xmrig_linux | 57fedfb431a717031f454d4fb2809d1f6d432a9edd900b07f0b9f9aca7fb3597

Analysis

max time kernel
0s
max time network
482s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05-07-2024 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app
Size

5.3MB
MD5

4963fb33ca90b2393505d93287daecdc
SHA1

3457db72ae702ce655f01dbf722d280dd8f69b42
SHA256

57fedfb431a717031f454d4fb2809d1f6d432a9edd900b07f0b9f9aca7fb3597
SHA512

0825e4def1ba15f605686e2186f79413fff5e36ca60b011e5008c9c9fba39f1c368736a5b4ea6f00191a1751268e656e579771e2860376c20bb14a83bd2ee78c
SSDEEP

98304:w9k98Zr/RLWOb2sYGDzHIZBy9X4isF5IiPE/1EuoBdiQYgkiqRMFBEJyq4P3kTIL:edUBdVq4MTbSZ7

Score

10^/10

xmrig_linux antivm miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	app
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	app
File opened for reading	/sys/devices/virtual/dmi/id/product_name	app
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	app

Enumerates running processes
Discovers information about currently running processes on the system

Reads hardware information 1 TTPs 14 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	app
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	app
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	app
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	app
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	app
File opened for reading	/sys/devices/virtual/dmi/id/product_version	app
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	app
File opened for reading	/sys/devices/virtual/dmi/id/board_name	app
File opened for reading	/sys/devices/virtual/dmi/id/board_version	app
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	app
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	app
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	app
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	app
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	app

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	app

Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	app
File opened for reading	/sys/devices/system/cpu/possible	app

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/level	app
File opened for reading	/sys/kernel/mm/hugepages	app
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/thread_siblings	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition	app
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/core_siblings	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/id	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/size	app
File opened for reading	/sys/bus/dax/devices	app
File opened for reading	/sys/bus/cpu/devices	app
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/die_cpus	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/level	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cpufreq/base_frequency	app
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/physical_package_id	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/id	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/id	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map	app
File opened for reading	/sys/bus/node/devices/node0/cpumap	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/level	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/type	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets	app
File opened for reading	/sys/bus/node/devices/node0/meminfo	app
File opened for reading	/sys/bus/node/devices/node0/access0/initiators/read_latency	app
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/cluster_cpus	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/size	app
File opened for reading	/sys/devices/system/node/online	app
File opened for reading	/sys/bus/node/devices/node0/access1/initiators	app
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.cpus	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map	app
File opened for reading	/sys/bus/node/devices/node0/access0/initiators	app
File opened for reading	/sys/bus/node/devices/node0/access0/initiators/read_bandwidth	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/type	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cpufreq/cpuinfo_max_freq	app
File opened for reading	/sys/bus/cpu/devices/cpu0/topology/core_id	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/level	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition	app
File opened for reading	/sys/bus/node/devices/node0/hugepages	app
File opened for reading	/sys/fs/cgroup/unified/cgroup.controllers	app
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.mems	app
File opened for reading	/sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages	app
File opened for reading	/sys/devices/virtual/dmi/id	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/size	app
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/type	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/id	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cpu_capacity	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map	app
File opened for reading	/sys/bus/cpu/devices/cpu0/cache/index3/type	app

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/459/cmdline	cut
File opened for reading	/proc/1173/cmdline	cut
File opened for reading	/proc/1240/cmdline	cut
File opened for reading	/proc/sys/cmdline	cut
File opened for reading	/proc/21/cmdline	cut
File opened for reading	/proc/22/cmdline	cut
File opened for reading	/proc/82/cmdline	cut
File opened for reading	/proc/172/cmdline	cut
File opened for reading	/proc/507/cmdline	cut
File opened for reading	/proc/1029/cmdline	cut
File opened for reading	/proc/1140/cmdline	cut
File opened for reading	/proc/1/cmdline	cut
File opened for reading	/proc/1275/cmdline	cut
File opened for reading	/proc/1157/cmdline	cut
File opened for reading	/proc/3/cmdline	cut
File opened for reading	/proc/26/cmdline	cut
File opened for reading	/proc/405/cmdline	cut
File opened for reading	/proc/420/cmdline	cut
File opened for reading	/proc/436/cmdline	cut
File opened for reading	/proc/2/cmdline	cut
File opened for reading	/proc/164/cmdline	cut
File opened for reading	/proc/165/cmdline	cut
File opened for reading	/proc/driver/nvidia/gpus	app
File opened for reading	/proc/78/cmdline	cut
File opened for reading	/proc/161/cmdline	cut
File opened for reading	/proc/412/cmdline	cut
File opened for reading	/proc/536/cmdline	cut
File opened for reading	/proc/587/cmdline	cut
File opened for reading	/proc/1141/cmdline	cut
File opened for reading	/proc/1239/cmdline	cut
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1283/cmdline	cut
File opened for reading	/proc/1274/cmdline	cut
File opened for reading	/proc/559/cmdline	cut
File opened for reading	/proc/1073/cmdline	cut
File opened for reading	/proc/1077/cmdline	cut
File opened for reading	/proc/1101/cmdline	cut
File opened for reading	/proc/1114/cmdline	cut
File opened for reading	/proc/1154/cmdline	cut
File opened for reading	/proc/159/cmdline	cut
File opened for reading	/proc/thread-self/cmdline	cut
File opened for reading	/proc/29/cmdline	cut
File opened for reading	/proc/30/cmdline	cut
File opened for reading	/proc/83/cmdline	cut
File opened for reading	/proc/157/cmdline	cut
File opened for reading	/proc/170/cmdline	cut
File opened for reading	/proc/267/cmdline	cut
File opened for reading	/proc/self/cpuset	app
File opened for reading	/proc/699/cmdline	cut
File opened for reading	/proc/1086/cmdline	cut
File opened for reading	/proc/424/cmdline	cut
File opened for reading	/proc/538/cmdline	cut
File opened for reading	/proc/942/cmdline	cut
File opened for reading	/proc/1122/cmdline	cut
File opened for reading	/proc/1309/cmdline	cut
File opened for reading	/proc/18/cmdline	cut
File opened for reading	/proc/mtrr/cmdline	cut
File opened for reading	/proc/32/cmdline	cut
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/129/cmdline	cut
File opened for reading	/proc/1050/cmdline	cut
File opened for reading	/proc/1255/cmdline	cut
File opened for reading	/proc/bus/cmdline	cut
File opened for reading	/proc/irq/cmdline	cut

/tmp/app
/tmp/app
1⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1478
- /bin/sh
  sh -c "find /proc -maxdepth 1 -mmin +0.2 -user \$(whoami) | xargs -I {} cut -b 1- {}/cmdline | sed 's/\\o0/ /g' | shuf -n 1 -"
  2⤵
  PID:1479
- - /usr/bin/shuf
    shuf -n 1 -
    3⤵
    PID:1483
- - /bin/sed
    sed "s/\\o0/ /g"
    3⤵
    - Reads runtime system information
    PID:1482
- - /usr/bin/xargs
    xargs -I "{}" cut -b 1- "{}/cmdline"
    3⤵
    - Reads runtime system information
    PID:1481
  - - /usr/local/sbin/cut
      cut -b 1- /proc/cmdline
      4⤵
      PID:1485
  - - /usr/local/bin/cut
      cut -b 1- /proc/cmdline
      4⤵
      PID:1485
  - - /usr/sbin/cut
      cut -b 1- /proc/cmdline
      4⤵
      PID:1485
  - - /usr/bin/cut
      cut -b 1- /proc/cmdline
      4⤵
      PID:1485
  - - /usr/local/sbin/cut
      cut -b 1- /proc/fs/cmdline
      4⤵
      PID:1486
  - - /usr/local/bin/cut
      cut -b 1- /proc/fs/cmdline
      4⤵
      PID:1486
  - - /usr/sbin/cut
      cut -b 1- /proc/fs/cmdline
      4⤵
      PID:1486
  - - /usr/bin/cut
      cut -b 1- /proc/fs/cmdline
      4⤵
      PID:1486
  - - /usr/local/sbin/cut
      cut -b 1- /proc/bus/cmdline
      4⤵
      PID:1487
  - - /usr/local/bin/cut
      cut -b 1- /proc/bus/cmdline
      4⤵
      PID:1487
  - - /usr/sbin/cut
      cut -b 1- /proc/bus/cmdline
      4⤵
      PID:1487
  - - /usr/bin/cut
      cut -b 1- /proc/bus/cmdline
      4⤵
      Reads runtime system information
      PID:1487
  - - /usr/local/sbin/cut
      cut -b 1- /proc/irq/cmdline
      4⤵
      PID:1488
  - - /usr/local/bin/cut
      cut -b 1- /proc/irq/cmdline
      4⤵
      PID:1488
  - - /usr/sbin/cut
      cut -b 1- /proc/irq/cmdline
      4⤵
      PID:1488
  - - /usr/bin/cut
      cut -b 1- /proc/irq/cmdline
      4⤵
      Reads runtime system information
      PID:1488
  - - /usr/local/sbin/cut
      cut -b 1- /proc/sys/cmdline
      4⤵
      PID:1489
  - - /usr/local/bin/cut
      cut -b 1- /proc/sys/cmdline
      4⤵
      PID:1489
  - - /usr/sbin/cut
      cut -b 1- /proc/sys/cmdline
      4⤵
      PID:1489
  - - /usr/bin/cut
      cut -b 1- /proc/sys/cmdline
      4⤵
      Reads runtime system information
      PID:1489
  - - /usr/local/sbin/cut
      cut -b 1- /proc/acpi/cmdline
      4⤵
      PID:1490
  - - /usr/local/bin/cut
      cut -b 1- /proc/acpi/cmdline
      4⤵
      PID:1490
  - - /usr/sbin/cut
      cut -b 1- /proc/acpi/cmdline
      4⤵
      PID:1490
  - - /usr/bin/cut
      cut -b 1- /proc/acpi/cmdline
      4⤵
      PID:1490
  - - /usr/local/sbin/cut
      cut -b 1- /proc/kmsg/cmdline
      4⤵
      PID:1491
  - - /usr/local/bin/cut
      cut -b 1- /proc/kmsg/cmdline
      4⤵
      PID:1491
  - - /usr/sbin/cut
      cut -b 1- /proc/kmsg/cmdline
      4⤵
      PID:1491
  - - /usr/bin/cut
      cut -b 1- /proc/kmsg/cmdline
      4⤵
      PID:1491
  - - /usr/local/sbin/cut
      cut -b 1- /proc/mtrr/cmdline
      4⤵
      PID:1492
  - - /usr/local/bin/cut
      cut -b 1- /proc/mtrr/cmdline
      4⤵
      PID:1492
  - - /usr/sbin/cut
      cut -b 1- /proc/mtrr/cmdline
      4⤵
      PID:1492
  - - /usr/bin/cut
      cut -b 1- /proc/mtrr/cmdline
      4⤵
      Reads runtime system information
      PID:1492
  - - /usr/local/sbin/cut
      cut -b 1- /proc/swaps/cmdline
      4⤵
      PID:1493
  - - /usr/local/bin/cut
      cut -b 1- /proc/swaps/cmdline
      4⤵
      PID:1493
  - - /usr/sbin/cut
      cut -b 1- /proc/swaps/cmdline
      4⤵
      PID:1493
  - - /usr/bin/cut
      cut -b 1- /proc/swaps/cmdline
      4⤵
      PID:1493
  - - /usr/local/sbin/cut
      cut -b 1- /proc/sysrq-trigger/cmdline
      4⤵
      PID:1494
  - - /usr/local/bin/cut
      cut -b 1- /proc/sysrq-trigger/cmdline
      4⤵
      PID:1494
  - - /usr/sbin/cut
      cut -b 1- /proc/sysrq-trigger/cmdline
      4⤵
      PID:1494
  - - /usr/bin/cut
      cut -b 1- /proc/sysrq-trigger/cmdline
      4⤵
      PID:1494
  - - /usr/local/sbin/cut
      cut -b 1- /proc/self/cmdline
      4⤵
      PID:1495
  - - /usr/local/bin/cut
      cut -b 1- /proc/self/cmdline
      4⤵
      PID:1495
  - - /usr/sbin/cut
      cut -b 1- /proc/self/cmdline
      4⤵
      PID:1495
  - - /usr/bin/cut
      cut -b 1- /proc/self/cmdline
      4⤵
      PID:1495
  - - /usr/local/sbin/cut
      cut -b 1- /proc/thread-self/cmdline
      4⤵
      PID:1496
  - - /usr/local/bin/cut
      cut -b 1- /proc/thread-self/cmdline
      4⤵
      PID:1496
  - - /usr/sbin/cut
      cut -b 1- /proc/thread-self/cmdline
      4⤵
      PID:1496
  - - /usr/bin/cut
      cut -b 1- /proc/thread-self/cmdline
      4⤵
      Reads runtime system information
      PID:1496
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1/cmdline
      4⤵
      PID:1497
  - - /usr/local/bin/cut
      cut -b 1- /proc/1/cmdline
      4⤵
      PID:1497
  - - /usr/sbin/cut
      cut -b 1- /proc/1/cmdline
      4⤵
      PID:1497
  - - /usr/bin/cut
      cut -b 1- /proc/1/cmdline
      4⤵
      Reads runtime system information
      PID:1497
  - - /usr/local/sbin/cut
      cut -b 1- /proc/2/cmdline
      4⤵
      PID:1498
  - - /usr/local/bin/cut
      cut -b 1- /proc/2/cmdline
      4⤵
      PID:1498
  - - /usr/sbin/cut
      cut -b 1- /proc/2/cmdline
      4⤵
      PID:1498
  - - /usr/bin/cut
      cut -b 1- /proc/2/cmdline
      4⤵
      Reads runtime system information
      PID:1498
  - - /usr/local/sbin/cut
      cut -b 1- /proc/3/cmdline
      4⤵
      PID:1499
  - - /usr/local/bin/cut
      cut -b 1- /proc/3/cmdline
      4⤵
      PID:1499
  - - /usr/sbin/cut
      cut -b 1- /proc/3/cmdline
      4⤵
      PID:1499
  - - /usr/bin/cut
      cut -b 1- /proc/3/cmdline
      4⤵
      Reads runtime system information
      PID:1499
  - - /usr/local/sbin/cut
      cut -b 1- /proc/4/cmdline
      4⤵
      PID:1500
  - - /usr/local/bin/cut
      cut -b 1- /proc/4/cmdline
      4⤵
      PID:1500
  - - /usr/sbin/cut
      cut -b 1- /proc/4/cmdline
      4⤵
      PID:1500
  - - /usr/bin/cut
      cut -b 1- /proc/4/cmdline
      4⤵
      PID:1500
  - - /usr/local/sbin/cut
      cut -b 1- /proc/5/cmdline
      4⤵
      PID:1501
  - - /usr/local/bin/cut
      cut -b 1- /proc/5/cmdline
      4⤵
      PID:1501
  - - /usr/sbin/cut
      cut -b 1- /proc/5/cmdline
      4⤵
      PID:1501
  - - /usr/bin/cut
      cut -b 1- /proc/5/cmdline
      4⤵
      PID:1501
  - - /usr/local/sbin/cut
      cut -b 1- /proc/6/cmdline
      4⤵
      PID:1502
  - - /usr/local/bin/cut
      cut -b 1- /proc/6/cmdline
      4⤵
      PID:1502
  - - /usr/sbin/cut
      cut -b 1- /proc/6/cmdline
      4⤵
      PID:1502
  - - /usr/bin/cut
      cut -b 1- /proc/6/cmdline
      4⤵
      PID:1502
  - - /usr/local/sbin/cut
      cut -b 1- /proc/7/cmdline
      4⤵
      PID:1503
  - - /usr/local/bin/cut
      cut -b 1- /proc/7/cmdline
      4⤵
      PID:1503
  - - /usr/sbin/cut
      cut -b 1- /proc/7/cmdline
      4⤵
      PID:1503
  - - /usr/bin/cut
      cut -b 1- /proc/7/cmdline
      4⤵
      PID:1503
  - - /usr/local/sbin/cut
      cut -b 1- /proc/8/cmdline
      4⤵
      PID:1504
  - - /usr/local/bin/cut
      cut -b 1- /proc/8/cmdline
      4⤵
      PID:1504
  - - /usr/sbin/cut
      cut -b 1- /proc/8/cmdline
      4⤵
      PID:1504
  - - /usr/bin/cut
      cut -b 1- /proc/8/cmdline
      4⤵
      PID:1504
  - - /usr/local/sbin/cut
      cut -b 1- /proc/9/cmdline
      4⤵
      PID:1505
  - - /usr/local/bin/cut
      cut -b 1- /proc/9/cmdline
      4⤵
      PID:1505
  - - /usr/sbin/cut
      cut -b 1- /proc/9/cmdline
      4⤵
      PID:1505
  - - /usr/bin/cut
      cut -b 1- /proc/9/cmdline
      4⤵
      PID:1505
  - - /usr/local/sbin/cut
      cut -b 1- /proc/10/cmdline
      4⤵
      PID:1506
  - - /usr/local/bin/cut
      cut -b 1- /proc/10/cmdline
      4⤵
      PID:1506
  - - /usr/sbin/cut
      cut -b 1- /proc/10/cmdline
      4⤵
      PID:1506
  - - /usr/bin/cut
      cut -b 1- /proc/10/cmdline
      4⤵
      PID:1506
  - - /usr/local/sbin/cut
      cut -b 1- /proc/11/cmdline
      4⤵
      PID:1507
  - - /usr/local/bin/cut
      cut -b 1- /proc/11/cmdline
      4⤵
      PID:1507
  - - /usr/sbin/cut
      cut -b 1- /proc/11/cmdline
      4⤵
      PID:1507
  - - /usr/bin/cut
      cut -b 1- /proc/11/cmdline
      4⤵
      PID:1507
  - - /usr/local/sbin/cut
      cut -b 1- /proc/12/cmdline
      4⤵
      PID:1508
  - - /usr/local/bin/cut
      cut -b 1- /proc/12/cmdline
      4⤵
      PID:1508
  - - /usr/sbin/cut
      cut -b 1- /proc/12/cmdline
      4⤵
      PID:1508
  - - /usr/bin/cut
      cut -b 1- /proc/12/cmdline
      4⤵
      PID:1508
  - - /usr/local/sbin/cut
      cut -b 1- /proc/13/cmdline
      4⤵
      PID:1509
  - - /usr/local/bin/cut
      cut -b 1- /proc/13/cmdline
      4⤵
      PID:1509
  - - /usr/sbin/cut
      cut -b 1- /proc/13/cmdline
      4⤵
      PID:1509
  - - /usr/bin/cut
      cut -b 1- /proc/13/cmdline
      4⤵
      PID:1509
  - - /usr/local/sbin/cut
      cut -b 1- /proc/14/cmdline
      4⤵
      PID:1510
  - - /usr/local/bin/cut
      cut -b 1- /proc/14/cmdline
      4⤵
      PID:1510
  - - /usr/sbin/cut
      cut -b 1- /proc/14/cmdline
      4⤵
      PID:1510
  - - /usr/bin/cut
      cut -b 1- /proc/14/cmdline
      4⤵
      PID:1510
  - - /usr/local/sbin/cut
      cut -b 1- /proc/15/cmdline
      4⤵
      PID:1511
  - - /usr/local/bin/cut
      cut -b 1- /proc/15/cmdline
      4⤵
      PID:1511
  - - /usr/sbin/cut
      cut -b 1- /proc/15/cmdline
      4⤵
      PID:1511
  - - /usr/bin/cut
      cut -b 1- /proc/15/cmdline
      4⤵
      PID:1511
  - - /usr/local/sbin/cut
      cut -b 1- /proc/16/cmdline
      4⤵
      PID:1512
  - - /usr/local/bin/cut
      cut -b 1- /proc/16/cmdline
      4⤵
      PID:1512
  - - /usr/sbin/cut
      cut -b 1- /proc/16/cmdline
      4⤵
      PID:1512
  - - /usr/bin/cut
      cut -b 1- /proc/16/cmdline
      4⤵
      PID:1512
  - - /usr/local/sbin/cut
      cut -b 1- /proc/17/cmdline
      4⤵
      PID:1513
  - - /usr/local/bin/cut
      cut -b 1- /proc/17/cmdline
      4⤵
      PID:1513
  - - /usr/sbin/cut
      cut -b 1- /proc/17/cmdline
      4⤵
      PID:1513
  - - /usr/bin/cut
      cut -b 1- /proc/17/cmdline
      4⤵
      PID:1513
  - - /usr/local/sbin/cut
      cut -b 1- /proc/18/cmdline
      4⤵
      PID:1514
  - - /usr/local/bin/cut
      cut -b 1- /proc/18/cmdline
      4⤵
      PID:1514
  - - /usr/sbin/cut
      cut -b 1- /proc/18/cmdline
      4⤵
      PID:1514
  - - /usr/bin/cut
      cut -b 1- /proc/18/cmdline
      4⤵
      Reads runtime system information
      PID:1514
  - - /usr/local/sbin/cut
      cut -b 1- /proc/19/cmdline
      4⤵
      PID:1515
  - - /usr/local/bin/cut
      cut -b 1- /proc/19/cmdline
      4⤵
      PID:1515
  - - /usr/sbin/cut
      cut -b 1- /proc/19/cmdline
      4⤵
      PID:1515
  - - /usr/bin/cut
      cut -b 1- /proc/19/cmdline
      4⤵
      PID:1515
  - - /usr/local/sbin/cut
      cut -b 1- /proc/20/cmdline
      4⤵
      PID:1516
  - - /usr/local/bin/cut
      cut -b 1- /proc/20/cmdline
      4⤵
      PID:1516
  - - /usr/sbin/cut
      cut -b 1- /proc/20/cmdline
      4⤵
      PID:1516
  - - /usr/bin/cut
      cut -b 1- /proc/20/cmdline
      4⤵
      PID:1516
  - - /usr/local/sbin/cut
      cut -b 1- /proc/21/cmdline
      4⤵
      PID:1517
  - - /usr/local/bin/cut
      cut -b 1- /proc/21/cmdline
      4⤵
      PID:1517
  - - /usr/sbin/cut
      cut -b 1- /proc/21/cmdline
      4⤵
      PID:1517
  - - /usr/bin/cut
      cut -b 1- /proc/21/cmdline
      4⤵
      Reads runtime system information
      PID:1517
  - - /usr/local/sbin/cut
      cut -b 1- /proc/22/cmdline
      4⤵
      PID:1518
  - - /usr/local/bin/cut
      cut -b 1- /proc/22/cmdline
      4⤵
      PID:1518
  - - /usr/sbin/cut
      cut -b 1- /proc/22/cmdline
      4⤵
      PID:1518
  - - /usr/bin/cut
      cut -b 1- /proc/22/cmdline
      4⤵
      Reads runtime system information
      PID:1518
  - - /usr/local/sbin/cut
      cut -b 1- /proc/23/cmdline
      4⤵
      PID:1519
  - - /usr/local/bin/cut
      cut -b 1- /proc/23/cmdline
      4⤵
      PID:1519
  - - /usr/sbin/cut
      cut -b 1- /proc/23/cmdline
      4⤵
      PID:1519
  - - /usr/bin/cut
      cut -b 1- /proc/23/cmdline
      4⤵
      PID:1519
  - - /usr/local/sbin/cut
      cut -b 1- /proc/24/cmdline
      4⤵
      PID:1520
  - - /usr/local/bin/cut
      cut -b 1- /proc/24/cmdline
      4⤵
      PID:1520
  - - /usr/sbin/cut
      cut -b 1- /proc/24/cmdline
      4⤵
      PID:1520
  - - /usr/bin/cut
      cut -b 1- /proc/24/cmdline
      4⤵
      PID:1520
  - - /usr/local/sbin/cut
      cut -b 1- /proc/25/cmdline
      4⤵
      PID:1521
  - - /usr/local/bin/cut
      cut -b 1- /proc/25/cmdline
      4⤵
      PID:1521
  - - /usr/sbin/cut
      cut -b 1- /proc/25/cmdline
      4⤵
      PID:1521
  - - /usr/bin/cut
      cut -b 1- /proc/25/cmdline
      4⤵
      PID:1521
  - - /usr/local/sbin/cut
      cut -b 1- /proc/26/cmdline
      4⤵
      PID:1522
  - - /usr/local/bin/cut
      cut -b 1- /proc/26/cmdline
      4⤵
      PID:1522
  - - /usr/sbin/cut
      cut -b 1- /proc/26/cmdline
      4⤵
      PID:1522
  - - /usr/bin/cut
      cut -b 1- /proc/26/cmdline
      4⤵
      Reads runtime system information
      PID:1522
  - - /usr/local/sbin/cut
      cut -b 1- /proc/27/cmdline
      4⤵
      PID:1523
  - - /usr/local/bin/cut
      cut -b 1- /proc/27/cmdline
      4⤵
      PID:1523
  - - /usr/sbin/cut
      cut -b 1- /proc/27/cmdline
      4⤵
      PID:1523
  - - /usr/bin/cut
      cut -b 1- /proc/27/cmdline
      4⤵
      PID:1523
  - - /usr/local/sbin/cut
      cut -b 1- /proc/28/cmdline
      4⤵
      PID:1524
  - - /usr/local/bin/cut
      cut -b 1- /proc/28/cmdline
      4⤵
      PID:1524
  - - /usr/sbin/cut
      cut -b 1- /proc/28/cmdline
      4⤵
      PID:1524
  - - /usr/bin/cut
      cut -b 1- /proc/28/cmdline
      4⤵
      PID:1524
  - - /usr/local/sbin/cut
      cut -b 1- /proc/29/cmdline
      4⤵
      PID:1525
  - - /usr/local/bin/cut
      cut -b 1- /proc/29/cmdline
      4⤵
      PID:1525
  - - /usr/sbin/cut
      cut -b 1- /proc/29/cmdline
      4⤵
      PID:1525
  - - /usr/bin/cut
      cut -b 1- /proc/29/cmdline
      4⤵
      Reads runtime system information
      PID:1525
  - - /usr/local/sbin/cut
      cut -b 1- /proc/30/cmdline
      4⤵
      PID:1526
  - - /usr/local/bin/cut
      cut -b 1- /proc/30/cmdline
      4⤵
      PID:1526
  - - /usr/sbin/cut
      cut -b 1- /proc/30/cmdline
      4⤵
      PID:1526
  - - /usr/bin/cut
      cut -b 1- /proc/30/cmdline
      4⤵
      Reads runtime system information
      PID:1526
  - - /usr/local/sbin/cut
      cut -b 1- /proc/31/cmdline
      4⤵
      PID:1527
  - - /usr/local/bin/cut
      cut -b 1- /proc/31/cmdline
      4⤵
      PID:1527
  - - /usr/sbin/cut
      cut -b 1- /proc/31/cmdline
      4⤵
      PID:1527
  - - /usr/bin/cut
      cut -b 1- /proc/31/cmdline
      4⤵
      PID:1527
  - - /usr/local/sbin/cut
      cut -b 1- /proc/32/cmdline
      4⤵
      PID:1528
  - - /usr/local/bin/cut
      cut -b 1- /proc/32/cmdline
      4⤵
      PID:1528
  - - /usr/sbin/cut
      cut -b 1- /proc/32/cmdline
      4⤵
      PID:1528
  - - /usr/bin/cut
      cut -b 1- /proc/32/cmdline
      4⤵
      Reads runtime system information
      PID:1528
  - - /usr/local/sbin/cut
      cut -b 1- /proc/34/cmdline
      4⤵
      PID:1529
  - - /usr/local/bin/cut
      cut -b 1- /proc/34/cmdline
      4⤵
      PID:1529
  - - /usr/sbin/cut
      cut -b 1- /proc/34/cmdline
      4⤵
      PID:1529
  - - /usr/bin/cut
      cut -b 1- /proc/34/cmdline
      4⤵
      PID:1529
  - - /usr/local/sbin/cut
      cut -b 1- /proc/35/cmdline
      4⤵
      PID:1530
  - - /usr/local/bin/cut
      cut -b 1- /proc/35/cmdline
      4⤵
      PID:1530
  - - /usr/sbin/cut
      cut -b 1- /proc/35/cmdline
      4⤵
      PID:1530
  - - /usr/bin/cut
      cut -b 1- /proc/35/cmdline
      4⤵
      PID:1530
  - - /usr/local/sbin/cut
      cut -b 1- /proc/36/cmdline
      4⤵
      PID:1531
  - - /usr/local/bin/cut
      cut -b 1- /proc/36/cmdline
      4⤵
      PID:1531
  - - /usr/sbin/cut
      cut -b 1- /proc/36/cmdline
      4⤵
      PID:1531
  - - /usr/bin/cut
      cut -b 1- /proc/36/cmdline
      4⤵
      PID:1531
  - - /usr/local/sbin/cut
      cut -b 1- /proc/78/cmdline
      4⤵
      PID:1532
  - - /usr/local/bin/cut
      cut -b 1- /proc/78/cmdline
      4⤵
      PID:1532
  - - /usr/sbin/cut
      cut -b 1- /proc/78/cmdline
      4⤵
      PID:1532
  - - /usr/bin/cut
      cut -b 1- /proc/78/cmdline
      4⤵
      Reads runtime system information
      PID:1532
  - - /usr/local/sbin/cut
      cut -b 1- /proc/79/cmdline
      4⤵
      PID:1533
  - - /usr/local/bin/cut
      cut -b 1- /proc/79/cmdline
      4⤵
      PID:1533
  - - /usr/sbin/cut
      cut -b 1- /proc/79/cmdline
      4⤵
      PID:1533
  - - /usr/bin/cut
      cut -b 1- /proc/79/cmdline
      4⤵
      PID:1533
  - - /usr/local/sbin/cut
      cut -b 1- /proc/80/cmdline
      4⤵
      PID:1534
  - - /usr/local/bin/cut
      cut -b 1- /proc/80/cmdline
      4⤵
      PID:1534
  - - /usr/sbin/cut
      cut -b 1- /proc/80/cmdline
      4⤵
      PID:1534
  - - /usr/bin/cut
      cut -b 1- /proc/80/cmdline
      4⤵
      PID:1534
  - - /usr/local/sbin/cut
      cut -b 1- /proc/81/cmdline
      4⤵
      PID:1535
  - - /usr/local/bin/cut
      cut -b 1- /proc/81/cmdline
      4⤵
      PID:1535
  - - /usr/sbin/cut
      cut -b 1- /proc/81/cmdline
      4⤵
      PID:1535
  - - /usr/bin/cut
      cut -b 1- /proc/81/cmdline
      4⤵
      PID:1535
  - - /usr/local/sbin/cut
      cut -b 1- /proc/82/cmdline
      4⤵
      PID:1536
  - - /usr/local/bin/cut
      cut -b 1- /proc/82/cmdline
      4⤵
      PID:1536
  - - /usr/sbin/cut
      cut -b 1- /proc/82/cmdline
      4⤵
      PID:1536
  - - /usr/bin/cut
      cut -b 1- /proc/82/cmdline
      4⤵
      Reads runtime system information
      PID:1536
  - - /usr/local/sbin/cut
      cut -b 1- /proc/83/cmdline
      4⤵
      PID:1537
  - - /usr/local/bin/cut
      cut -b 1- /proc/83/cmdline
      4⤵
      PID:1537
  - - /usr/sbin/cut
      cut -b 1- /proc/83/cmdline
      4⤵
      PID:1537
  - - /usr/bin/cut
      cut -b 1- /proc/83/cmdline
      4⤵
      Reads runtime system information
      PID:1537
  - - /usr/local/sbin/cut
      cut -b 1- /proc/84/cmdline
      4⤵
      PID:1538
  - - /usr/local/bin/cut
      cut -b 1- /proc/84/cmdline
      4⤵
      PID:1538
  - - /usr/sbin/cut
      cut -b 1- /proc/84/cmdline
      4⤵
      PID:1538
  - - /usr/bin/cut
      cut -b 1- /proc/84/cmdline
      4⤵
      PID:1538
  - - /usr/local/sbin/cut
      cut -b 1- /proc/85/cmdline
      4⤵
      PID:1539
  - - /usr/local/bin/cut
      cut -b 1- /proc/85/cmdline
      4⤵
      PID:1539
  - - /usr/sbin/cut
      cut -b 1- /proc/85/cmdline
      4⤵
      PID:1539
  - - /usr/bin/cut
      cut -b 1- /proc/85/cmdline
      4⤵
      PID:1539
  - - /usr/local/sbin/cut
      cut -b 1- /proc/89/cmdline
      4⤵
      PID:1540
  - - /usr/local/bin/cut
      cut -b 1- /proc/89/cmdline
      4⤵
      PID:1540
  - - /usr/sbin/cut
      cut -b 1- /proc/89/cmdline
      4⤵
      PID:1540
  - - /usr/bin/cut
      cut -b 1- /proc/89/cmdline
      4⤵
      PID:1540
  - - /usr/local/sbin/cut
      cut -b 1- /proc/98/cmdline
      4⤵
      PID:1541
  - - /usr/local/bin/cut
      cut -b 1- /proc/98/cmdline
      4⤵
      PID:1541
  - - /usr/sbin/cut
      cut -b 1- /proc/98/cmdline
      4⤵
      PID:1541
  - - /usr/bin/cut
      cut -b 1- /proc/98/cmdline
      4⤵
      PID:1541
  - - /usr/local/sbin/cut
      cut -b 1- /proc/115/cmdline
      4⤵
      PID:1542
  - - /usr/local/bin/cut
      cut -b 1- /proc/115/cmdline
      4⤵
      PID:1542
  - - /usr/sbin/cut
      cut -b 1- /proc/115/cmdline
      4⤵
      PID:1542
  - - /usr/bin/cut
      cut -b 1- /proc/115/cmdline
      4⤵
      PID:1542
  - - /usr/local/sbin/cut
      cut -b 1- /proc/129/cmdline
      4⤵
      PID:1543
  - - /usr/local/bin/cut
      cut -b 1- /proc/129/cmdline
      4⤵
      PID:1543
  - - /usr/sbin/cut
      cut -b 1- /proc/129/cmdline
      4⤵
      PID:1543
  - - /usr/bin/cut
      cut -b 1- /proc/129/cmdline
      4⤵
      Reads runtime system information
      PID:1543
  - - /usr/local/sbin/cut
      cut -b 1- /proc/153/cmdline
      4⤵
      PID:1544
  - - /usr/local/bin/cut
      cut -b 1- /proc/153/cmdline
      4⤵
      PID:1544
  - - /usr/sbin/cut
      cut -b 1- /proc/153/cmdline
      4⤵
      PID:1544
  - - /usr/bin/cut
      cut -b 1- /proc/153/cmdline
      4⤵
      PID:1544
  - - /usr/local/sbin/cut
      cut -b 1- /proc/154/cmdline
      4⤵
      PID:1545
  - - /usr/local/bin/cut
      cut -b 1- /proc/154/cmdline
      4⤵
      PID:1545
  - - /usr/sbin/cut
      cut -b 1- /proc/154/cmdline
      4⤵
      PID:1545
  - - /usr/bin/cut
      cut -b 1- /proc/154/cmdline
      4⤵
      PID:1545
  - - /usr/local/sbin/cut
      cut -b 1- /proc/155/cmdline
      4⤵
      PID:1546
  - - /usr/local/bin/cut
      cut -b 1- /proc/155/cmdline
      4⤵
      PID:1546
  - - /usr/sbin/cut
      cut -b 1- /proc/155/cmdline
      4⤵
      PID:1546
  - - /usr/bin/cut
      cut -b 1- /proc/155/cmdline
      4⤵
      PID:1546
  - - /usr/local/sbin/cut
      cut -b 1- /proc/156/cmdline
      4⤵
      PID:1547
  - - /usr/local/bin/cut
      cut -b 1- /proc/156/cmdline
      4⤵
      PID:1547
  - - /usr/sbin/cut
      cut -b 1- /proc/156/cmdline
      4⤵
      PID:1547
  - - /usr/bin/cut
      cut -b 1- /proc/156/cmdline
      4⤵
      PID:1547
  - - /usr/local/sbin/cut
      cut -b 1- /proc/157/cmdline
      4⤵
      PID:1548
  - - /usr/local/bin/cut
      cut -b 1- /proc/157/cmdline
      4⤵
      PID:1548
  - - /usr/sbin/cut
      cut -b 1- /proc/157/cmdline
      4⤵
      PID:1548
  - - /usr/bin/cut
      cut -b 1- /proc/157/cmdline
      4⤵
      Reads runtime system information
      PID:1548
  - - /usr/local/sbin/cut
      cut -b 1- /proc/158/cmdline
      4⤵
      PID:1549
  - - /usr/local/bin/cut
      cut -b 1- /proc/158/cmdline
      4⤵
      PID:1549
  - - /usr/sbin/cut
      cut -b 1- /proc/158/cmdline
      4⤵
      PID:1549
  - - /usr/bin/cut
      cut -b 1- /proc/158/cmdline
      4⤵
      PID:1549
  - - /usr/local/sbin/cut
      cut -b 1- /proc/159/cmdline
      4⤵
      PID:1550
  - - /usr/local/bin/cut
      cut -b 1- /proc/159/cmdline
      4⤵
      PID:1550
  - - /usr/sbin/cut
      cut -b 1- /proc/159/cmdline
      4⤵
      PID:1550
  - - /usr/bin/cut
      cut -b 1- /proc/159/cmdline
      4⤵
      Reads runtime system information
      PID:1550
  - - /usr/local/sbin/cut
      cut -b 1- /proc/160/cmdline
      4⤵
      PID:1551
  - - /usr/local/bin/cut
      cut -b 1- /proc/160/cmdline
      4⤵
      PID:1551
  - - /usr/sbin/cut
      cut -b 1- /proc/160/cmdline
      4⤵
      PID:1551
  - - /usr/bin/cut
      cut -b 1- /proc/160/cmdline
      4⤵
      PID:1551
  - - /usr/local/sbin/cut
      cut -b 1- /proc/161/cmdline
      4⤵
      PID:1552
  - - /usr/local/bin/cut
      cut -b 1- /proc/161/cmdline
      4⤵
      PID:1552
  - - /usr/sbin/cut
      cut -b 1- /proc/161/cmdline
      4⤵
      PID:1552
  - - /usr/bin/cut
      cut -b 1- /proc/161/cmdline
      4⤵
      Reads runtime system information
      PID:1552
  - - /usr/local/sbin/cut
      cut -b 1- /proc/162/cmdline
      4⤵
      PID:1553
  - - /usr/local/bin/cut
      cut -b 1- /proc/162/cmdline
      4⤵
      PID:1553
  - - /usr/sbin/cut
      cut -b 1- /proc/162/cmdline
      4⤵
      PID:1553
  - - /usr/bin/cut
      cut -b 1- /proc/162/cmdline
      4⤵
      PID:1553
  - - /usr/local/sbin/cut
      cut -b 1- /proc/163/cmdline
      4⤵
      PID:1554
  - - /usr/local/bin/cut
      cut -b 1- /proc/163/cmdline
      4⤵
      PID:1554
  - - /usr/sbin/cut
      cut -b 1- /proc/163/cmdline
      4⤵
      PID:1554
  - - /usr/bin/cut
      cut -b 1- /proc/163/cmdline
      4⤵
      PID:1554
  - - /usr/local/sbin/cut
      cut -b 1- /proc/164/cmdline
      4⤵
      PID:1555
  - - /usr/local/bin/cut
      cut -b 1- /proc/164/cmdline
      4⤵
      PID:1555
  - - /usr/sbin/cut
      cut -b 1- /proc/164/cmdline
      4⤵
      PID:1555
  - - /usr/bin/cut
      cut -b 1- /proc/164/cmdline
      4⤵
      Reads runtime system information
      PID:1555
  - - /usr/local/sbin/cut
      cut -b 1- /proc/165/cmdline
      4⤵
      PID:1556
  - - /usr/local/bin/cut
      cut -b 1- /proc/165/cmdline
      4⤵
      PID:1556
  - - /usr/sbin/cut
      cut -b 1- /proc/165/cmdline
      4⤵
      PID:1556
  - - /usr/bin/cut
      cut -b 1- /proc/165/cmdline
      4⤵
      Reads runtime system information
      PID:1556
  - - /usr/local/sbin/cut
      cut -b 1- /proc/166/cmdline
      4⤵
      PID:1557
  - - /usr/local/bin/cut
      cut -b 1- /proc/166/cmdline
      4⤵
      PID:1557
  - - /usr/sbin/cut
      cut -b 1- /proc/166/cmdline
      4⤵
      PID:1557
  - - /usr/bin/cut
      cut -b 1- /proc/166/cmdline
      4⤵
      PID:1557
  - - /usr/local/sbin/cut
      cut -b 1- /proc/167/cmdline
      4⤵
      PID:1558
  - - /usr/local/bin/cut
      cut -b 1- /proc/167/cmdline
      4⤵
      PID:1558
  - - /usr/sbin/cut
      cut -b 1- /proc/167/cmdline
      4⤵
      PID:1558
  - - /usr/bin/cut
      cut -b 1- /proc/167/cmdline
      4⤵
      PID:1558
  - - /usr/local/sbin/cut
      cut -b 1- /proc/168/cmdline
      4⤵
      PID:1559
  - - /usr/local/bin/cut
      cut -b 1- /proc/168/cmdline
      4⤵
      PID:1559
  - - /usr/sbin/cut
      cut -b 1- /proc/168/cmdline
      4⤵
      PID:1559
  - - /usr/bin/cut
      cut -b 1- /proc/168/cmdline
      4⤵
      PID:1559
  - - /usr/local/sbin/cut
      cut -b 1- /proc/169/cmdline
      4⤵
      PID:1560
  - - /usr/local/bin/cut
      cut -b 1- /proc/169/cmdline
      4⤵
      PID:1560
  - - /usr/sbin/cut
      cut -b 1- /proc/169/cmdline
      4⤵
      PID:1560
  - - /usr/bin/cut
      cut -b 1- /proc/169/cmdline
      4⤵
      PID:1560
  - - /usr/local/sbin/cut
      cut -b 1- /proc/170/cmdline
      4⤵
      PID:1561
  - - /usr/local/bin/cut
      cut -b 1- /proc/170/cmdline
      4⤵
      PID:1561
  - - /usr/sbin/cut
      cut -b 1- /proc/170/cmdline
      4⤵
      PID:1561
  - - /usr/bin/cut
      cut -b 1- /proc/170/cmdline
      4⤵
      Reads runtime system information
      PID:1561
  - - /usr/local/sbin/cut
      cut -b 1- /proc/172/cmdline
      4⤵
      PID:1562
  - - /usr/local/bin/cut
      cut -b 1- /proc/172/cmdline
      4⤵
      PID:1562
  - - /usr/sbin/cut
      cut -b 1- /proc/172/cmdline
      4⤵
      PID:1562
  - - /usr/bin/cut
      cut -b 1- /proc/172/cmdline
      4⤵
      Reads runtime system information
      PID:1562
  - - /usr/local/sbin/cut
      cut -b 1- /proc/197/cmdline
      4⤵
      PID:1563
  - - /usr/local/bin/cut
      cut -b 1- /proc/197/cmdline
      4⤵
      PID:1563
  - - /usr/sbin/cut
      cut -b 1- /proc/197/cmdline
      4⤵
      PID:1563
  - - /usr/bin/cut
      cut -b 1- /proc/197/cmdline
      4⤵
      PID:1563
  - - /usr/local/sbin/cut
      cut -b 1- /proc/198/cmdline
      4⤵
      PID:1564
  - - /usr/local/bin/cut
      cut -b 1- /proc/198/cmdline
      4⤵
      PID:1564
  - - /usr/sbin/cut
      cut -b 1- /proc/198/cmdline
      4⤵
      PID:1564
  - - /usr/bin/cut
      cut -b 1- /proc/198/cmdline
      4⤵
      PID:1564
  - - /usr/local/sbin/cut
      cut -b 1- /proc/253/cmdline
      4⤵
      PID:1565
  - - /usr/local/bin/cut
      cut -b 1- /proc/253/cmdline
      4⤵
      PID:1565
  - - /usr/sbin/cut
      cut -b 1- /proc/253/cmdline
      4⤵
      PID:1565
  - - /usr/bin/cut
      cut -b 1- /proc/253/cmdline
      4⤵
      PID:1565
  - - /usr/local/sbin/cut
      cut -b 1- /proc/267/cmdline
      4⤵
      PID:1566
  - - /usr/local/bin/cut
      cut -b 1- /proc/267/cmdline
      4⤵
      PID:1566
  - - /usr/sbin/cut
      cut -b 1- /proc/267/cmdline
      4⤵
      PID:1566
  - - /usr/bin/cut
      cut -b 1- /proc/267/cmdline
      4⤵
      Reads runtime system information
      PID:1566
  - - /usr/local/sbin/cut
      cut -b 1- /proc/328/cmdline
      4⤵
      PID:1567
  - - /usr/local/bin/cut
      cut -b 1- /proc/328/cmdline
      4⤵
      PID:1567
  - - /usr/sbin/cut
      cut -b 1- /proc/328/cmdline
      4⤵
      PID:1567
  - - /usr/bin/cut
      cut -b 1- /proc/328/cmdline
      4⤵
      PID:1567
  - - /usr/local/sbin/cut
      cut -b 1- /proc/405/cmdline
      4⤵
      PID:1568
  - - /usr/local/bin/cut
      cut -b 1- /proc/405/cmdline
      4⤵
      PID:1568
  - - /usr/sbin/cut
      cut -b 1- /proc/405/cmdline
      4⤵
      PID:1568
  - - /usr/bin/cut
      cut -b 1- /proc/405/cmdline
      4⤵
      Reads runtime system information
      PID:1568
  - - /usr/local/sbin/cut
      cut -b 1- /proc/412/cmdline
      4⤵
      PID:1569
  - - /usr/local/bin/cut
      cut -b 1- /proc/412/cmdline
      4⤵
      PID:1569
  - - /usr/sbin/cut
      cut -b 1- /proc/412/cmdline
      4⤵
      PID:1569
  - - /usr/bin/cut
      cut -b 1- /proc/412/cmdline
      4⤵
      Reads runtime system information
      PID:1569
  - - /usr/local/sbin/cut
      cut -b 1- /proc/419/cmdline
      4⤵
      PID:1570
  - - /usr/local/bin/cut
      cut -b 1- /proc/419/cmdline
      4⤵
      PID:1570
  - - /usr/sbin/cut
      cut -b 1- /proc/419/cmdline
      4⤵
      PID:1570
  - - /usr/bin/cut
      cut -b 1- /proc/419/cmdline
      4⤵
      PID:1570
  - - /usr/local/sbin/cut
      cut -b 1- /proc/420/cmdline
      4⤵
      PID:1571
  - - /usr/local/bin/cut
      cut -b 1- /proc/420/cmdline
      4⤵
      PID:1571
  - - /usr/sbin/cut
      cut -b 1- /proc/420/cmdline
      4⤵
      PID:1571
  - - /usr/bin/cut
      cut -b 1- /proc/420/cmdline
      4⤵
      Reads runtime system information
      PID:1571
  - - /usr/local/sbin/cut
      cut -b 1- /proc/424/cmdline
      4⤵
      PID:1572
  - - /usr/local/bin/cut
      cut -b 1- /proc/424/cmdline
      4⤵
      PID:1572
  - - /usr/sbin/cut
      cut -b 1- /proc/424/cmdline
      4⤵
      PID:1572
  - - /usr/bin/cut
      cut -b 1- /proc/424/cmdline
      4⤵
      Reads runtime system information
      PID:1572
  - - /usr/local/sbin/cut
      cut -b 1- /proc/436/cmdline
      4⤵
      PID:1573
  - - /usr/local/bin/cut
      cut -b 1- /proc/436/cmdline
      4⤵
      PID:1573
  - - /usr/sbin/cut
      cut -b 1- /proc/436/cmdline
      4⤵
      PID:1573
  - - /usr/bin/cut
      cut -b 1- /proc/436/cmdline
      4⤵
      Reads runtime system information
      PID:1573
  - - /usr/local/sbin/cut
      cut -b 1- /proc/457/cmdline
      4⤵
      PID:1574
  - - /usr/local/bin/cut
      cut -b 1- /proc/457/cmdline
      4⤵
      PID:1574
  - - /usr/sbin/cut
      cut -b 1- /proc/457/cmdline
      4⤵
      PID:1574
  - - /usr/bin/cut
      cut -b 1- /proc/457/cmdline
      4⤵
      PID:1574
  - - /usr/local/sbin/cut
      cut -b 1- /proc/459/cmdline
      4⤵
      PID:1575
  - - /usr/local/bin/cut
      cut -b 1- /proc/459/cmdline
      4⤵
      PID:1575
  - - /usr/sbin/cut
      cut -b 1- /proc/459/cmdline
      4⤵
      PID:1575
  - - /usr/bin/cut
      cut -b 1- /proc/459/cmdline
      4⤵
      Reads runtime system information
      PID:1575
  - - /usr/local/sbin/cut
      cut -b 1- /proc/477/cmdline
      4⤵
      PID:1576
  - - /usr/local/bin/cut
      cut -b 1- /proc/477/cmdline
      4⤵
      PID:1576
  - - /usr/sbin/cut
      cut -b 1- /proc/477/cmdline
      4⤵
      PID:1576
  - - /usr/bin/cut
      cut -b 1- /proc/477/cmdline
      4⤵
      PID:1576
  - - /usr/local/sbin/cut
      cut -b 1- /proc/480/cmdline
      4⤵
      PID:1577
  - - /usr/local/bin/cut
      cut -b 1- /proc/480/cmdline
      4⤵
      PID:1577
  - - /usr/sbin/cut
      cut -b 1- /proc/480/cmdline
      4⤵
      PID:1577
  - - /usr/bin/cut
      cut -b 1- /proc/480/cmdline
      4⤵
      PID:1577
  - - /usr/local/sbin/cut
      cut -b 1- /proc/506/cmdline
      4⤵
      PID:1578
  - - /usr/local/bin/cut
      cut -b 1- /proc/506/cmdline
      4⤵
      PID:1578
  - - /usr/sbin/cut
      cut -b 1- /proc/506/cmdline
      4⤵
      PID:1578
  - - /usr/bin/cut
      cut -b 1- /proc/506/cmdline
      4⤵
      PID:1578
  - - /usr/local/sbin/cut
      cut -b 1- /proc/507/cmdline
      4⤵
      PID:1579
  - - /usr/local/bin/cut
      cut -b 1- /proc/507/cmdline
      4⤵
      PID:1579
  - - /usr/sbin/cut
      cut -b 1- /proc/507/cmdline
      4⤵
      PID:1579
  - - /usr/bin/cut
      cut -b 1- /proc/507/cmdline
      4⤵
      Reads runtime system information
      PID:1579
  - - /usr/local/sbin/cut
      cut -b 1- /proc/514/cmdline
      4⤵
      PID:1580
  - - /usr/local/bin/cut
      cut -b 1- /proc/514/cmdline
      4⤵
      PID:1580
  - - /usr/sbin/cut
      cut -b 1- /proc/514/cmdline
      4⤵
      PID:1580
  - - /usr/bin/cut
      cut -b 1- /proc/514/cmdline
      4⤵
      PID:1580
  - - /usr/local/sbin/cut
      cut -b 1- /proc/536/cmdline
      4⤵
      PID:1581
  - - /usr/local/bin/cut
      cut -b 1- /proc/536/cmdline
      4⤵
      PID:1581
  - - /usr/sbin/cut
      cut -b 1- /proc/536/cmdline
      4⤵
      PID:1581
  - - /usr/bin/cut
      cut -b 1- /proc/536/cmdline
      4⤵
      Reads runtime system information
      PID:1581
  - - /usr/local/sbin/cut
      cut -b 1- /proc/538/cmdline
      4⤵
      PID:1582
  - - /usr/local/bin/cut
      cut -b 1- /proc/538/cmdline
      4⤵
      PID:1582
  - - /usr/sbin/cut
      cut -b 1- /proc/538/cmdline
      4⤵
      PID:1582
  - - /usr/bin/cut
      cut -b 1- /proc/538/cmdline
      4⤵
      Reads runtime system information
      PID:1582
  - - /usr/local/sbin/cut
      cut -b 1- /proc/559/cmdline
      4⤵
      PID:1583
  - - /usr/local/bin/cut
      cut -b 1- /proc/559/cmdline
      4⤵
      PID:1583
  - - /usr/sbin/cut
      cut -b 1- /proc/559/cmdline
      4⤵
      PID:1583
  - - /usr/bin/cut
      cut -b 1- /proc/559/cmdline
      4⤵
      Reads runtime system information
      PID:1583
  - - /usr/local/sbin/cut
      cut -b 1- /proc/587/cmdline
      4⤵
      PID:1584
  - - /usr/local/bin/cut
      cut -b 1- /proc/587/cmdline
      4⤵
      PID:1584
  - - /usr/sbin/cut
      cut -b 1- /proc/587/cmdline
      4⤵
      PID:1584
  - - /usr/bin/cut
      cut -b 1- /proc/587/cmdline
      4⤵
      Reads runtime system information
      PID:1584
  - - /usr/local/sbin/cut
      cut -b 1- /proc/588/cmdline
      4⤵
      PID:1585
  - - /usr/local/bin/cut
      cut -b 1- /proc/588/cmdline
      4⤵
      PID:1585
  - - /usr/sbin/cut
      cut -b 1- /proc/588/cmdline
      4⤵
      PID:1585
  - - /usr/bin/cut
      cut -b 1- /proc/588/cmdline
      4⤵
      PID:1585
  - - /usr/local/sbin/cut
      cut -b 1- /proc/651/cmdline
      4⤵
      PID:1586
  - - /usr/local/bin/cut
      cut -b 1- /proc/651/cmdline
      4⤵
      PID:1586
  - - /usr/sbin/cut
      cut -b 1- /proc/651/cmdline
      4⤵
      PID:1586
  - - /usr/bin/cut
      cut -b 1- /proc/651/cmdline
      4⤵
      PID:1586
  - - /usr/local/sbin/cut
      cut -b 1- /proc/664/cmdline
      4⤵
      PID:1587
  - - /usr/local/bin/cut
      cut -b 1- /proc/664/cmdline
      4⤵
      PID:1587
  - - /usr/sbin/cut
      cut -b 1- /proc/664/cmdline
      4⤵
      PID:1587
  - - /usr/bin/cut
      cut -b 1- /proc/664/cmdline
      4⤵
      PID:1587
  - - /usr/local/sbin/cut
      cut -b 1- /proc/668/cmdline
      4⤵
      PID:1588
  - - /usr/local/bin/cut
      cut -b 1- /proc/668/cmdline
      4⤵
      PID:1588
  - - /usr/sbin/cut
      cut -b 1- /proc/668/cmdline
      4⤵
      PID:1588
  - - /usr/bin/cut
      cut -b 1- /proc/668/cmdline
      4⤵
      PID:1588
  - - /usr/local/sbin/cut
      cut -b 1- /proc/699/cmdline
      4⤵
      PID:1589
  - - /usr/local/bin/cut
      cut -b 1- /proc/699/cmdline
      4⤵
      PID:1589
  - - /usr/sbin/cut
      cut -b 1- /proc/699/cmdline
      4⤵
      PID:1589
  - - /usr/bin/cut
      cut -b 1- /proc/699/cmdline
      4⤵
      Reads runtime system information
      PID:1589
  - - /usr/local/sbin/cut
      cut -b 1- /proc/701/cmdline
      4⤵
      PID:1590
  - - /usr/local/bin/cut
      cut -b 1- /proc/701/cmdline
      4⤵
      PID:1590
  - - /usr/sbin/cut
      cut -b 1- /proc/701/cmdline
      4⤵
      PID:1590
  - - /usr/bin/cut
      cut -b 1- /proc/701/cmdline
      4⤵
      PID:1590
  - - /usr/local/sbin/cut
      cut -b 1- /proc/709/cmdline
      4⤵
      PID:1591
  - - /usr/local/bin/cut
      cut -b 1- /proc/709/cmdline
      4⤵
      PID:1591
  - - /usr/sbin/cut
      cut -b 1- /proc/709/cmdline
      4⤵
      PID:1591
  - - /usr/bin/cut
      cut -b 1- /proc/709/cmdline
      4⤵
      PID:1591
  - - /usr/local/sbin/cut
      cut -b 1- /proc/870/cmdline
      4⤵
      PID:1592
  - - /usr/local/bin/cut
      cut -b 1- /proc/870/cmdline
      4⤵
      PID:1592
  - - /usr/sbin/cut
      cut -b 1- /proc/870/cmdline
      4⤵
      PID:1592
  - - /usr/bin/cut
      cut -b 1- /proc/870/cmdline
      4⤵
      PID:1592
  - - /usr/local/sbin/cut
      cut -b 1- /proc/937/cmdline
      4⤵
      PID:1593
  - - /usr/local/bin/cut
      cut -b 1- /proc/937/cmdline
      4⤵
      PID:1593
  - - /usr/sbin/cut
      cut -b 1- /proc/937/cmdline
      4⤵
      PID:1593
  - - /usr/bin/cut
      cut -b 1- /proc/937/cmdline
      4⤵
      PID:1593
  - - /usr/local/sbin/cut
      cut -b 1- /proc/942/cmdline
      4⤵
      PID:1594
  - - /usr/local/bin/cut
      cut -b 1- /proc/942/cmdline
      4⤵
      PID:1594
  - - /usr/sbin/cut
      cut -b 1- /proc/942/cmdline
      4⤵
      PID:1594
  - - /usr/bin/cut
      cut -b 1- /proc/942/cmdline
      4⤵
      Reads runtime system information
      PID:1594
  - - /usr/local/sbin/cut
      cut -b 1- /proc/946/cmdline
      4⤵
      PID:1595
  - - /usr/local/bin/cut
      cut -b 1- /proc/946/cmdline
      4⤵
      PID:1595
  - - /usr/sbin/cut
      cut -b 1- /proc/946/cmdline
      4⤵
      PID:1595
  - - /usr/bin/cut
      cut -b 1- /proc/946/cmdline
      4⤵
      PID:1595
  - - /usr/local/sbin/cut
      cut -b 1- /proc/948/cmdline
      4⤵
      PID:1596
  - - /usr/local/bin/cut
      cut -b 1- /proc/948/cmdline
      4⤵
      PID:1596
  - - /usr/sbin/cut
      cut -b 1- /proc/948/cmdline
      4⤵
      PID:1596
  - - /usr/bin/cut
      cut -b 1- /proc/948/cmdline
      4⤵
      PID:1596
  - - /usr/local/sbin/cut
      cut -b 1- /proc/956/cmdline
      4⤵
      PID:1597
  - - /usr/local/bin/cut
      cut -b 1- /proc/956/cmdline
      4⤵
      PID:1597
  - - /usr/sbin/cut
      cut -b 1- /proc/956/cmdline
      4⤵
      PID:1597
  - - /usr/bin/cut
      cut -b 1- /proc/956/cmdline
      4⤵
      PID:1597
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1000/cmdline
      4⤵
      PID:1598
  - - /usr/local/bin/cut
      cut -b 1- /proc/1000/cmdline
      4⤵
      PID:1598
  - - /usr/sbin/cut
      cut -b 1- /proc/1000/cmdline
      4⤵
      PID:1598
  - - /usr/bin/cut
      cut -b 1- /proc/1000/cmdline
      4⤵
      PID:1598
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1005/cmdline
      4⤵
      PID:1599
  - - /usr/local/bin/cut
      cut -b 1- /proc/1005/cmdline
      4⤵
      PID:1599
  - - /usr/sbin/cut
      cut -b 1- /proc/1005/cmdline
      4⤵
      PID:1599
  - - /usr/bin/cut
      cut -b 1- /proc/1005/cmdline
      4⤵
      PID:1599
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1029/cmdline
      4⤵
      PID:1600
  - - /usr/local/bin/cut
      cut -b 1- /proc/1029/cmdline
      4⤵
      PID:1600
  - - /usr/sbin/cut
      cut -b 1- /proc/1029/cmdline
      4⤵
      PID:1600
  - - /usr/bin/cut
      cut -b 1- /proc/1029/cmdline
      4⤵
      Reads runtime system information
      PID:1600
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1035/cmdline
      4⤵
      PID:1601
  - - /usr/local/bin/cut
      cut -b 1- /proc/1035/cmdline
      4⤵
      PID:1601
  - - /usr/sbin/cut
      cut -b 1- /proc/1035/cmdline
      4⤵
      PID:1601
  - - /usr/bin/cut
      cut -b 1- /proc/1035/cmdline
      4⤵
      PID:1601
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1050/cmdline
      4⤵
      PID:1602
  - - /usr/local/bin/cut
      cut -b 1- /proc/1050/cmdline
      4⤵
      PID:1602
  - - /usr/sbin/cut
      cut -b 1- /proc/1050/cmdline
      4⤵
      PID:1602
  - - /usr/bin/cut
      cut -b 1- /proc/1050/cmdline
      4⤵
      Reads runtime system information
      PID:1602
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1054/cmdline
      4⤵
      PID:1603
  - - /usr/local/bin/cut
      cut -b 1- /proc/1054/cmdline
      4⤵
      PID:1603
  - - /usr/sbin/cut
      cut -b 1- /proc/1054/cmdline
      4⤵
      PID:1603
  - - /usr/bin/cut
      cut -b 1- /proc/1054/cmdline
      4⤵
      PID:1603
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1057/cmdline
      4⤵
      PID:1604
  - - /usr/local/bin/cut
      cut -b 1- /proc/1057/cmdline
      4⤵
      PID:1604
  - - /usr/sbin/cut
      cut -b 1- /proc/1057/cmdline
      4⤵
      PID:1604
  - - /usr/bin/cut
      cut -b 1- /proc/1057/cmdline
      4⤵
      PID:1604
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1059/cmdline
      4⤵
      PID:1605
  - - /usr/local/bin/cut
      cut -b 1- /proc/1059/cmdline
      4⤵
      PID:1605
  - - /usr/sbin/cut
      cut -b 1- /proc/1059/cmdline
      4⤵
      PID:1605
  - - /usr/bin/cut
      cut -b 1- /proc/1059/cmdline
      4⤵
      PID:1605
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1066/cmdline
      4⤵
      PID:1606
  - - /usr/local/bin/cut
      cut -b 1- /proc/1066/cmdline
      4⤵
      PID:1606
  - - /usr/sbin/cut
      cut -b 1- /proc/1066/cmdline
      4⤵
      PID:1606
  - - /usr/bin/cut
      cut -b 1- /proc/1066/cmdline
      4⤵
      PID:1606
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1073/cmdline
      4⤵
      PID:1607
  - - /usr/local/bin/cut
      cut -b 1- /proc/1073/cmdline
      4⤵
      PID:1607
  - - /usr/sbin/cut
      cut -b 1- /proc/1073/cmdline
      4⤵
      PID:1607
  - - /usr/bin/cut
      cut -b 1- /proc/1073/cmdline
      4⤵
      Reads runtime system information
      PID:1607
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1077/cmdline
      4⤵
      PID:1608
  - - /usr/local/bin/cut
      cut -b 1- /proc/1077/cmdline
      4⤵
      PID:1608
  - - /usr/sbin/cut
      cut -b 1- /proc/1077/cmdline
      4⤵
      PID:1608
  - - /usr/bin/cut
      cut -b 1- /proc/1077/cmdline
      4⤵
      Reads runtime system information
      PID:1608
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1086/cmdline
      4⤵
      PID:1609
  - - /usr/local/bin/cut
      cut -b 1- /proc/1086/cmdline
      4⤵
      PID:1609
  - - /usr/sbin/cut
      cut -b 1- /proc/1086/cmdline
      4⤵
      PID:1609
  - - /usr/bin/cut
      cut -b 1- /proc/1086/cmdline
      4⤵
      Reads runtime system information
      PID:1609
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1101/cmdline
      4⤵
      PID:1610
  - - /usr/local/bin/cut
      cut -b 1- /proc/1101/cmdline
      4⤵
      PID:1610
  - - /usr/sbin/cut
      cut -b 1- /proc/1101/cmdline
      4⤵
      PID:1610
  - - /usr/bin/cut
      cut -b 1- /proc/1101/cmdline
      4⤵
      Reads runtime system information
      PID:1610
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1104/cmdline
      4⤵
      PID:1611
  - - /usr/local/bin/cut
      cut -b 1- /proc/1104/cmdline
      4⤵
      PID:1611
  - - /usr/sbin/cut
      cut -b 1- /proc/1104/cmdline
      4⤵
      PID:1611
  - - /usr/bin/cut
      cut -b 1- /proc/1104/cmdline
      4⤵
      PID:1611
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1110/cmdline
      4⤵
      PID:1612
  - - /usr/local/bin/cut
      cut -b 1- /proc/1110/cmdline
      4⤵
      PID:1612
  - - /usr/sbin/cut
      cut -b 1- /proc/1110/cmdline
      4⤵
      PID:1612
  - - /usr/bin/cut
      cut -b 1- /proc/1110/cmdline
      4⤵
      PID:1612
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1114/cmdline
      4⤵
      PID:1613
  - - /usr/local/bin/cut
      cut -b 1- /proc/1114/cmdline
      4⤵
      PID:1613
  - - /usr/sbin/cut
      cut -b 1- /proc/1114/cmdline
      4⤵
      PID:1613
  - - /usr/bin/cut
      cut -b 1- /proc/1114/cmdline
      4⤵
      Reads runtime system information
      PID:1613
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1118/cmdline
      4⤵
      PID:1614
  - - /usr/local/bin/cut
      cut -b 1- /proc/1118/cmdline
      4⤵
      PID:1614
  - - /usr/sbin/cut
      cut -b 1- /proc/1118/cmdline
      4⤵
      PID:1614
  - - /usr/bin/cut
      cut -b 1- /proc/1118/cmdline
      4⤵
      PID:1614
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1122/cmdline
      4⤵
      PID:1615
  - - /usr/local/bin/cut
      cut -b 1- /proc/1122/cmdline
      4⤵
      PID:1615
  - - /usr/sbin/cut
      cut -b 1- /proc/1122/cmdline
      4⤵
      PID:1615
  - - /usr/bin/cut
      cut -b 1- /proc/1122/cmdline
      4⤵
      Reads runtime system information
      PID:1615
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1126/cmdline
      4⤵
      PID:1616
  - - /usr/local/bin/cut
      cut -b 1- /proc/1126/cmdline
      4⤵
      PID:1616
  - - /usr/sbin/cut
      cut -b 1- /proc/1126/cmdline
      4⤵
      PID:1616
  - - /usr/bin/cut
      cut -b 1- /proc/1126/cmdline
      4⤵
      PID:1616
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1131/cmdline
      4⤵
      PID:1617
  - - /usr/local/bin/cut
      cut -b 1- /proc/1131/cmdline
      4⤵
      PID:1617
  - - /usr/sbin/cut
      cut -b 1- /proc/1131/cmdline
      4⤵
      PID:1617
  - - /usr/bin/cut
      cut -b 1- /proc/1131/cmdline
      4⤵
      PID:1617
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1136/cmdline
      4⤵
      PID:1618
  - - /usr/local/bin/cut
      cut -b 1- /proc/1136/cmdline
      4⤵
      PID:1618
  - - /usr/sbin/cut
      cut -b 1- /proc/1136/cmdline
      4⤵
      PID:1618
  - - /usr/bin/cut
      cut -b 1- /proc/1136/cmdline
      4⤵
      PID:1618
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1137/cmdline
      4⤵
      PID:1619
  - - /usr/local/bin/cut
      cut -b 1- /proc/1137/cmdline
      4⤵
      PID:1619
  - - /usr/sbin/cut
      cut -b 1- /proc/1137/cmdline
      4⤵
      PID:1619
  - - /usr/bin/cut
      cut -b 1- /proc/1137/cmdline
      4⤵
      PID:1619
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1140/cmdline
      4⤵
      PID:1620
  - - /usr/local/bin/cut
      cut -b 1- /proc/1140/cmdline
      4⤵
      PID:1620
  - - /usr/sbin/cut
      cut -b 1- /proc/1140/cmdline
      4⤵
      PID:1620
  - - /usr/bin/cut
      cut -b 1- /proc/1140/cmdline
      4⤵
      Reads runtime system information
      PID:1620
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1141/cmdline
      4⤵
      PID:1621
  - - /usr/local/bin/cut
      cut -b 1- /proc/1141/cmdline
      4⤵
      PID:1621
  - - /usr/sbin/cut
      cut -b 1- /proc/1141/cmdline
      4⤵
      PID:1621
  - - /usr/bin/cut
      cut -b 1- /proc/1141/cmdline
      4⤵
      Reads runtime system information
      PID:1621
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1143/cmdline
      4⤵
      PID:1622
  - - /usr/local/bin/cut
      cut -b 1- /proc/1143/cmdline
      4⤵
      PID:1622
  - - /usr/sbin/cut
      cut -b 1- /proc/1143/cmdline
      4⤵
      PID:1622
  - - /usr/bin/cut
      cut -b 1- /proc/1143/cmdline
      4⤵
      PID:1622
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1151/cmdline
      4⤵
      PID:1623
  - - /usr/local/bin/cut
      cut -b 1- /proc/1151/cmdline
      4⤵
      PID:1623
  - - /usr/sbin/cut
      cut -b 1- /proc/1151/cmdline
      4⤵
      PID:1623
  - - /usr/bin/cut
      cut -b 1- /proc/1151/cmdline
      4⤵
      PID:1623
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1154/cmdline
      4⤵
      PID:1624
  - - /usr/local/bin/cut
      cut -b 1- /proc/1154/cmdline
      4⤵
      PID:1624
  - - /usr/sbin/cut
      cut -b 1- /proc/1154/cmdline
      4⤵
      PID:1624
  - - /usr/bin/cut
      cut -b 1- /proc/1154/cmdline
      4⤵
      Reads runtime system information
      PID:1624
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1155/cmdline
      4⤵
      PID:1625
  - - /usr/local/bin/cut
      cut -b 1- /proc/1155/cmdline
      4⤵
      PID:1625
  - - /usr/sbin/cut
      cut -b 1- /proc/1155/cmdline
      4⤵
      PID:1625
  - - /usr/bin/cut
      cut -b 1- /proc/1155/cmdline
      4⤵
      PID:1625
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1157/cmdline
      4⤵
      PID:1626
  - - /usr/local/bin/cut
      cut -b 1- /proc/1157/cmdline
      4⤵
      PID:1626
  - - /usr/sbin/cut
      cut -b 1- /proc/1157/cmdline
      4⤵
      PID:1626
  - - /usr/bin/cut
      cut -b 1- /proc/1157/cmdline
      4⤵
      Reads runtime system information
      PID:1626
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1161/cmdline
      4⤵
      PID:1627
  - - /usr/local/bin/cut
      cut -b 1- /proc/1161/cmdline
      4⤵
      PID:1627
  - - /usr/sbin/cut
      cut -b 1- /proc/1161/cmdline
      4⤵
      PID:1627
  - - /usr/bin/cut
      cut -b 1- /proc/1161/cmdline
      4⤵
      PID:1627
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1169/cmdline
      4⤵
      PID:1628
  - - /usr/local/bin/cut
      cut -b 1- /proc/1169/cmdline
      4⤵
      PID:1628
  - - /usr/sbin/cut
      cut -b 1- /proc/1169/cmdline
      4⤵
      PID:1628
  - - /usr/bin/cut
      cut -b 1- /proc/1169/cmdline
      4⤵
      PID:1628
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1172/cmdline
      4⤵
      PID:1629
  - - /usr/local/bin/cut
      cut -b 1- /proc/1172/cmdline
      4⤵
      PID:1629
  - - /usr/sbin/cut
      cut -b 1- /proc/1172/cmdline
      4⤵
      PID:1629
  - - /usr/bin/cut
      cut -b 1- /proc/1172/cmdline
      4⤵
      PID:1629
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1173/cmdline
      4⤵
      PID:1630
  - - /usr/local/bin/cut
      cut -b 1- /proc/1173/cmdline
      4⤵
      PID:1630
  - - /usr/sbin/cut
      cut -b 1- /proc/1173/cmdline
      4⤵
      PID:1630
  - - /usr/bin/cut
      cut -b 1- /proc/1173/cmdline
      4⤵
      Reads runtime system information
      PID:1630
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1174/cmdline
      4⤵
      PID:1631
  - - /usr/local/bin/cut
      cut -b 1- /proc/1174/cmdline
      4⤵
      PID:1631
  - - /usr/sbin/cut
      cut -b 1- /proc/1174/cmdline
      4⤵
      PID:1631
  - - /usr/bin/cut
      cut -b 1- /proc/1174/cmdline
      4⤵
      PID:1631
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1176/cmdline
      4⤵
      PID:1632
  - - /usr/local/bin/cut
      cut -b 1- /proc/1176/cmdline
      4⤵
      PID:1632
  - - /usr/sbin/cut
      cut -b 1- /proc/1176/cmdline
      4⤵
      PID:1632
  - - /usr/bin/cut
      cut -b 1- /proc/1176/cmdline
      4⤵
      PID:1632
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1179/cmdline
      4⤵
      PID:1633
  - - /usr/local/bin/cut
      cut -b 1- /proc/1179/cmdline
      4⤵
      PID:1633
  - - /usr/sbin/cut
      cut -b 1- /proc/1179/cmdline
      4⤵
      PID:1633
  - - /usr/bin/cut
      cut -b 1- /proc/1179/cmdline
      4⤵
      PID:1633
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1183/cmdline
      4⤵
      PID:1634
  - - /usr/local/bin/cut
      cut -b 1- /proc/1183/cmdline
      4⤵
      PID:1634
  - - /usr/sbin/cut
      cut -b 1- /proc/1183/cmdline
      4⤵
      PID:1634
  - - /usr/bin/cut
      cut -b 1- /proc/1183/cmdline
      4⤵
      PID:1634
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1221/cmdline
      4⤵
      PID:1635
  - - /usr/local/bin/cut
      cut -b 1- /proc/1221/cmdline
      4⤵
      PID:1635
  - - /usr/sbin/cut
      cut -b 1- /proc/1221/cmdline
      4⤵
      PID:1635
  - - /usr/bin/cut
      cut -b 1- /proc/1221/cmdline
      4⤵
      PID:1635
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1239/cmdline
      4⤵
      PID:1636
  - - /usr/local/bin/cut
      cut -b 1- /proc/1239/cmdline
      4⤵
      PID:1636
  - - /usr/sbin/cut
      cut -b 1- /proc/1239/cmdline
      4⤵
      PID:1636
  - - /usr/bin/cut
      cut -b 1- /proc/1239/cmdline
      4⤵
      Reads runtime system information
      PID:1636
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1240/cmdline
      4⤵
      PID:1637
  - - /usr/local/bin/cut
      cut -b 1- /proc/1240/cmdline
      4⤵
      PID:1637
  - - /usr/sbin/cut
      cut -b 1- /proc/1240/cmdline
      4⤵
      PID:1637
  - - /usr/bin/cut
      cut -b 1- /proc/1240/cmdline
      4⤵
      Reads runtime system information
      PID:1637
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1255/cmdline
      4⤵
      PID:1638
  - - /usr/local/bin/cut
      cut -b 1- /proc/1255/cmdline
      4⤵
      PID:1638
  - - /usr/sbin/cut
      cut -b 1- /proc/1255/cmdline
      4⤵
      PID:1638
  - - /usr/bin/cut
      cut -b 1- /proc/1255/cmdline
      4⤵
      Reads runtime system information
      PID:1638
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1274/cmdline
      4⤵
      PID:1639
  - - /usr/local/bin/cut
      cut -b 1- /proc/1274/cmdline
      4⤵
      PID:1639
  - - /usr/sbin/cut
      cut -b 1- /proc/1274/cmdline
      4⤵
      PID:1639
  - - /usr/bin/cut
      cut -b 1- /proc/1274/cmdline
      4⤵
      Reads runtime system information
      PID:1639
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1275/cmdline
      4⤵
      PID:1640
  - - /usr/local/bin/cut
      cut -b 1- /proc/1275/cmdline
      4⤵
      PID:1640
  - - /usr/sbin/cut
      cut -b 1- /proc/1275/cmdline
      4⤵
      PID:1640
  - - /usr/bin/cut
      cut -b 1- /proc/1275/cmdline
      4⤵
      Reads runtime system information
      PID:1640
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1283/cmdline
      4⤵
      PID:1641
  - - /usr/local/bin/cut
      cut -b 1- /proc/1283/cmdline
      4⤵
      PID:1641
  - - /usr/sbin/cut
      cut -b 1- /proc/1283/cmdline
      4⤵
      PID:1641
  - - /usr/bin/cut
      cut -b 1- /proc/1283/cmdline
      4⤵
      Reads runtime system information
      PID:1641
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1293/cmdline
      4⤵
      PID:1642
  - - /usr/local/bin/cut
      cut -b 1- /proc/1293/cmdline
      4⤵
      PID:1642
  - - /usr/sbin/cut
      cut -b 1- /proc/1293/cmdline
      4⤵
      PID:1642
  - - /usr/bin/cut
      cut -b 1- /proc/1293/cmdline
      4⤵
      PID:1642
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1298/cmdline
      4⤵
      PID:1643
  - - /usr/local/bin/cut
      cut -b 1- /proc/1298/cmdline
      4⤵
      PID:1643
  - - /usr/sbin/cut
      cut -b 1- /proc/1298/cmdline
      4⤵
      PID:1643
  - - /usr/bin/cut
      cut -b 1- /proc/1298/cmdline
      4⤵
      PID:1643
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1309/cmdline
      4⤵
      PID:1644
  - - /usr/local/bin/cut
      cut -b 1- /proc/1309/cmdline
      4⤵
      PID:1644
  - - /usr/sbin/cut
      cut -b 1- /proc/1309/cmdline
      4⤵
      PID:1644
  - - /usr/bin/cut
      cut -b 1- /proc/1309/cmdline
      4⤵
      Reads runtime system information
      PID:1644
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1323/cmdline
      4⤵
      PID:1645
  - - /usr/local/bin/cut
      cut -b 1- /proc/1323/cmdline
      4⤵
      PID:1645
  - - /usr/sbin/cut
      cut -b 1- /proc/1323/cmdline
      4⤵
      PID:1645
  - - /usr/bin/cut
      cut -b 1- /proc/1323/cmdline
      4⤵
      PID:1645
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1331/cmdline
      4⤵
      PID:1646
  - - /usr/local/bin/cut
      cut -b 1- /proc/1331/cmdline
      4⤵
      PID:1646
  - - /usr/sbin/cut
      cut -b 1- /proc/1331/cmdline
      4⤵
      PID:1646
  - - /usr/bin/cut
      cut -b 1- /proc/1331/cmdline
      4⤵
      PID:1646
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1338/cmdline
      4⤵
      PID:1647
  - - /usr/local/bin/cut
      cut -b 1- /proc/1338/cmdline
      4⤵
      PID:1647
  - - /usr/sbin/cut
      cut -b 1- /proc/1338/cmdline
      4⤵
      PID:1647
  - - /usr/bin/cut
      cut -b 1- /proc/1338/cmdline
      4⤵
      PID:1647
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1361/cmdline
      4⤵
      PID:1648
  - - /usr/local/bin/cut
      cut -b 1- /proc/1361/cmdline
      4⤵
      PID:1648
  - - /usr/sbin/cut
      cut -b 1- /proc/1361/cmdline
      4⤵
      PID:1648
  - - /usr/bin/cut
      cut -b 1- /proc/1361/cmdline
      4⤵
      PID:1648
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1458/cmdline
      4⤵
      PID:1649
  - - /usr/local/bin/cut
      cut -b 1- /proc/1458/cmdline
      4⤵
      PID:1649
  - - /usr/sbin/cut
      cut -b 1- /proc/1458/cmdline
      4⤵
      PID:1649
  - - /usr/bin/cut
      cut -b 1- /proc/1458/cmdline
      4⤵
      PID:1649
  - - /usr/local/sbin/cut
      cut -b 1- /proc/1473/cmdline
      4⤵
      PID:1650
  - - /usr/local/bin/cut
      cut -b 1- /proc/1473/cmdline
      4⤵
      PID:1650
  - - /usr/sbin/cut
      cut -b 1- /proc/1473/cmdline
      4⤵
      PID:1650
  - - /usr/bin/cut
      cut -b 1- /proc/1473/cmdline
      4⤵
      PID:1650
- - /usr/bin/whoami
    whoami
    3⤵
    PID:1484
- - /usr/bin/find
    find /proc -maxdepth 1 -mmin +0.2 -user root
    3⤵
    PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads