PID:2797

/bin/sh
/bin/sh -
1⤵
PID:2798

/usr/bin/id
id -n -u 0
2⤵
PID:2799

/bin/sh
/bin/sh -
1⤵
PID:2800

/usr/bin/id
id -n -u 0
2⤵
PID:2801

/bin/sh
/bin/sh -
1⤵
PID:2802

/usr/bin/id
id -n -u 0
2⤵
PID:2803

/bin/sh
/bin/sh -
1⤵
PID:2804

/usr/bin/id
id -n -u 0
2⤵
PID:2805

/bin/sh
/bin/sh -
1⤵
PID:2806

/usr/bin/id
id -n -u 0
2⤵
PID:2807

/bin/sh
/bin/sh -
1⤵
PID:2808

/usr/bin/id
id -n -u 0
2⤵
PID:2809

/bin/sh
/bin/sh -
1⤵
PID:2810

/usr/bin/id
id -n -u 0
2⤵
PID:2811

/bin/sh
/bin/sh -
1⤵
PID:2812

/usr/bin/id
id -n -u 123
2⤵
PID:2813

/bin/sh
/bin/sh -
1⤵
PID:2814

/usr/bin/id
id -n -u 0
2⤵
PID:2815

/bin/sh
/bin/sh -
1⤵
PID:2816

/usr/bin/id
id -n -u 0
2⤵
PID:2817

/bin/sh
/bin/sh -
1⤵
PID:2818

/usr/bin/id
id -n -u 0
2⤵
PID:2819

/bin/sh
/bin/sh -
1⤵
PID:2820

/usr/bin/id
id -n -u 0
2⤵
PID:2821

/bin/sh
/bin/sh -
1⤵
PID:2822

/usr/bin/id
id -n -u 0
2⤵
PID:2823

/bin/sh
/bin/sh -
1⤵
PID:2824

/usr/bin/id
id -n -u 0
2⤵
PID:2825

/bin/sh
/bin/sh -
1⤵
PID:2826

/usr/bin/id
id -n -u 0
2⤵
PID:2827

/bin/sh
/bin/sh -
1⤵
PID:2828

/usr/bin/id
id -n -u 0
2⤵
PID:2829

/bin/sh
/bin/sh -
1⤵
PID:2830

/usr/bin/id
id -n -u 0
2⤵
PID:2831

/bin/sh
/bin/sh -
1⤵
PID:2832

/usr/bin/id
id -n -u 0
2⤵
PID:2833

/bin/sh
/bin/sh -
1⤵
PID:2834

/usr/bin/id
id -n -u 0
2⤵
PID:2835

/bin/sh
/bin/sh -
1⤵
PID:2836

/usr/bin/id
id -n -u 0
2⤵
PID:2837

/bin/sh
/bin/sh -
1⤵
PID:2838

/usr/bin/id
id -n -u 0
2⤵
PID:2839

/bin/sh
/bin/sh -
1⤵
PID:2840

/usr/bin/id
id -n -u 0
2⤵
PID:2841

/bin/sh
/bin/sh -
1⤵
PID:2842

/usr/bin/id
id -n -u 0
2⤵
PID:2843

/bin/sh
/bin/sh -
1⤵
PID:2844

/usr/bin/id
id -n -u 0
2⤵
PID:2845

/bin/sh
/bin/sh -
1⤵
PID:2846

/usr/bin/id
id -n -u 0
2⤵
PID:2847

/bin/sh
/bin/sh -
1⤵
PID:2848

/usr/bin/id
id -n -u 0
2⤵
PID:2849

/bin/sh
/bin/sh -
1⤵
PID:2850

/usr/bin/id
id -n -u 0
2⤵
PID:2851

/bin/sh
/bin/sh -
1⤵
PID:2852

/usr/bin/id
id -n -u 0
2⤵
PID:2853

/bin/sh
/bin/sh -
1⤵
PID:2854

/usr/bin/id
id -n -u 0
2⤵
PID:2855

/bin/sh
/bin/sh -
1⤵
PID:2856

/usr/bin/id
id -n -u 0
2⤵
PID:2857

/bin/sh
/bin/sh -
1⤵
PID:2858

/usr/bin/id
id -n -u 0
2⤵
PID:2859

/bin/sh
/bin/sh -
1⤵
PID:2860

/usr/bin/id
id -n -u 0
2⤵
PID:2861

/bin/sh
/bin/sh -
1⤵
PID:2862

/usr/bin/id
id -n -u 0
2⤵
- Reads runtime system information
PID:2863

/bin/sh
/bin/sh -
1⤵
PID:2864

/usr/bin/id
id -n -u 0
2⤵
PID:2865

/bin/sh
/bin/sh -
1⤵
PID:2866

/usr/bin/id
id -n -u 0
2⤵
PID:2867

/bin/sh
/bin/sh -
1⤵
PID:2868

/usr/bin/id
id -n -u 0
2⤵
PID:2869

/bin/sh
/bin/sh -
1⤵
PID:2870

/usr/bin/id
id -n -u 0
2⤵
PID:2871

/bin/sh
/bin/sh -
1⤵
PID:2872

/usr/bin/id
id -n -u 0
2⤵
PID:2873

/bin/sh
/bin/sh -
1⤵
PID:2874

/usr/bin/id
id -n -u 0
2⤵
PID:2875

/bin/sh
/bin/sh -
1⤵
PID:2876

/usr/bin/id
id -n -u 0
2⤵
PID:2877

/bin/sh
/bin/sh -
1⤵
PID:2878

/usr/bin/id
id -n -u 0
2⤵
PID:2879

/bin/sh
/bin/sh -
1⤵
PID:2880

/usr/bin/id
id -n -u 0
2⤵
PID:2881

/bin/sh
/bin/sh -
1⤵
PID:2882

/usr/bin/id
id -n -u 0
2⤵
PID:2883

/bin/sh
/bin/sh -
1⤵
PID:2884

/usr/bin/id
id -n -u 0
2⤵
PID:2885

/bin/sh
/bin/sh -
1⤵
PID:2886

/usr/bin/id
id -n -u 0
2⤵
PID:2887

/bin/sh
/bin/sh -
1⤵
PID:2888

/usr/bin/id
id -n -u 0
2⤵
PID:2889

/bin/sh
/bin/sh -
1⤵
PID:2890

/usr/bin/id
id -n -u 0
2⤵
PID:2891

/bin/sh
/bin/sh -
1⤵
PID:2892

/usr/bin/id
id -n -u 0
2⤵
PID:2893

/bin/sh
/bin/sh -
1⤵
PID:2894

/usr/bin/id
id -n -u 0
2⤵
PID:2895

/bin/sh
/bin/sh -
1⤵
PID:2896

/usr/bin/id
id -n -u 0
2⤵
PID:2897

/bin/sh
/bin/sh -
1⤵
PID:2898

/usr/bin/id
id -n -u 0
2⤵
PID:2899

/bin/sh
/bin/sh -
1⤵
PID:2900

/usr/bin/id
id -n -u 0
2⤵
PID:2901

/bin/sh
/bin/sh -
1⤵
PID:2902

/usr/bin/id
id -n -u 0
2⤵
PID:2903

/bin/sh
/bin/sh -
1⤵
PID:2904

/usr/bin/id
id -n -u 0
2⤵
PID:2905

/bin/sh
/bin/sh -
1⤵
PID:2906

/usr/bin/id
id -n -u 0
2⤵
PID:2907

/bin/sh
/bin/sh -
1⤵
PID:2908

/usr/bin/id
id -n -u 0
2⤵
PID:2909

/bin/sh
/bin/sh -
1⤵
PID:2910

/usr/bin/id
id -n -u 0
2⤵
PID:2911

/bin/sh
/bin/sh -
1⤵
PID:2912

/usr/bin/id
id -n -u 0
2⤵
PID:2913

/bin/sh
/bin/sh -
1⤵
PID:2914

/usr/bin/id
id -n -u 0
2⤵
PID:2915

/bin/sh
/bin/sh -
1⤵
PID:2916

/usr/bin/id
id -n -u 0
2⤵
PID:2917

/bin/sh
/bin/sh -
1⤵
PID:2918

/usr/bin/id
id -n -u 0
2⤵
PID:2919

/bin/sh
/bin/sh -
1⤵
PID:2920

/usr/bin/id
id -n -u 0
2⤵
PID:2921

/bin/sh
/bin/sh -
1⤵
PID:2922

/usr/bin/id
id -n -u 0
2⤵
PID:2923

/bin/sh
/bin/sh -
1⤵
PID:2924

/usr/bin/id
id -n -u 0
2⤵
PID:2925

/bin/sh
/bin/sh -
1⤵
PID:2926

/usr/bin/id
id -n -u 0
2⤵
PID:2927

/bin/sh
/bin/sh -
1⤵
PID:2928

/usr/bin/id
id -n -u 0
2⤵
PID:2929

/bin/sh
/bin/sh -
1⤵
PID:2930

/usr/bin/id
id -n -u 0
2⤵
PID:2931

/bin/sh
/bin/sh -
1⤵
PID:2932

/usr/bin/id
id -n -u 0
2⤵
PID:2933

/bin/sh
/bin/sh -
1⤵
PID:2934

/usr/bin/id
id -n -u 0
2⤵
PID:2935

/bin/sh
/bin/sh -
1⤵
PID:2936

/usr/bin/id
id -n -u 101
2⤵
PID:2937

/bin/sh
/bin/sh -
1⤵
PID:2938

/usr/bin/id
id -n -u 0
2⤵
PID:2939

/bin/sh
/bin/sh -
1⤵
PID:2940

/usr/bin/id
id -n -u 0
2⤵
PID:2941

/bin/sh
/bin/sh -
1⤵
PID:2942

/usr/bin/id
id -n -u 0
2⤵
PID:2943

/bin/sh
/bin/sh -
1⤵
PID:2944

/usr/bin/id
id -n -u 0
2⤵
PID:2945

/bin/sh
/bin/sh -
1⤵
PID:2946

/usr/bin/id
id -n -u 0
2⤵
PID:2947

/bin/sh
/bin/sh -
1⤵
PID:2948

/usr/bin/id
id -n -u 0
2⤵
PID:2949

/bin/sh
/bin/sh -
1⤵
PID:2950

/usr/bin/id
id -n -u 0
2⤵
PID:2951

/bin/sh
/bin/sh -
1⤵
PID:2952

/usr/bin/id
id -n -u 0
2⤵
PID:2953

/bin/sh
/bin/sh -
1⤵
PID:2954

/usr/bin/id
id -n -u 0
2⤵
PID:2955

/bin/sh
/bin/sh -
1⤵
PID:2956

/usr/bin/id
id -n -u 0
2⤵
PID:2957

/bin/sh
/bin/sh -
1⤵
PID:2958

/usr/bin/id
id -n -u 0
2⤵
PID:2959

/bin/sh
/bin/sh -
1⤵
PID:2960

/usr/bin/id
id -n -u 0
2⤵
PID:2961

/bin/sh
/bin/sh -
1⤵
PID:2962

/usr/bin/id
id -n -u 0
2⤵
PID:2963

/bin/sh
/bin/sh -
1⤵
PID:2964

/usr/bin/id
id -n -u 0
2⤵
PID:2965

/bin/sh
/bin/sh -
1⤵
PID:2966

/usr/bin/id
id -n -u 0
2⤵
PID:2967

/bin/sh
/bin/sh -
1⤵
PID:2968

/usr/bin/id
id -n -u 0
2⤵
PID:2969

/bin/sh
/bin/sh -
1⤵
PID:2970

/usr/bin/id
id -n -u 0
2⤵
PID:2971

/bin/sh
/bin/sh -
1⤵
PID:2972

/usr/bin/id
id -n -u 0
2⤵
PID:2973

/bin/sh
/bin/sh -
1⤵
PID:2974

/usr/bin/id
id -n -u 0
2⤵
PID:2975

/bin/sh
/bin/sh -
1⤵
PID:2976

/usr/bin/id
id -n -u 0
2⤵
PID:2977

/bin/sh
/bin/sh -
1⤵
PID:2978

/usr/bin/id
id -n -u 0
2⤵
PID:2979

/bin/sh
/bin/sh -
1⤵
PID:2980

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.ssh/authorized_keys
Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads