471c70b6764c6f719bab35b92678e323d53928a14617737a6fc994dc27d2a12e

Resubmissions

02/05/2024, 13:21

240502-qll18ahg3s 7

09/04/2024, 12:32

09/04/2024, 11:57

08/04/2024, 11:38

02/04/2024, 11:55

27/03/2024, 13:16

25/03/2024, 07:32

13/03/2024, 10:09

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
08/04/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
Size

8.1MB
MD5

e0efd46445731c6c35deffe8d9e47888
SHA1

219a2cc1df97fe0b51244f7238aa4114e858f1d0
SHA256

471c70b6764c6f719bab35b92678e323d53928a14617737a6fc994dc27d2a12e
SHA512

92a5438489316593f45f4afeca6e2a1654e75480f4670f58df5cb63091ec52dd8279b156a3949e2243dc350dbe31220b2ac433abb4250ddc238f70d295d1949d
SSDEEP

49152:az1q8M+srb/TIvO90dL3BmAFd4A64nsfJrYJaRM6CxN4+WqFottdpaCEy4SahdBV:auM2GebQyF66rNdvEoS5

Score

7^/10

antivm infostealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid
1484

Reads EFI boot settings 1 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

infostealer

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

Attempts to change immutable files 17 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1507	chattr
4699	Process not Found
4704	Process not Found
4710	Process not Found
1506	chattr
2511	chattr
3260	Process not Found
3976	Process not Found
3981	Process not Found
5419	Process not Found
5424	Process not Found
2533	chattr
3244	Process not Found
3986	Process not Found
1500	chattr
2395	chattr
3249	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	cat

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 30 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	journalctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/1473/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/1300/cmdline	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/242/cmdline	Process not Found
File opened for reading	/proc/20/cmdline	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/15/stat	Process not Found
File opened for reading	/proc/955/stat	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/81/cmdline	Process not Found
File opened for reading	/proc/268/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/1300/stat	Process not Found
File opened for reading	/proc/2/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/642/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/673/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/76/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/102/cmdline	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/2523/stat	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/961/cmdline	Process not Found
File opened for reading	/proc/16/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/2524/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/1122/cmdline	Process not Found
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/575/cmdline	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/497/stat	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/2514/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/1005/stat	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/808/cmdline	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/1213/cmdline	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/18/stat	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/92/cmdline	Process not Found

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.ssh/authorized_keys	Process not Found
File opened for modification	/tmp/.ssh/authorized_keys	5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5

/tmp/5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
/tmp/5fa7595c38e29ad36ff3ec76bf266f9c391510f773c7d8b43555db534332d763_patched_pkey_5
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1478
- /usr/bin/uname
  uname -a
  2⤵
  PID:1486
- /usr/bin/cat
  cat /etc/issue
  2⤵
  PID:1487
- /usr/bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1488
- /bin/sh
  /bin/sh -
  2⤵
  PID:1489
- - /usr/bin/whoami
    whoami
    3⤵
    PID:1490
- /bin/sh
  /bin/sh -
  2⤵
  PID:1491
- /usr/bin/free
  free -h
  2⤵
  - Reads CPU attributes
  PID:1492
- /bin/sh
  /bin/sh -
  2⤵
  PID:1493
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1495
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1494
- /bin/sh
  /bin/sh -
  2⤵
  PID:1510
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1512
- /usr/bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  - Reads EFI boot settings
  - Enumerates kernel/hardware configuration
  PID:1511
- /usr/bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:1522
- /usr/bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:1524
- /usr/local/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1524
- /usr/local/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1524
- /usr/sbin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1524
- /usr/bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1524
- /bin/sh
  /bin/sh -
  2⤵
  PID:1613
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1614
- /bin/sh
  /bin/sh -
  2⤵
  PID:1615
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:1616
- /bin/sh
  /bin/sh -
  2⤵
  PID:1617
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1618
- /bin/sh
  /bin/sh -
  2⤵
  PID:1619
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1620
- /bin/sh
  /bin/sh -
  2⤵
  PID:1621
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1622
- /bin/sh
  /bin/sh -
  2⤵
  PID:1623
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1624
- /bin/sh
  /bin/sh -
  2⤵
  PID:1625
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1626
- /bin/sh
  /bin/sh -
  2⤵
  PID:1627
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1628
- /bin/sh
  /bin/sh -
  2⤵
  PID:1629
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1630
- /bin/sh
  /bin/sh -
  2⤵
  PID:1631
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1632
- /bin/sh
  /bin/sh -
  2⤵
  PID:1633
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1634
- /bin/sh
  /bin/sh -
  2⤵
  PID:1635
- - /usr/bin/id
    id -n -u 121
    3⤵
    PID:1636
- /bin/sh
  /bin/sh -
  2⤵
  PID:1637
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1638
- /bin/sh
  /bin/sh -
  2⤵
  PID:1639
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1640
- /bin/sh
  /bin/sh -
  2⤵
  PID:1642
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1643
- /bin/sh
  /bin/sh -
  2⤵
  PID:1645
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1646
- /bin/sh
  /bin/sh -
  2⤵
  PID:1648
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1649
- /bin/sh
  /bin/sh -
  2⤵
  PID:1650
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1651
- /bin/sh
  /bin/sh -
  2⤵
  PID:1652
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1653
- /bin/sh
  /bin/sh -
  2⤵
  PID:1656
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1657
- /bin/sh
  /bin/sh -
  2⤵
  PID:1658
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1659
- /bin/sh
  /bin/sh -
  2⤵
  PID:1660
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1661
- /bin/sh
  /bin/sh -
  2⤵
  PID:1662
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1663
- /bin/sh
  /bin/sh -
  2⤵
  PID:1664
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1665
- /bin/sh
  /bin/sh -
  2⤵
  PID:1666
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1667
- /bin/sh
  /bin/sh -
  2⤵
  PID:1668
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1669
- /bin/sh
  /bin/sh -
  2⤵
  PID:1670
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1671
- /bin/sh
  /bin/sh -
  2⤵
  PID:1672
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1673
- /bin/sh
  /bin/sh -
  2⤵
  PID:1674
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1675
- /bin/sh
  /bin/sh -
  2⤵
  PID:1676
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1677
- /bin/sh
  /bin/sh -
  2⤵
  PID:1678
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1679
- /bin/sh
  /bin/sh -
  2⤵
  PID:1680
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1681
- /bin/sh
  /bin/sh -
  2⤵
  PID:1682
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1683
- /bin/sh
  /bin/sh -
  2⤵
  PID:1684
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1685
- /bin/sh
  /bin/sh -
  2⤵
  PID:1686
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1687
- /bin/sh
  /bin/sh -
  2⤵
  PID:1688
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1689
- /bin/sh
  /bin/sh -
  2⤵
  PID:1690
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1691
- /bin/sh
  /bin/sh -
  2⤵
  PID:1692
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1693
- /bin/sh
  /bin/sh -
  2⤵
  PID:1694
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1695
- /bin/sh
  /bin/sh -
  2⤵
  PID:1696
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1697
- /bin/sh
  /bin/sh -
  2⤵
  PID:1698
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1699
- /bin/sh
  /bin/sh -
  2⤵
  PID:1700
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1701
- /bin/sh
  /bin/sh -
  2⤵
  PID:1702
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:1703
- /bin/sh
  /bin/sh -
  2⤵
  PID:1704
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1705
- /bin/sh
  /bin/sh -
  2⤵
  PID:1706
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1707
- /bin/sh
  /bin/sh -
  2⤵
  PID:1708
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1709
- /bin/sh
  /bin/sh -
  2⤵
  PID:1710
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1711
- /bin/sh
  /bin/sh -
  2⤵
  PID:1714
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1715
- /bin/sh
  /bin/sh -
  2⤵
  PID:1717
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1720
- /bin/sh
  /bin/sh -
  2⤵
  PID:1721
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1722
- /bin/sh
  /bin/sh -
  2⤵
  PID:1725
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1726
- /bin/sh
  /bin/sh -
  2⤵
  PID:1729
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1730
- /bin/sh
  /bin/sh -
  2⤵
  PID:1732
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1733
- /bin/sh
  /bin/sh -
  2⤵
  PID:1735
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1736
- /bin/sh
  /bin/sh -
  2⤵
  PID:1739
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1740
- /bin/sh
  /bin/sh -
  2⤵
  PID:1743
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1744
- /bin/sh
  /bin/sh -
  2⤵
  PID:1747
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1748
- /bin/sh
  /bin/sh -
  2⤵
  PID:1749
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1750
- /bin/sh
  /bin/sh -
  2⤵
  PID:1751
- - /usr/bin/id
    id -n -u 101
    3⤵
    PID:1752
- /bin/sh
  /bin/sh -
  2⤵
  PID:1753
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1754
- /bin/sh
  /bin/sh -
  2⤵
  PID:1755
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1756
- /bin/sh
  /bin/sh -
  2⤵
  PID:1757
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1758
- /bin/sh
  /bin/sh -
  2⤵
  PID:1759
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1760
- /bin/sh
  /bin/sh -
  2⤵
  PID:1761
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1762
- /bin/sh
  /bin/sh -
  2⤵
  PID:1763
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1764
- /bin/sh
  /bin/sh -
  2⤵
  PID:1765
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1766
- /bin/sh
  /bin/sh -
  2⤵
  PID:1768
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1769
- /bin/sh
  /bin/sh -
  2⤵
  PID:1774
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1775
- /bin/sh
  /bin/sh -
  2⤵
  PID:1782
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1783
- /bin/sh
  /bin/sh -
  2⤵
  PID:1785
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1786
- /bin/sh
  /bin/sh -
  2⤵
  PID:1788
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1789
- /bin/sh
  /bin/sh -
  2⤵
  PID:1790
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1791
- /bin/sh
  /bin/sh -
  2⤵
  PID:1792
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1793
- /bin/sh
  /bin/sh -
  2⤵
  PID:1794
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1795
- /bin/sh
  /bin/sh -
  2⤵
  PID:1796
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1797
- /bin/sh
  /bin/sh -
  2⤵
  PID:1798
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1799
- /bin/sh
  /bin/sh -
  2⤵
  PID:1800
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1801
- /bin/sh
  /bin/sh -
  2⤵
  PID:1802
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1803
- /bin/sh
  /bin/sh -
  2⤵
  PID:1804
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1805
- /bin/sh
  /bin/sh -
  2⤵
  PID:1806
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1807
- /bin/sh
  /bin/sh -
  2⤵
  PID:1808
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1809
- /bin/sh
  /bin/sh -
  2⤵
  PID:1810
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1811
- /bin/sh
  /bin/sh -
  2⤵
  PID:1812
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1813
- /bin/sh
  /bin/sh -
  2⤵
  PID:1814
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1815
- /bin/sh
  /bin/sh -
  2⤵
  PID:1816
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1817
- /bin/sh
  /bin/sh -
  2⤵
  PID:1818
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1819
- /bin/sh
  /bin/sh -
  2⤵
  PID:1821
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1823
- /bin/sh
  /bin/sh -
  2⤵
  PID:1827
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1828
- /bin/sh
  /bin/sh -
  2⤵
  PID:1829
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1830
- /bin/sh
  /bin/sh -
  2⤵
  PID:1836
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1837
- /bin/sh
  /bin/sh -
  2⤵
  PID:1840
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1841
- /bin/sh
  /bin/sh -
  2⤵
  PID:1844
- - /usr/bin/id
    id -n -u 119
    3⤵
    PID:1846
- /bin/sh
  /bin/sh -
  2⤵
  PID:1848
- - /usr/bin/id
    id -n -u 116
    3⤵
    PID:1849
- /bin/sh
  /bin/sh -
  2⤵
  PID:1853
- - /usr/bin/id
    id -n -u 116
    3⤵
    PID:1854
- /bin/sh
  /bin/sh -
  2⤵
  PID:1858
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1859
- /bin/sh
  /bin/sh -
  2⤵
  PID:1863
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1865
- /bin/sh
  /bin/sh -
  2⤵
  PID:1868
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1869
- /bin/sh
  /bin/sh -
  2⤵
  PID:1871
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1874
- /bin/sh
  /bin/sh -
  2⤵
  PID:1880
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1881
- /bin/sh
  /bin/sh -
  2⤵
  PID:1888
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1889
- /bin/sh
  /bin/sh -
  2⤵
  PID:1900
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1904
- /bin/sh
  /bin/sh -
  2⤵
  PID:1912
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1913
- /bin/sh
  /bin/sh -
  2⤵
  PID:1914
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1915
- /bin/sh
  /bin/sh -
  2⤵
  PID:1918
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1920
- /bin/sh
  /bin/sh -
  2⤵
  PID:1923
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1924
- /bin/sh
  /bin/sh -
  2⤵
  PID:1928
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1929
- /bin/sh
  /bin/sh -
  2⤵
  PID:1932
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1933
- /bin/sh
  /bin/sh -
  2⤵
  PID:1936
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1937
- /bin/sh
  /bin/sh -
  2⤵
  PID:1940
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1941
- /bin/sh
  /bin/sh -
  2⤵
  PID:1944
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1945
- /bin/sh
  /bin/sh -
  2⤵
  PID:1948
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1949
- /bin/sh
  /bin/sh -
  2⤵
  PID:1951
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1952
- /bin/sh
  /bin/sh -
  2⤵
  PID:1963
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:1964
- /bin/sh
  /bin/sh -
  2⤵
  PID:1969
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1970
- /bin/sh
  /bin/sh -
  2⤵
  PID:1973
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1974
- /bin/sh
  /bin/sh -
  2⤵
  PID:1975
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1976
- /bin/sh
  /bin/sh -
  2⤵
  PID:1977
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1978
- /bin/sh
  /bin/sh -
  2⤵
  PID:1979
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1980
- /bin/sh
  /bin/sh -
  2⤵
  PID:1981
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1982
- /bin/sh
  /bin/sh -
  2⤵
  PID:1983
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1984
- /bin/sh
  /bin/sh -
  2⤵
  PID:1985
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1986
- /bin/sh
  /bin/sh -
  2⤵
  PID:1987
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1988
- /bin/sh
  /bin/sh -
  2⤵
  PID:1989
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1990
- /bin/sh
  /bin/sh -
  2⤵
  PID:1991
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1992
- /bin/sh
  /bin/sh -
  2⤵
  PID:1993
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1994
- /bin/sh
  /bin/sh -
  2⤵
  PID:1995
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1996
- /bin/sh
  /bin/sh -
  2⤵
  PID:1997
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:1998
- /bin/sh
  /bin/sh -
  2⤵
  PID:1999
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2000
- /bin/sh
  /bin/sh -
  2⤵
  PID:2001
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2002
- /bin/sh
  /bin/sh -
  2⤵
  PID:2003
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2004
- /bin/sh
  /bin/sh -
  2⤵
  PID:2005
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2006
- /bin/sh
  /bin/sh -
  2⤵
  PID:2007
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2008
- /bin/sh
  /bin/sh -
  2⤵
  PID:2009
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2010
- /bin/sh
  /bin/sh -
  2⤵
  PID:2011
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2012
- /bin/sh
  /bin/sh -
  2⤵
  PID:2013
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2014
- /bin/sh
  /bin/sh -
  2⤵
  PID:2015
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2016
- /bin/sh
  /bin/sh -
  2⤵
  PID:2017
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2018
- /bin/sh
  /bin/sh -
  2⤵
  PID:2019
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2020
- /bin/sh
  /bin/sh -
  2⤵
  PID:2021
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2022
- /bin/sh
  /bin/sh -
  2⤵
  PID:2023
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2024
- /bin/sh
  /bin/sh -
  2⤵
  PID:2025
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2026
- /bin/sh
  /bin/sh -
  2⤵
  PID:2027
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2028
- /bin/sh
  /bin/sh -
  2⤵
  PID:2029
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2030
- /bin/sh
  /bin/sh -
  2⤵
  PID:2031
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2032
- /bin/sh
  /bin/sh -
  2⤵
  PID:2033
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2034
- /bin/sh
  /bin/sh -
  2⤵
  PID:2035
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:2036
- /bin/sh
  /bin/sh -
  2⤵
  PID:2037
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2038
- /usr/bin/free
  free -h
  2⤵
  - Reads CPU attributes
  PID:2507
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:2508
- /bin/sh
  /bin/sh -
  2⤵
  PID:2509
- /bin/sh
  /bin/sh -
  2⤵
  PID:2510
- - /usr/bin/chattr
    chattr -ia .ssh/authorized_keys
    3⤵
    - Attempts to change immutable files
    PID:2511
- /usr/bin/free
  free -h
  2⤵
  - Reads CPU attributes
  PID:2529
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:2530
- /bin/sh
  /bin/sh -
  2⤵
  PID:2531
- /bin/sh
  /bin/sh -
  2⤵
  PID:2532
- - /usr/bin/chattr
    chattr -ia .ssh/authorized_keys
    3⤵
    - Attempts to change immutable files
    PID:2533
- /bin/sh
  /bin/sh -
  2⤵
  PID:2534
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2535
- /bin/sh
  /bin/sh -
  2⤵
  PID:2536
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2537
- /bin/sh
  /bin/sh -
  2⤵
  PID:2538
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2539
- /bin/sh
  /bin/sh -
  2⤵
  PID:2540
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2541
- /bin/sh
  /bin/sh -
  2⤵
  PID:2542
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2543
- /bin/sh
  /bin/sh -
  2⤵
  PID:2544
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2545
- /bin/sh
  /bin/sh -
  2⤵
  PID:2546
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2547
- /bin/sh
  /bin/sh -
  2⤵
  PID:2548
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2549
- /bin/sh
  /bin/sh -
  2⤵
  PID:2550
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2551
- /bin/sh
  /bin/sh -
  2⤵
  PID:2552
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2553
- /bin/sh
  /bin/sh -
  2⤵
  PID:2554
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2555
- /bin/sh
  /bin/sh -
  2⤵
  PID:2556
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2557
- /bin/sh
  /bin/sh -
  2⤵
  PID:2558
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2559
- /bin/sh
  /bin/sh -
  2⤵
  PID:2560
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2561
- /bin/sh
  /bin/sh -
  2⤵
  PID:2562
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2563
- /bin/sh
  /bin/sh -
  2⤵
  PID:2564
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2565
- /bin/sh
  /bin/sh -
  2⤵
  PID:2566
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2567
- /bin/sh
  /bin/sh -
  2⤵
  PID:2568
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2569
- /bin/sh
  /bin/sh -
  2⤵
  PID:2570
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:2571
- /bin/sh
  /bin/sh -
  2⤵
  PID:2572
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2573
- /bin/sh
  /bin/sh -
  2⤵
  PID:2574
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2575
- /bin/sh
  /bin/sh -
  2⤵
  PID:2576
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2577
- /bin/sh
  /bin/sh -
  2⤵
  PID:2578
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2579
- /bin/sh
  /bin/sh -
  2⤵
  PID:2580
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2581
- /bin/sh
  /bin/sh -
  2⤵
  PID:2582
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2583
- /bin/sh
  /bin/sh -
  2⤵
  PID:2584
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2585
- /bin/sh
  /bin/sh -
  2⤵
  PID:2586
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2587
- /bin/sh
  /bin/sh -
  2⤵
  PID:2588
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:2589
- /bin/sh
  /bin/sh -
  2⤵
  PID:2590
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2591
- /bin/sh
  /bin/sh -
  2⤵
  PID:2592
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2593
- /bin/sh
  /bin/sh -
  2⤵
  PID:2594
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2595
- /bin/sh
  /bin/sh -
  2⤵
  PID:2596
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2597
- /bin/sh
  /bin/sh -
  2⤵
  PID:2598
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2599
- /bin/sh
  /bin/sh -
  2⤵
  PID:2600
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2601
- /bin/sh
  /bin/sh -
  2⤵
  PID:2602
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2603
- /bin/sh
  /bin/sh -
  2⤵
  PID:2604
- - /usr/bin/id
    id -n -u 123
    3⤵
    - Reads runtime system information
    PID:2605
- /bin/sh
  /bin/sh -
  2⤵
  PID:2606
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2607
- /bin/sh
  /bin/sh -
  2⤵
  PID:2608
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2609
- /bin/sh
  /bin/sh -
  2⤵
  PID:2610
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2611
- /bin/sh
  /bin/sh -
  2⤵
  PID:2612
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2613
- /bin/sh
  /bin/sh -
  2⤵
  PID:2614
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2615
- /bin/sh
  /bin/sh -
  2⤵
  PID:2616
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2617
- /bin/sh
  /bin/sh -
  2⤵
  PID:2618
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2619
- /bin/sh
  /bin/sh -
  2⤵
  PID:2620
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2621
- /bin/sh
  /bin/sh -
  2⤵
  PID:2622
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2623
- /bin/sh
  /bin/sh -
  2⤵
  PID:2624
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2625
- /bin/sh
  /bin/sh -
  2⤵
  PID:2626
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2627
- /bin/sh
  /bin/sh -
  2⤵
  PID:2628
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2629
- /bin/sh
  /bin/sh -
  2⤵
  PID:2630
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2631
- /bin/sh
  /bin/sh -
  2⤵
  PID:2632
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2633
- /bin/sh
  /bin/sh -
  2⤵
  PID:2634
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2635
- /bin/sh
  /bin/sh -
  2⤵
  PID:2636
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2637
- /bin/sh
  /bin/sh -
  2⤵
  PID:2638
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2639
- /bin/sh
  /bin/sh -
  2⤵
  PID:2640
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2641
- /bin/sh
  /bin/sh -
  2⤵
  PID:2642
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2643
- /bin/sh
  /bin/sh -
  2⤵
  PID:2644
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2645
- /bin/sh
  /bin/sh -
  2⤵
  PID:2646
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2647
- /bin/sh
  /bin/sh -
  2⤵
  PID:2648
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2649
- /bin/sh
  /bin/sh -
  2⤵
  PID:2650
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:2651
- /bin/sh
  /bin/sh -
  2⤵
  PID:2652
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2653
- /bin/sh
  /bin/sh -
  2⤵
  PID:2654
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2655
- /bin/sh
  /bin/sh -
  2⤵
  PID:2656
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2657
- /bin/sh
  /bin/sh -
  2⤵
  PID:2658
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2659
- /bin/sh
  /bin/sh -
  2⤵
  PID:2660
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2661
- /bin/sh
  /bin/sh -
  2⤵
  PID:2662
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2663
- /bin/sh
  /bin/sh -
  2⤵
  PID:2664
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2665
- /bin/sh
  /bin/sh -
  2⤵
  PID:2666
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2667
- /bin/sh
  /bin/sh -
  2⤵
  PID:2668
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2669
- /bin/sh
  /bin/sh -
  2⤵
  PID:2670
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2671
- /bin/sh
  /bin/sh -
  2⤵
  PID:2672
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2673
- /bin/sh
  /bin/sh -
  2⤵
  PID:2674
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2675
- /bin/sh
  /bin/sh -
  2⤵
  PID:2676
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2677
- /bin/sh
  /bin/sh -
  2⤵
  PID:2678
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2679
- /bin/sh
  /bin/sh -
  2⤵
  PID:2680
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2681
- /bin/sh
  /bin/sh -
  2⤵
  PID:2682
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2683
- /bin/sh
  /bin/sh -
  2⤵
  PID:2684
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2685
- /bin/sh
  /bin/sh -
  2⤵
  PID:2686
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2687
- /bin/sh
  /bin/sh -
  2⤵
  PID:2688
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2689
- /bin/sh
  /bin/sh -
  2⤵
  PID:2690
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2691
- /bin/sh
  /bin/sh -
  2⤵
  PID:2692
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2693
- /bin/sh
  /bin/sh -
  2⤵
  PID:2694
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2695
- /bin/sh
  /bin/sh -
  2⤵
  PID:2696
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2697
- /bin/sh
  /bin/sh -
  2⤵
  PID:2698
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2699
- /bin/sh
  /bin/sh -
  2⤵
  PID:2700
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2701
- /bin/sh
  /bin/sh -
  2⤵
  PID:2702
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2703
- /bin/sh
  /bin/sh -
  2⤵
  PID:2704
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2705
- /bin/sh
  /bin/sh -
  2⤵
  PID:2706
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2707
- /bin/sh
  /bin/sh -
  2⤵
  PID:2708
- - /usr/bin/id
    id -n -u 101
    3⤵
    PID:2709
- /bin/sh
  /bin/sh -
  2⤵
  PID:2710
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2711
- /bin/sh
  /bin/sh -
  2⤵
  PID:2712
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2713
- /bin/sh
  /bin/sh -
  2⤵
  PID:2714
- - /usr/bin/id
    id -n -u 0
    3⤵
    - Reads runtime system information
    PID:2715
- /bin/sh
  /bin/sh -
  2⤵
  PID:2716
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2717
- /bin/sh
  /bin/sh -
  2⤵
  PID:2718
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2719
- /bin/sh
  /bin/sh -
  2⤵
  PID:2720
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2721
- /bin/sh
  /bin/sh -
  2⤵
  PID:2722
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2723
- /bin/sh
  /bin/sh -
  2⤵
  PID:2724
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2725
- /bin/sh
  /bin/sh -
  2⤵
  PID:2726
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2727
- /bin/sh
  /bin/sh -
  2⤵
  PID:2728
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2729
- /bin/sh
  /bin/sh -
  2⤵
  PID:2730
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2731
- /bin/sh
  /bin/sh -
  2⤵
  PID:2732
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2733
- /bin/sh
  /bin/sh -
  2⤵
  PID:2734
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2735
- /bin/sh
  /bin/sh -
  2⤵
  PID:2736
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2737
- /bin/sh
  /bin/sh -
  2⤵
  PID:2738
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2739
- /bin/sh
  /bin/sh -
  2⤵
  PID:2740
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2741
- /bin/sh
  /bin/sh -
  2⤵
  PID:2742
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2743
- /bin/sh
  /bin/sh -
  2⤵
  PID:2744
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2745
- /bin/sh
  /bin/sh -
  2⤵
  PID:2746
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2747
- /bin/sh
  /bin/sh -
  2⤵
  PID:2748
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2749
- /bin/sh
  /bin/sh -
  2⤵
  PID:2750
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2751
- /bin/sh
  /bin/sh -
  2⤵
  PID:2752
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2753
- /bin/sh
  /bin/sh -
  2⤵
  PID:2754
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2755
- /bin/sh
  /bin/sh -
  2⤵
  PID:2756
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2757
- /bin/sh
  /bin/sh -
  2⤵
  PID:2758
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2759
- /bin/sh
  /bin/sh -
  2⤵
  PID:2760
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2761
- /bin/sh
  /bin/sh -
  2⤵
  PID:2762
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2763
- /bin/sh
  /bin/sh -
  2⤵
  PID:2764
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2765
- /bin/sh
  /bin/sh -
  2⤵
  PID:2766
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2767
- /bin/sh
  /bin/sh -
  2⤵
  PID:2768
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2769
- /bin/sh
  /bin/sh -
  2⤵
  PID:2770
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2771
- /bin/sh
  /bin/sh -
  2⤵
  PID:2772
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2773
- /bin/sh
  /bin/sh -
  2⤵
  PID:2774
- - /usr/bin/id
    id -n -u 119
    3⤵
    PID:2775
- /bin/sh
  /bin/sh -
  2⤵
  PID:2776
- - /usr/bin/id
    id -n -u 116
    3⤵
    PID:2777
- /bin/sh
  /bin/sh -
  2⤵
  PID:2778
- - /usr/bin/id
    id -n -u 116
    3⤵
    PID:2779
- /bin/sh
  /bin/sh -
  2⤵
  PID:2780
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2781
- /bin/sh
  /bin/sh -
  2⤵
  PID:2782
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2783
- /bin/sh
  /bin/sh -
  2⤵
  PID:2784
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2785
- /bin/sh
  /bin/sh -
  2⤵
  PID:2786
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2787
- /bin/sh
  /bin/sh -
  2⤵
  PID:2788
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2789
- /bin/sh
  /bin/sh -
  2⤵
  PID:2790
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2791
- /bin/sh
  /bin/sh -
  2⤵
  PID:2792
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2793
- /bin/sh
  /bin/sh -
  2⤵
  PID:2794
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2795
- /bin/sh
  /bin/sh -
  2⤵
  PID:2796
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2797
- /bin/sh
  /bin/sh -
  2⤵
  PID:2798
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2799
- /bin/sh
  /bin/sh -
  2⤵
  PID:2800
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2801
- /bin/sh
  /bin/sh -
  2⤵
  PID:2802
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2803
- /bin/sh
  /bin/sh -
  2⤵
  PID:2804
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2805
- /bin/sh
  /bin/sh -
  2⤵
  PID:2806
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2807
- /bin/sh
  /bin/sh -
  2⤵
  PID:2808
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2809
- /bin/sh
  /bin/sh -
  2⤵
  PID:2810
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2811
- /bin/sh
  /bin/sh -
  2⤵
  PID:2812
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2813
- /bin/sh
  /bin/sh -
  2⤵
  PID:2814
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2815
- /bin/sh
  /bin/sh -
  2⤵
  PID:2816
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2817
- /bin/sh
  /bin/sh -
  2⤵
  PID:2818
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2819
- /bin/sh
  /bin/sh -
  2⤵
  PID:2820
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2821
- /bin/sh
  /bin/sh -
  2⤵
  PID:2822
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2823
- /bin/sh
  /bin/sh -
  2⤵
  PID:2824
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2825
- /bin/sh
  /bin/sh -
  2⤵
  PID:2826
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2827
- /bin/sh
  /bin/sh -
  2⤵
  PID:2828
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2829
- /bin/sh
  /bin/sh -
  2⤵
  PID:2830
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2831
- /bin/sh
  /bin/sh -
  2⤵
  PID:2832
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2833
- /bin/sh
  /bin/sh -
  2⤵
  PID:2834
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2835
- /bin/sh
  /bin/sh -
  2⤵
  PID:2836
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2837
- /bin/sh
  /bin/sh -
  2⤵
  PID:2838
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2839
- /bin/sh
  /bin/sh -
  2⤵
  PID:2840
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2841
- /bin/sh
  /bin/sh -
  2⤵
  PID:2842
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2843
- /bin/sh
  /bin/sh -
  2⤵
  PID:2844
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2845
- /bin/sh
  /bin/sh -
  2⤵
  PID:2846
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2847
- /bin/sh
  /bin/sh -
  2⤵
  PID:2848
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2849
- /bin/sh
  /bin/sh -
  2⤵
  PID:2850
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2851
- /bin/sh
  /bin/sh -
  2⤵
  PID:2852
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2853
- /bin/sh
  /bin/sh -
  2⤵
  PID:2854
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2855
- /bin/sh
  /bin/sh -
  2⤵
  PID:2856
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2857
- /bin/sh
  /bin/sh -
  2⤵
  PID:2858
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2859
- /bin/sh
  /bin/sh -
  2⤵
  PID:2860
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2861
- /bin/sh
  /bin/sh -
  2⤵
  PID:2862
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2863
- /bin/sh
  /bin/sh -
  2⤵
  PID:2864
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2865
- /bin/sh
  /bin/sh -
  2⤵
  PID:2866
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2867
- /bin/sh
  /bin/sh -
  2⤵
  PID:2868
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2869
- /bin/sh
  /bin/sh -
  2⤵
  PID:2870
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2871
- /bin/sh
  /bin/sh -
  2⤵
  PID:2872
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2873
- /bin/sh
  /bin/sh -
  2⤵
  PID:2874
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2875
- /bin/sh
  /bin/sh -
  2⤵
  PID:2876
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2877
- /bin/sh
  /bin/sh -
  2⤵
  PID:2878
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2879
- /bin/sh
  /bin/sh -
  2⤵
  PID:2880
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2881
- /bin/sh
  /bin/sh -
  2⤵
  PID:2882
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2883
- /bin/sh
  /bin/sh -
  2⤵
  PID:2884
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2885
- /bin/sh
  /bin/sh -
  2⤵
  PID:2886
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2887
- /bin/sh
  /bin/sh -
  2⤵
  PID:2888
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2889
- /bin/sh
  /bin/sh -
  2⤵
  PID:2890
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2891
- /bin/sh
  /bin/sh -
  2⤵
  PID:2892
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2893
- /bin/sh
  /bin/sh -
  2⤵
  PID:2894
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2895
- /bin/sh
  /bin/sh -
  2⤵
  PID:2896
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2897
- /bin/sh
  /bin/sh -
  2⤵
  PID:2898
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2899
- /bin/sh
  /bin/sh -
  2⤵
  PID:2900
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2901
- /bin/sh
  /bin/sh -
  2⤵
  PID:2902
- - /usr/bin/id
    id -n -u 0
    3⤵
    PID:2903

/bin/sh
/bin/sh -
1⤵
PID:1496

/bin/sh
/bin/sh -
1⤵
PID:1497
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1498

/bin/sh
/bin/sh -
1⤵
PID:1499
- /usr/bin/chattr
  chattr -ia .ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:1500

/bin/sh
/bin/sh -
1⤵
PID:1501

/bin/sh
/bin/sh -
1⤵
PID:1502
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1504

/bin/sh
/bin/sh -
1⤵
PID:1503
- /usr/bin/chattr
  chattr +ia .ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:1506

/bin/sh
/bin/sh -
1⤵
PID:1505
- /usr/bin/chattr
  chattr -ia .ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:1507

/bin/sh
/bin/sh -
1⤵
PID:1508
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1509

/bin/sh
/bin/sh -
1⤵
PID:1513
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1514

/bin/sh
/bin/sh -
1⤵
PID:1515
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1516

/bin/sh
/bin/sh -
1⤵
PID:1517
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1518

/bin/sh
/bin/sh -
1⤵
PID:1519
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1520

/bin/sh
/bin/sh -
1⤵
PID:1521
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1523

/bin/sh
/bin/sh -
1⤵
PID:1525
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1527

/bin/sh
/bin/sh -
1⤵
PID:1526
- /usr/bin/cat
  cat "~/.ssh/known_hosts"
  2⤵
  PID:1528

/bin/sh
/bin/sh -
1⤵
PID:1529
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1531

/bin/sh
/bin/sh -
1⤵
PID:1530
- /usr/bin/grep
  grep -E "(scp|ssh)"
  2⤵
  PID:1533

/bin/sh
/bin/sh -
1⤵
PID:1534
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1535

/bin/sh
/bin/sh -
1⤵
PID:1536
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1537

/bin/sh
/bin/sh -
1⤵
PID:1538
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1539

/bin/sh
/bin/sh -
1⤵
PID:1540
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1541

/bin/sh
/bin/sh -
1⤵
PID:1542
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1543

/bin/sh
/bin/sh -
1⤵
PID:1544
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1545

/bin/sh
/bin/sh -
1⤵
PID:1546
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1547

/bin/sh
/bin/sh -
1⤵
PID:1548
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1549

/bin/sh
/bin/sh -
1⤵
PID:1550
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1551

/bin/sh
/bin/sh -
1⤵
PID:1552
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1553

/bin/sh
/bin/sh -
1⤵
PID:1554
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1555

/bin/sh
/bin/sh -
1⤵
PID:1556
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1557

/bin/sh
/bin/sh -
1⤵
PID:1558
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1559

/bin/sh
/bin/sh -
1⤵
PID:1562
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1563

/bin/sh
/bin/sh -
1⤵
PID:1564
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1565

/bin/sh
/bin/sh -
1⤵
PID:1566
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1567

/bin/sh
/bin/sh -
1⤵
PID:1568
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1569

/bin/sh
/bin/sh -
1⤵
PID:1570
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1571

/bin/sh
/bin/sh -
1⤵
PID:1572
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1573

/bin/sh
/bin/sh -
1⤵
PID:1574
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1575

/bin/sh
/bin/sh -
1⤵
PID:1576
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1577

/bin/sh
/bin/sh -
1⤵
PID:1578
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1579

/bin/sh
/bin/sh -
1⤵
PID:1580
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1581

/bin/sh
/bin/sh -
1⤵
PID:1583
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1584

/bin/sh
/bin/sh -
1⤵
PID:1585
- /usr/bin/id
  id -n -u 123
  2⤵
  PID:1586

/bin/sh
/bin/sh -
1⤵
PID:1587
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1588

/bin/sh
/bin/sh -
1⤵
PID:1589
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1590

/bin/sh
/bin/sh -
1⤵
PID:1591
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1592

/bin/sh
/bin/sh -
1⤵
PID:1593
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1594

/bin/sh
/bin/sh -
1⤵
PID:1595
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1596

/bin/sh
/bin/sh -
1⤵
PID:1597
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1598

/bin/sh
/bin/sh -
1⤵
PID:1599
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1600

/bin/sh
/bin/sh -
1⤵
PID:1601
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1602

/bin/sh
/bin/sh -
1⤵
PID:1603
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1604

/bin/sh
/bin/sh -
1⤵
PID:1605
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1606

/bin/sh
/bin/sh -
1⤵
PID:1607
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1608

/bin/sh
/bin/sh -
1⤵
PID:1609
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1610

/bin/sh
/bin/sh -
1⤵
PID:1611
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:1612

/usr/bin/free
free -h
1⤵
- Reads CPU attributes
PID:2391

/usr/bin/uptime
uptime
1⤵
- Reads CPU attributes
PID:2392

/bin/sh
/bin/sh -
1⤵
PID:2393

/bin/sh
/bin/sh -
1⤵
PID:2394
- /usr/bin/chattr
  chattr -ia .ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:2395

/bin/sh
/bin/sh -
1⤵
PID:2904
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2905

/bin/sh
/bin/sh -
1⤵
PID:2906
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2907

/bin/sh
/bin/sh -
1⤵
PID:2908
- /usr/bin/id
  id -n -u 0
  2⤵
  - Reads runtime system information
  PID:2909

/bin/sh
/bin/sh -
1⤵
PID:2910
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2911

/bin/sh
/bin/sh -
1⤵
PID:2912
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2913

/bin/sh
/bin/sh -
1⤵
PID:2914
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2915

/bin/sh
/bin/sh -
1⤵
PID:2916
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2917

/bin/sh
/bin/sh -
1⤵
PID:2918
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2919

/bin/sh
/bin/sh -
1⤵
PID:2920
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2921

/bin/sh
/bin/sh -
1⤵
PID:2922
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2923

/bin/sh
/bin/sh -
1⤵
PID:2924
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2925

/bin/sh
/bin/sh -
1⤵
PID:2926
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2927

/bin/sh
/bin/sh -
1⤵
PID:2928
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2929

/bin/sh
/bin/sh -
1⤵
PID:2930
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2931

/bin/sh
/bin/sh -
1⤵
PID:2932
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2933

/bin/sh
/bin/sh -
1⤵
PID:2934
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2935

/bin/sh
/bin/sh -
1⤵
PID:2936
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2937

/bin/sh
/bin/sh -
1⤵
PID:2938
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2939

/bin/sh
/bin/sh -
1⤵
PID:2940
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2941

/bin/sh
/bin/sh -
1⤵
PID:2942
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2943

/bin/sh
/bin/sh -
1⤵
PID:2944
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2945

/bin/sh
/bin/sh -
1⤵
PID:2946
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2947

/bin/sh
/bin/sh -
1⤵
PID:2948
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2949

/bin/sh
/bin/sh -
1⤵
PID:2950
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2951

/bin/sh
/bin/sh -
1⤵
PID:2952
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2953

/bin/sh
/bin/sh -
1⤵
PID:2954
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2955

/bin/sh
/bin/sh -
1⤵
PID:2956
- /usr/bin/id
  id -n -u 123
  2⤵
  PID:2957

/bin/sh
/bin/sh -
1⤵
PID:2958
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2959

/bin/sh
/bin/sh -
1⤵
PID:2960
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2961

/bin/sh
/bin/sh -
1⤵
PID:2962
- /usr/bin/id
  id -n -u 0
  2⤵
  - Reads runtime system information
  PID:2963

/bin/sh
/bin/sh -
1⤵
PID:2964
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2965

/bin/sh
/bin/sh -
1⤵
PID:2966
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2967

/bin/sh
/bin/sh -
1⤵
PID:2968
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2969

/bin/sh
/bin/sh -
1⤵
PID:2970
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2971

/bin/sh
/bin/sh -
1⤵
PID:2972
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2973

/bin/sh
/bin/sh -
1⤵
PID:2974
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2975

/bin/sh
/bin/sh -
1⤵
PID:2976
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2977

/bin/sh
/bin/sh -
1⤵
PID:2978
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2979

/bin/sh
/bin/sh -
1⤵
PID:2980
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2981

/bin/sh
/bin/sh -
1⤵
PID:2982
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2983

/bin/sh
/bin/sh -
1⤵
PID:2984
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2985

/bin/sh
/bin/sh -
1⤵
PID:2986
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2987

/bin/sh
/bin/sh -
1⤵
PID:2988
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2989

/bin/sh
/bin/sh -
1⤵
PID:2990
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2991

/bin/sh
/bin/sh -
1⤵
PID:2992
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2993

/bin/sh
/bin/sh -
1⤵
PID:2994
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2995

/bin/sh
/bin/sh -
1⤵
PID:2996
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2997

/bin/sh
/bin/sh -
1⤵
PID:2998
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:2999

/bin/sh
/bin/sh -
1⤵
PID:3000
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3001

/bin/sh
/bin/sh -
1⤵
PID:3002
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3003

/bin/sh
/bin/sh -
1⤵
PID:3004
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3005

/bin/sh
/bin/sh -
1⤵
PID:3006
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3007

/bin/sh
/bin/sh -
1⤵
PID:3008
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3009

/bin/sh
/bin/sh -
1⤵
PID:3010
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3011

/bin/sh
/bin/sh -
1⤵
PID:3012
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3013

/bin/sh
/bin/sh -
1⤵
PID:3014
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3015

/bin/sh
/bin/sh -
1⤵
PID:3016
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3017

/bin/sh
/bin/sh -
1⤵
PID:3018
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3019

/bin/sh
/bin/sh -
1⤵
PID:3020
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3021

/bin/sh
/bin/sh -
1⤵
PID:3022
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3023

/bin/sh
/bin/sh -
1⤵
PID:3024
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3025

/bin/sh
/bin/sh -
1⤵
PID:3026
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3027

/bin/sh
/bin/sh -
1⤵
PID:3028
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3029

/bin/sh
/bin/sh -
1⤵
PID:3030
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3031

/bin/sh
/bin/sh -
1⤵
PID:3032
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3033

/bin/sh
/bin/sh -
1⤵
PID:3034
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3035

/bin/sh
/bin/sh -
1⤵
PID:3036
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3037

/bin/sh
/bin/sh -
1⤵
PID:3038
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3039

/bin/sh
/bin/sh -
1⤵
PID:3040
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3041

/bin/sh
/bin/sh -
1⤵
PID:3042
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3043

/bin/sh
/bin/sh -
1⤵
PID:3044
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3045

/bin/sh
/bin/sh -
1⤵
PID:3046
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3047

/bin/sh
/bin/sh -
1⤵
PID:3048
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3049

/bin/sh
/bin/sh -
1⤵
PID:3050
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3051

/bin/sh
/bin/sh -
1⤵
PID:3052
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3053

/bin/sh
/bin/sh -
1⤵
PID:3054
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3055

/bin/sh
/bin/sh -
1⤵
PID:3056
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3057

/bin/sh
/bin/sh -
1⤵
PID:3058
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3059

/bin/sh
/bin/sh -
1⤵
PID:3060
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3061

/bin/sh
/bin/sh -
1⤵
PID:3062
- /usr/bin/id
  id -n -u 101
  2⤵
  PID:3063

/bin/sh
/bin/sh -
1⤵
PID:3064
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3065

/bin/sh
/bin/sh -
1⤵
PID:3066
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3067

/bin/sh
/bin/sh -
1⤵
PID:3068
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3069

/bin/sh
/bin/sh -
1⤵
PID:3070
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3071

/bin/sh
/bin/sh -
1⤵
PID:3072
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3073

/bin/sh
/bin/sh -
1⤵
PID:3074
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3075

/bin/sh
/bin/sh -
1⤵
PID:3076
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3077

/bin/sh
/bin/sh -
1⤵
PID:3078
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3079

/bin/sh
/bin/sh -
1⤵
PID:3080
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3081

/bin/sh
/bin/sh -
1⤵
PID:3082
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3083

/bin/sh
/bin/sh -
1⤵
PID:3084
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3085

/bin/sh
/bin/sh -
1⤵
PID:3086
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3087

/bin/sh
/bin/sh -
1⤵
PID:3088
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3089

/bin/sh
/bin/sh -
1⤵
PID:3090
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3091

/bin/sh
/bin/sh -
1⤵
PID:3092
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3093

/bin/sh
/bin/sh -
1⤵
PID:3094
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3095

/bin/sh
/bin/sh -
1⤵
PID:3096
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3097

/bin/sh
/bin/sh -
1⤵
PID:3098
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3099

/bin/sh
/bin/sh -
1⤵
PID:3100
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3101

/bin/sh
/bin/sh -
1⤵
PID:3102
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3103

/bin/sh
/bin/sh -
1⤵
PID:3104
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3105

/bin/sh
/bin/sh -
1⤵
PID:3106
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3107

/bin/sh
/bin/sh -
1⤵
PID:3108
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3109

/bin/sh
/bin/sh -
1⤵
PID:3110
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3111

/bin/sh
/bin/sh -
1⤵
PID:3112
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3113

/bin/sh
/bin/sh -
1⤵
PID:3114
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3115

/bin/sh
/bin/sh -
1⤵
PID:3116
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3117

/bin/sh
/bin/sh -
1⤵
PID:3118
- /usr/bin/id
  id -n -u 0
  2⤵
  PID:3119

/bin/sh
/bin/sh -
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.ssh/authorized_keys

Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads