7761a32cbc96fb28a0c4268376e52819fa8874724ade80b1a20be9ab38d8ca12

execution persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/ld.so.preload	.X0-lock_x86_64.elf
File opened for modification	/etc/ld.so.preload	.16

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.nz2LpV	crontab

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/root/.bashrc	.16

Enumerates running processes
Discovers information about currently running processes on the system

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
23	api.ipify.org
24	api.ipify.org

Modifies Bash startup script 2 TTPs 1 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	.16

Changes its process name 6 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	top	1503	.X0-lock_x86_64.elf
Changes the process name, possibly in an attempt to hide itself	16	2220	.16
Changes the process name, possibly in an attempt to hide itself	libuv-worker	2266	.16
Changes the process name, possibly in an attempt to hide itself	libuv-worker	2263	.16
Changes the process name, possibly in an attempt to hide itself	libuv-worker	2265	.16
Changes the process name, possibly in an attempt to hide itself	libuv-worker	2264	.16

Reads CPU attributes 1 TTPs 54 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index15/level	.16
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/type	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index10/level	.16
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index6/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index12/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index13/level	.16
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_type	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/type	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/type	.16
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_list	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_list	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index4/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index7/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index11/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index14/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	.16
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	.16
File opened for reading	/sys/devices/system/cpu/cpu0/topology/die_id	.16
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	.16
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index9/level	.16
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_list	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index5/level	.16
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index8/level	.16

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	.16
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	.16

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/5/status	Process not Found
File opened for reading	/proc/10/status	Process not Found
File opened for reading	/proc/664/status	pgrep
File opened for reading	/proc/279/cmdline	pgrep
File opened for reading	/proc/32/cmdline	pgrep
File opened for reading	/proc/467/cmdline	Process not Found
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1045/status	pgrep
File opened for reading	/proc/442/status	pgrep
File opened for reading	/proc/1268/cmdline	pgrep
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/169/comm	cat
File opened for reading	/proc/1108/status	pgrep
File opened for reading	/proc/1204/cmdline	pgrep
File opened for reading	/proc/450/comm	Process not Found
File opened for reading	/proc/170/cmdline	pgrep
File opened for reading	/proc/717/status	pkill
File opened for reading	/proc/84/cmdline	pgrep
File opened for reading	/proc/1325/status	pgrep
File opened for reading	/proc/1325/cmdline	pgrep
File opened for reading	/proc/324/status	pkill
File opened for reading	/proc/1074/cmdline	pgrep
File opened for reading	/proc/173/status	ps
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/213/status	pgrep
File opened for reading	/proc/184/stat	ps
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/1325/cmdline	pgrep
File opened for reading	/proc/1049/cmdline	pkill
File opened for reading	/proc/1308/status	ps
File opened for reading	/proc/1352/status	pgrep
File opened for reading	/proc/32/status	Process not Found
File opened for reading	/proc/1352/status	Process not Found
File opened for reading	/proc/self/maps	Process not Found
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/1009/status	pgrep
File opened for reading	/proc/1493/status	pgrep
File opened for reading	/proc/581/cmdline	Process not Found
File opened for reading	/proc/1037/stat	Process not Found
File opened for reading	/proc/581/stat	Process not Found
File opened for reading	/proc/82/status	pgrep
File opened for reading	/proc/1168/cmdline	pkill
File opened for reading	/proc/2287/comm	cat
File opened for reading	/proc/925/stat	sh
File opened for reading	/proc/424/stat	Process not Found
File opened for reading	/proc/170/status	pgrep
File opened for reading	/proc/435/status	pgrep
File opened for reading	/proc/565/status	pkill
File opened for reading	/proc/928/status	pgrep
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/84/status	pgrep
File opened for reading	/proc/988/status	pgrep
File opened for reading	/proc/1169/status	Process not Found
File opened for reading	/proc/1074/cmdline	pgrep
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/618/comm	cat
File opened for reading	/proc/26/cmdline	pgrep
File opened for reading	/proc/717/cmdline	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/1084/status	Process not Found
File opened for reading	/proc/28/comm	Process not Found
File opened for reading	/proc/1508/status	pgrep
File opened for reading	/proc/184/cmdline	pgrep
File opened for reading	/proc/1057/status	pgrep

/tmp/.X0-lock_x86_64.elf
/tmp/.X0-lock_x86_64.elf
1⤵
- Modifies the dynamic linker configuration file
- Changes its process name
PID:1501
- /bin/sh
  sh -c "for pid in \$(pgrep -f sshd); do path=\$(readlink -f /proc/\$pid/exe 2>/dev/null); echo \"\$path\" | grep -qE \"^(/tmp/|/dev/shm/|/var/tmp/|\$HOME/).*sshd\" && [[ \"\$path\" != \"/usr/sbin/sshd\" ]] && kill -9 \$pid 2>/dev/null; done 2>/dev/null"
  2⤵
  PID:1508
- - /usr/bin/pgrep
    pgrep -f sshd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1509
- - /bin/readlink
    readlink -f /proc/571/exe
    3⤵
    PID:1512
- - /bin/grep
    grep -qE "^(/tmp/|/dev/shm/|/var/tmp/|/).*sshd"
    3⤵
    PID:1514
- - /bin/readlink
    readlink -f /proc/1508/exe
    3⤵
    PID:1516
- - /bin/grep
    grep -qE "^(/tmp/|/dev/shm/|/var/tmp/|/).*sshd"
    3⤵
    PID:1518
- /bin/sh
  sh -c "for p in /proc/[0-9]*; do n=\$(cat \$p/comm 2>/dev/null); x=\$(ls -l \$p/exe 2>/dev/null | awk '{print \$NF}'); case \"\$x\" in *\"(deleted)\"*) [ \"\$n\" = \"sshd\" ] && kill -9 \${p##*/} && echo \"Killed \${p##*/} - \$x\";; /usr/sbin/*|/sbin/*) ;; /home/*|/tmp/*|/dev/shm/*|/var/tmp/*|/var/*) [ \"\$n\" = \"sshd\" ] && kill -9 \${p##*/} && echo \"Killed \${p##*/} - \$x\";; esac; done"
  2⤵
  PID:1519
- - /bin/cat
    cat /proc/1/comm
    3⤵
    PID:1520
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1523
- - /bin/ls
    ls -l /proc/1/exe
    3⤵
    PID:1522
- - /bin/cat
    cat /proc/10/comm
    3⤵
    PID:1525
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1528
- - /bin/ls
    ls -l /proc/10/exe
    3⤵
    PID:1527
- - /bin/cat
    cat /proc/1005/comm
    3⤵
    PID:1529
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1532
- - /bin/ls
    ls -l /proc/1005/exe
    3⤵
    PID:1531
- - /bin/cat
    cat /proc/1009/comm
    3⤵
    PID:1533
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1536
- - /bin/ls
    ls -l /proc/1009/exe
    3⤵
    PID:1535
- - /bin/cat
    cat /proc/1018/comm
    3⤵
    PID:1537
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1540
- - /bin/ls
    ls -l /proc/1018/exe
    3⤵
    PID:1539
- - /bin/cat
    cat /proc/1032/comm
    3⤵
    PID:1541
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1544
- - /bin/ls
    ls -l /proc/1032/exe
    3⤵
    PID:1543
- - /bin/cat
    cat /proc/1037/comm
    3⤵
    PID:1545
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1548
- - /bin/ls
    ls -l /proc/1037/exe
    3⤵
    PID:1547
- - /bin/cat
    cat /proc/1041/comm
    3⤵
    PID:1552
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1555
- - /bin/ls
    ls -l /proc/1041/exe
    3⤵
    PID:1554
- - /bin/cat
    cat /proc/1045/comm
    3⤵
    PID:1556
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1559
- - /bin/ls
    ls -l /proc/1045/exe
    3⤵
    PID:1558
- - /bin/cat
    cat /proc/1049/comm
    3⤵
    PID:1560
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1563
- - /bin/ls
    ls -l /proc/1049/exe
    3⤵
    PID:1562
- - /bin/cat
    cat /proc/1053/comm
    3⤵
    PID:1564
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1567
- - /bin/ls
    ls -l /proc/1053/exe
    3⤵
    PID:1566
- - /bin/cat
    cat /proc/1057/comm
    3⤵
    PID:1568
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1571
- - /bin/ls
    ls -l /proc/1057/exe
    3⤵
    PID:1570
- - /bin/cat
    cat /proc/1062/comm
    3⤵
    PID:1572
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1575
- - /bin/ls
    ls -l /proc/1062/exe
    3⤵
    PID:1574
- - /bin/cat
    cat /proc/1066/comm
    3⤵
    PID:1576
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1579
- - /bin/ls
    ls -l /proc/1066/exe
    3⤵
    PID:1578
- - /bin/cat
    cat /proc/1068/comm
    3⤵
    PID:1580
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1583
- - /bin/ls
    ls -l /proc/1068/exe
    3⤵
    PID:1582
- - /bin/cat
    cat /proc/1070/comm
    3⤵
    PID:1584
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1587
- - /bin/ls
    ls -l /proc/1070/exe
    3⤵
    PID:1586
- - /bin/cat
    cat /proc/1072/comm
    3⤵
    PID:1588
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1591
- - /bin/ls
    ls -l /proc/1072/exe
    3⤵
    PID:1590
- - /bin/cat
    cat /proc/1074/comm
    3⤵
    PID:1592
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1595
- - /bin/ls
    ls -l /proc/1074/exe
    3⤵
    PID:1594
- - /bin/cat
    cat /proc/1083/comm
    3⤵
    PID:1596
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1599
- - /bin/ls
    ls -l /proc/1083/exe
    3⤵
    PID:1598
- - /bin/cat
    cat /proc/1084/comm
    3⤵
    PID:1600
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1603
- - /bin/ls
    ls -l /proc/1084/exe
    3⤵
    PID:1602
- - /bin/cat
    cat /proc/1088/comm
    3⤵
    PID:1604
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1607
- - /bin/ls
    ls -l /proc/1088/exe
    3⤵
    PID:1606
- - /bin/cat
    cat /proc/1090/comm
    3⤵
    PID:1609
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1613
- - /bin/ls
    ls -l /proc/1090/exe
    3⤵
    PID:1612
- - /bin/cat
    cat /proc/1095/comm
    3⤵
    PID:1614
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1617
- - /bin/ls
    ls -l /proc/1095/exe
    3⤵
    PID:1616
- - /bin/cat
    cat /proc/11/comm
    3⤵
    PID:1618
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1621
- - /bin/ls
    ls -l /proc/11/exe
    3⤵
    PID:1620
- - /bin/cat
    cat /proc/1103/comm
    3⤵
    PID:1623
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1627
- - /bin/ls
    ls -l /proc/1103/exe
    3⤵
    PID:1626
- - /bin/cat
    cat /proc/1106/comm
    3⤵
    PID:1628
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1631
- - /bin/ls
    ls -l /proc/1106/exe
    3⤵
    PID:1630
- - /bin/cat
    cat /proc/1107/comm
    3⤵
    PID:1632
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1635
- - /bin/ls
    ls -l /proc/1107/exe
    3⤵
    PID:1634
- - /bin/cat
    cat /proc/1108/comm
    3⤵
    PID:1636
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1639
- - /bin/ls
    ls -l /proc/1108/exe
    3⤵
    PID:1638
- - /bin/cat
    cat /proc/1109/comm
    3⤵
    PID:1641
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1644
- - /bin/ls
    ls -l /proc/1109/exe
    3⤵
    PID:1643
- - /bin/cat
    cat /proc/1112/comm
    3⤵
    PID:1645
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1648
- - /bin/ls
    ls -l /proc/1112/exe
    3⤵
    PID:1647
- - /bin/cat
    cat /proc/1114/comm
    3⤵
    PID:1649
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1652
- - /bin/ls
    ls -l /proc/1114/exe
    3⤵
    PID:1651
- - /bin/cat
    cat /proc/115/comm
    3⤵
    PID:1653
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1656
- - /bin/ls
    ls -l /proc/115/exe
    3⤵
    PID:1655
- - /bin/cat
    cat /proc/1155/comm
    3⤵
    PID:1657
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1660
- - /bin/ls
    ls -l /proc/1155/exe
    3⤵
    PID:1659
- - /bin/cat
    cat /proc/1168/comm
    3⤵
    PID:1661
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1664
- - /bin/ls
    ls -l /proc/1168/exe
    3⤵
    PID:1663
- - /bin/cat
    cat /proc/1169/comm
    3⤵
    PID:1665
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1668
- - /bin/ls
    ls -l /proc/1169/exe
    3⤵
    PID:1667
- - /bin/cat
    cat /proc/1170/comm
    3⤵
    PID:1669
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1672
- - /bin/ls
    ls -l /proc/1170/exe
    3⤵
    PID:1671
- - /bin/cat
    cat /proc/1188/comm
    3⤵
    PID:1673
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1676
- - /bin/ls
    ls -l /proc/1188/exe
    3⤵
    PID:1675
- - /bin/cat
    cat /proc/12/comm
    3⤵
    PID:1677
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1680
- - /bin/ls
    ls -l /proc/12/exe
    3⤵
    PID:1679
- - /bin/cat
    cat /proc/1204/comm
    3⤵
    PID:1681
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1684
- - /bin/ls
    ls -l /proc/1204/exe
    3⤵
    PID:1683
- - /bin/cat
    cat /proc/1206/comm
    3⤵
    PID:1685
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1688
- - /bin/ls
    ls -l /proc/1206/exe
    3⤵
    PID:1687
- - /bin/cat
    cat /proc/1262/comm
    3⤵
    PID:1689
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1692
- - /bin/ls
    ls -l /proc/1262/exe
    3⤵
    PID:1691
- - /bin/cat
    cat /proc/1268/comm
    3⤵
    PID:1693
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1696
- - /bin/ls
    ls -l /proc/1268/exe
    3⤵
    PID:1695
- - /bin/cat
    cat /proc/13/comm
    3⤵
    PID:1697
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1700
- - /bin/ls
    ls -l /proc/13/exe
    3⤵
    PID:1699
- - /bin/cat
    cat /proc/1308/comm
    3⤵
    PID:1701
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1704
- - /bin/ls
    ls -l /proc/1308/exe
    3⤵
    PID:1703
- - /bin/cat
    cat /proc/1310/comm
    3⤵
    PID:1705
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1708
- - /bin/ls
    ls -l /proc/1310/exe
    3⤵
    PID:1707
- - /bin/cat
    cat /proc/1325/comm
    3⤵
    PID:1709
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1712
- - /bin/ls
    ls -l /proc/1325/exe
    3⤵
    PID:1711
- - /bin/cat
    cat /proc/1332/comm
    3⤵
    PID:1713
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1716
- - /bin/ls
    ls -l /proc/1332/exe
    3⤵
    PID:1715
- - /bin/cat
    cat /proc/1352/comm
    3⤵
    PID:1717
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1720
- - /bin/ls
    ls -l /proc/1352/exe
    3⤵
    PID:1719
- - /bin/cat
    cat /proc/1361/comm
    3⤵
    PID:1721
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1724
- - /bin/ls
    ls -l /proc/1361/exe
    3⤵
    PID:1723
- - /bin/cat
    cat /proc/137/comm
    3⤵
    PID:1725
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1728
- - /bin/ls
    ls -l /proc/137/exe
    3⤵
    PID:1727
- - /bin/cat
    cat /proc/1390/comm
    3⤵
    PID:1729
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1732
- - /bin/ls
    ls -l /proc/1390/exe
    3⤵
    PID:1731
- - /bin/cat
    cat /proc/14/comm
    3⤵
    PID:1733
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1736
- - /bin/ls
    ls -l /proc/14/exe
    3⤵
    PID:1735
- - /bin/cat
    cat /proc/1468/comm
    3⤵
    PID:1737
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1740
- - /bin/ls
    ls -l /proc/1468/exe
    3⤵
    PID:1739
- - /bin/cat
    cat /proc/1493/comm
    3⤵
    PID:1741
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1744
- - /bin/ls
    ls -l /proc/1493/exe
    3⤵
    PID:1743
- - /bin/cat
    cat /proc/1497/comm
    3⤵
    PID:1745
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1748
- - /bin/ls
    ls -l /proc/1497/exe
    3⤵
    PID:1747
- - /bin/cat
    cat /proc/1498/comm
    3⤵
    PID:1749
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1752
- - /bin/ls
    ls -l /proc/1498/exe
    3⤵
    PID:1751
- - /bin/cat
    cat /proc/1499/comm
    3⤵
    PID:1753
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1756
- - /bin/ls
    ls -l /proc/1499/exe
    3⤵
    PID:1755
- - /bin/cat
    cat /proc/15/comm
    3⤵
    PID:1757
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1760
- - /bin/ls
    ls -l /proc/15/exe
    3⤵
    PID:1759
- - /bin/cat
    cat /proc/1503/comm
    3⤵
    PID:1761
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1764
- - /bin/ls
    ls -l /proc/1503/exe
    3⤵
    PID:1763
- - /bin/cat
    cat /proc/1519/comm
    3⤵
    PID:1765
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1768
- - /bin/ls
    ls -l /proc/1519/exe
    3⤵
    PID:1767
- - /bin/cat
    cat /proc/16/comm
    3⤵
    PID:1769
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1772
- - /bin/ls
    ls -l /proc/16/exe
    3⤵
    PID:1771
- - /bin/cat
    cat /proc/168/comm
    3⤵
    PID:1773
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    - Reads runtime system information
    PID:1776
- - /bin/ls
    ls -l /proc/168/exe
    3⤵
    PID:1775
- - /bin/cat
    cat /proc/169/comm
    3⤵
    PID:1777
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1780
- - /bin/ls
    ls -l /proc/169/exe
    3⤵
    PID:1779
- - /bin/cat
    cat /proc/17/comm
    3⤵
    PID:1781
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1784
- - /bin/ls
    ls -l /proc/17/exe
    3⤵
    PID:1783
- - /bin/cat
    cat /proc/170/comm
    3⤵
    PID:1785
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1788
- - /bin/ls
    ls -l /proc/170/exe
    3⤵
    PID:1787
- - /bin/cat
    cat /proc/171/comm
    3⤵
    PID:1789
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1792
- - /bin/ls
    ls -l /proc/171/exe
    3⤵
    PID:1791
- - /bin/cat
    cat /proc/172/comm
    3⤵
    PID:1793
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1796
- - /bin/ls
    ls -l /proc/172/exe
    3⤵
    PID:1795
- - /bin/cat
    cat /proc/173/comm
    3⤵
    PID:1797
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1800
- - /bin/ls
    ls -l /proc/173/exe
    3⤵
    - Reads runtime system information
    PID:1799
- - /bin/cat
    cat /proc/174/comm
    3⤵
    PID:1801
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1804
- - /bin/ls
    ls -l /proc/174/exe
    3⤵
    PID:1803
- - /bin/cat
    cat /proc/175/comm
    3⤵
    PID:1805
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1808
- - /bin/ls
    ls -l /proc/175/exe
    3⤵
    PID:1807
- - /bin/cat
    cat /proc/176/comm
    3⤵
    PID:1809
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1812
- - /bin/ls
    ls -l /proc/176/exe
    3⤵
    PID:1811
- - /bin/cat
    cat /proc/177/comm
    3⤵
    PID:1813
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1816
- - /bin/ls
    ls -l /proc/177/exe
    3⤵
    PID:1815
- - /bin/cat
    cat /proc/178/comm
    3⤵
    PID:1817
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1820
- - /bin/ls
    ls -l /proc/178/exe
    3⤵
    PID:1819
- - /bin/cat
    cat /proc/179/comm
    3⤵
    PID:1821
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1824
- - /bin/ls
    ls -l /proc/179/exe
    3⤵
    PID:1823
- - /bin/cat
    cat /proc/18/comm
    3⤵
    PID:1825
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1828
- - /bin/ls
    ls -l /proc/18/exe
    3⤵
    PID:1827
- - /bin/cat
    cat /proc/180/comm
    3⤵
    PID:1829
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1832
- - /bin/ls
    ls -l /proc/180/exe
    3⤵
    PID:1831
- - /bin/cat
    cat /proc/181/comm
    3⤵
    PID:1833
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1836
- - /bin/ls
    ls -l /proc/181/exe
    3⤵
    PID:1835
- - /bin/cat
    cat /proc/182/comm
    3⤵
    PID:1837
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1840
- - /bin/ls
    ls -l /proc/182/exe
    3⤵
    PID:1839
- - /bin/cat
    cat /proc/183/comm
    3⤵
    PID:1841
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1844
- - /bin/ls
    ls -l /proc/183/exe
    3⤵
    PID:1843
- - /bin/cat
    cat /proc/184/comm
    3⤵
    PID:1845
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1848
- - /bin/ls
    ls -l /proc/184/exe
    3⤵
    PID:1847
- - /bin/cat
    cat /proc/185/comm
    3⤵
    PID:1849
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1852
- - /bin/ls
    ls -l /proc/185/exe
    3⤵
    PID:1851
- - /bin/cat
    cat /proc/187/comm
    3⤵
    PID:1853
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1856
- - /bin/ls
    ls -l /proc/187/exe
    3⤵
    PID:1855
- - /bin/cat
    cat /proc/19/comm
    3⤵
    PID:1857
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1860
- - /bin/ls
    ls -l /proc/19/exe
    3⤵
    PID:1859
- - /bin/cat
    cat /proc/2/comm
    3⤵
    PID:1861
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1864
- - /bin/ls
    ls -l /proc/2/exe
    3⤵
    PID:1863
- - /bin/cat
    cat /proc/20/comm
    3⤵
    PID:1865
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1868
- - /bin/ls
    ls -l /proc/20/exe
    3⤵
    PID:1867
- - /bin/cat
    cat /proc/21/comm
    3⤵
    PID:1869
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1872
- - /bin/ls
    ls -l /proc/21/exe
    3⤵
    PID:1871
- - /bin/cat
    cat /proc/212/comm
    3⤵
    PID:1873
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1876
- - /bin/ls
    ls -l /proc/212/exe
    3⤵
    PID:1875
- - /bin/cat
    cat /proc/213/comm
    3⤵
    PID:1877
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1880
- - /bin/ls
    ls -l /proc/213/exe
    3⤵
    PID:1879
- - /bin/cat
    cat /proc/22/comm
    3⤵
    PID:1881
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1884
- - /bin/ls
    ls -l /proc/22/exe
    3⤵
    PID:1883
- - /bin/cat
    cat /proc/23/comm
    3⤵
    PID:1885
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1888
- - /bin/ls
    ls -l /proc/23/exe
    3⤵
    PID:1887
- - /bin/cat
    cat /proc/24/comm
    3⤵
    PID:1889
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1892
- - /bin/ls
    ls -l /proc/24/exe
    3⤵
    PID:1891
- - /bin/cat
    cat /proc/25/comm
    3⤵
    PID:1893
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1896
- - /bin/ls
    ls -l /proc/25/exe
    3⤵
    PID:1895
- - /bin/cat
    cat /proc/26/comm
    3⤵
    PID:1897
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1900
- - /bin/ls
    ls -l /proc/26/exe
    3⤵
    PID:1899
- - /bin/cat
    cat /proc/261/comm
    3⤵
    PID:1902
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1906
- - /bin/ls
    ls -l /proc/261/exe
    3⤵
    PID:1905
- - /bin/cat
    cat /proc/27/comm
    3⤵
    PID:1907
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1910
- - /bin/ls
    ls -l /proc/27/exe
    3⤵
    PID:1909
- - /bin/cat
    cat /proc/279/comm
    3⤵
    PID:1911
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1916
- - /bin/ls
    ls -l /proc/279/exe
    3⤵
    PID:1915
- - /bin/cat
    cat /proc/28/comm
    3⤵
    PID:1917
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1920
- - /bin/ls
    ls -l /proc/28/exe
    3⤵
    PID:1919
- - /bin/cat
    cat /proc/29/comm
    3⤵
    PID:1921
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1924
- - /bin/ls
    ls -l /proc/29/exe
    3⤵
    PID:1923
- - /bin/cat
    cat /proc/3/comm
    3⤵
    PID:1925
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1928
- - /bin/ls
    ls -l /proc/3/exe
    3⤵
    PID:1927
- - /bin/cat
    cat /proc/30/comm
    3⤵
    PID:1929
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1932
- - /bin/ls
    ls -l /proc/30/exe
    3⤵
    PID:1931
- - /bin/cat
    cat /proc/31/comm
    3⤵
    PID:1933
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1936
- - /bin/ls
    ls -l /proc/31/exe
    3⤵
    PID:1935
- - /bin/cat
    cat /proc/32/comm
    3⤵
    PID:1937
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1940
- - /bin/ls
    ls -l /proc/32/exe
    3⤵
    PID:1939
- - /bin/cat
    cat /proc/321/comm
    3⤵
    PID:1941
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1944
- - /bin/ls
    ls -l /proc/321/exe
    3⤵
    PID:1943
- - /bin/cat
    cat /proc/324/comm
    3⤵
    PID:1945
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1948
- - /bin/ls
    ls -l /proc/324/exe
    3⤵
    PID:1947
- - /bin/cat
    cat /proc/34/comm
    3⤵
    PID:1949
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1952
- - /bin/ls
    ls -l /proc/34/exe
    3⤵
    PID:1951
- - /bin/cat
    cat /proc/35/comm
    3⤵
    PID:1953
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1956
- - /bin/ls
    ls -l /proc/35/exe
    3⤵
    PID:1955
- - /bin/cat
    cat /proc/36/comm
    3⤵
    PID:1957
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1960
- - /bin/ls
    ls -l /proc/36/exe
    3⤵
    PID:1959
- - /bin/cat
    cat /proc/4/comm
    3⤵
    PID:1961
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1964
- - /bin/ls
    ls -l /proc/4/exe
    3⤵
    PID:1963
- - /bin/cat
    cat /proc/424/comm
    3⤵
    PID:1965
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1968
- - /bin/ls
    ls -l /proc/424/exe
    3⤵
    PID:1967
- - /bin/cat
    cat /proc/435/comm
    3⤵
    PID:1969
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1972
- - /bin/ls
    ls -l /proc/435/exe
    3⤵
    PID:1971
- - /bin/cat
    cat /proc/442/comm
    3⤵
    PID:1973
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1976
- - /bin/ls
    ls -l /proc/442/exe
    3⤵
    PID:1975
- - /bin/cat
    cat /proc/450/comm
    3⤵
    PID:1977
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1980
- - /bin/ls
    ls -l /proc/450/exe
    3⤵
    PID:1979
- - /bin/cat
    cat /proc/456/comm
    3⤵
    PID:1981
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1984
- - /bin/ls
    ls -l /proc/456/exe
    3⤵
    PID:1983
- - /bin/cat
    cat /proc/460/comm
    3⤵
    PID:1985
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1988
- - /bin/ls
    ls -l /proc/460/exe
    3⤵
    PID:1987
- - /bin/cat
    cat /proc/462/comm
    3⤵
    PID:1989
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1992
- - /bin/ls
    ls -l /proc/462/exe
    3⤵
    PID:1991
- - /bin/cat
    cat /proc/467/comm
    3⤵
    PID:1993
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:1996
- - /bin/ls
    ls -l /proc/467/exe
    3⤵
    PID:1995
- - /bin/cat
    cat /proc/472/comm
    3⤵
    PID:1997
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2000
- - /bin/ls
    ls -l /proc/472/exe
    3⤵
    PID:1999
- - /bin/cat
    cat /proc/473/comm
    3⤵
    PID:2001
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2004
- - /bin/ls
    ls -l /proc/473/exe
    3⤵
    PID:2003
- - /bin/cat
    cat /proc/481/comm
    3⤵
    PID:2005
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2008
- - /bin/ls
    ls -l /proc/481/exe
    3⤵
    PID:2007
- - /bin/cat
    cat /proc/490/comm
    3⤵
    PID:2009
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2012
- - /bin/ls
    ls -l /proc/490/exe
    3⤵
    PID:2011
- - /bin/cat
    cat /proc/495/comm
    3⤵
    PID:2013
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2016
- - /bin/ls
    ls -l /proc/495/exe
    3⤵
    PID:2015
- - /bin/cat
    cat /proc/5/comm
    3⤵
    PID:2017
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2020
- - /bin/ls
    ls -l /proc/5/exe
    3⤵
    PID:2019
- - /bin/cat
    cat /proc/501/comm
    3⤵
    PID:2021
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2024
- - /bin/ls
    ls -l /proc/501/exe
    3⤵
    PID:2023
- - /bin/cat
    cat /proc/502/comm
    3⤵
    PID:2025
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2028
- - /bin/ls
    ls -l /proc/502/exe
    3⤵
    PID:2027
- - /bin/cat
    cat /proc/511/comm
    3⤵
    PID:2029
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2032
- - /bin/ls
    ls -l /proc/511/exe
    3⤵
    PID:2031
- - /bin/cat
    cat /proc/540/comm
    3⤵
    PID:2033
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2036
- - /bin/ls
    ls -l /proc/540/exe
    3⤵
    PID:2035
- - /bin/cat
    cat /proc/542/comm
    3⤵
    PID:2037
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2040
- - /bin/ls
    ls -l /proc/542/exe
    3⤵
    PID:2039
- - /bin/cat
    cat /proc/565/comm
    3⤵
    PID:2041
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2044
- - /bin/ls
    ls -l /proc/565/exe
    3⤵
    PID:2043
- - /bin/cat
    cat /proc/571/comm
    3⤵
    PID:2045
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2048
- - /bin/ls
    ls -l /proc/571/exe
    3⤵
    PID:2047
- - /bin/cat
    cat /proc/581/comm
    3⤵
    PID:2049
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2052
- - /bin/ls
    ls -l /proc/581/exe
    3⤵
    PID:2051
- - /bin/cat
    cat /proc/595/comm
    3⤵
    PID:2053
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2056
- - /bin/ls
    ls -l /proc/595/exe
    3⤵
    PID:2055
- - /bin/cat
    cat /proc/6/comm
    3⤵
    PID:2057
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2060
- - /bin/ls
    ls -l /proc/6/exe
    3⤵
    PID:2059
- - /bin/cat
    cat /proc/618/comm
    3⤵
    - Reads runtime system information
    PID:2061
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2064
- - /bin/ls
    ls -l /proc/618/exe
    3⤵
    PID:2063
- - /bin/cat
    cat /proc/619/comm
    3⤵
    PID:2065
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2068
- - /bin/ls
    ls -l /proc/619/exe
    3⤵
    PID:2067
- - /bin/cat
    cat /proc/656/comm
    3⤵
    PID:2069
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2072
- - /bin/ls
    ls -l /proc/656/exe
    3⤵
    PID:2071
- - /bin/cat
    cat /proc/664/comm
    3⤵
    PID:2073
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2076
- - /bin/ls
    ls -l /proc/664/exe
    3⤵
    PID:2075
- - /bin/cat
    cat /proc/667/comm
    3⤵
    PID:2077
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2080
- - /bin/ls
    ls -l /proc/667/exe
    3⤵
    PID:2079
- - /bin/cat
    cat /proc/680/comm
    3⤵
    PID:2081
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2084
- - /bin/ls
    ls -l /proc/680/exe
    3⤵
    PID:2083
- - /bin/cat
    cat /proc/681/comm
    3⤵
    PID:2085
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2088
- - /bin/ls
    ls -l /proc/681/exe
    3⤵
    PID:2087
- - /bin/cat
    cat /proc/683/comm
    3⤵
    PID:2089
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2092
- - /bin/ls
    ls -l /proc/683/exe
    3⤵
    PID:2091
- - /bin/cat
    cat /proc/7/comm
    3⤵
    PID:2093
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2096
- - /bin/ls
    ls -l /proc/7/exe
    3⤵
    PID:2095
- - /bin/cat
    cat /proc/709/comm
    3⤵
    PID:2097
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2100
- - /bin/ls
    ls -l /proc/709/exe
    3⤵
    PID:2099
- - /bin/cat
    cat /proc/717/comm
    3⤵
    PID:2101
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2104
- - /bin/ls
    ls -l /proc/717/exe
    3⤵
    PID:2103
- - /bin/cat
    cat /proc/731/comm
    3⤵
    PID:2105
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2108
- - /bin/ls
    ls -l /proc/731/exe
    3⤵
    PID:2107
- - /bin/cat
    cat /proc/78/comm
    3⤵
    PID:2109
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2112
- - /bin/ls
    ls -l /proc/78/exe
    3⤵
    PID:2111
- - /bin/cat
    cat /proc/79/comm
    3⤵
    PID:2113
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2116
- - /bin/ls
    ls -l /proc/79/exe
    3⤵
    PID:2115
- - /bin/cat
    cat /proc/8/comm
    3⤵
    PID:2117
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2120
- - /bin/ls
    ls -l /proc/8/exe
    3⤵
    PID:2119
- - /bin/cat
    cat /proc/80/comm
    3⤵
    PID:2121
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2124
- - /bin/ls
    ls -l /proc/80/exe
    3⤵
    PID:2123
- - /bin/cat
    cat /proc/81/comm
    3⤵
    PID:2125
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2128
- - /bin/ls
    ls -l /proc/81/exe
    3⤵
    PID:2127
- - /bin/cat
    cat /proc/82/comm
    3⤵
    PID:2129
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2132
- - /bin/ls
    ls -l /proc/82/exe
    3⤵
    PID:2131
- - /bin/cat
    cat /proc/83/comm
    3⤵
    PID:2133
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2136
- - /bin/ls
    ls -l /proc/83/exe
    3⤵
    PID:2135
- - /bin/cat
    cat /proc/84/comm
    3⤵
    PID:2137
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2140
- - /bin/ls
    ls -l /proc/84/exe
    3⤵
    PID:2139
- - /bin/cat
    cat /proc/86/comm
    3⤵
    PID:2141
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2144
- - /bin/ls
    ls -l /proc/86/exe
    3⤵
    PID:2143
- - /bin/cat
    cat /proc/89/comm
    3⤵
    PID:2145
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2148
- - /bin/ls
    ls -l /proc/89/exe
    3⤵
    PID:2147
- - /bin/cat
    cat /proc/9/comm
    3⤵
    PID:2149
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2152
- - /bin/ls
    ls -l /proc/9/exe
    3⤵
    PID:2151
- - /bin/cat
    cat /proc/918/comm
    3⤵
    PID:2153
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2156
- - /bin/ls
    ls -l /proc/918/exe
    3⤵
    PID:2155
- - /bin/cat
    cat /proc/920/comm
    3⤵
    PID:2157
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2160
- - /bin/ls
    ls -l /proc/920/exe
    3⤵
    PID:2159
- - /bin/cat
    cat /proc/925/comm
    3⤵
    PID:2161
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2164
- - /bin/ls
    ls -l /proc/925/exe
    3⤵
    PID:2163
- - /bin/cat
    cat /proc/928/comm
    3⤵
    PID:2165
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2168
- - /bin/ls
    ls -l /proc/928/exe
    3⤵
    PID:2167
- - /bin/cat
    cat /proc/942/comm
    3⤵
    PID:2169
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2172
- - /bin/ls
    ls -l /proc/942/exe
    3⤵
    PID:2171
- - /bin/cat
    cat /proc/947/comm
    3⤵
    PID:2173
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2176
- - /bin/ls
    ls -l /proc/947/exe
    3⤵
    PID:2175
- - /bin/cat
    cat /proc/961/comm
    3⤵
    PID:2177
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2180
- - /bin/ls
    ls -l /proc/961/exe
    3⤵
    PID:2179
- - /bin/cat
    cat /proc/967/comm
    3⤵
    PID:2181
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2184
- - /bin/ls
    ls -l /proc/967/exe
    3⤵
    PID:2183
- - /bin/cat
    cat /proc/98/comm
    3⤵
    PID:2185
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2188
- - /bin/ls
    ls -l /proc/98/exe
    3⤵
    PID:2187
- - /bin/cat
    cat /proc/981/comm
    3⤵
    PID:2189
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2192
- - /bin/ls
    ls -l /proc/981/exe
    3⤵
    PID:2191
- - /bin/cat
    cat /proc/985/comm
    3⤵
    PID:2193
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2196
- - /bin/ls
    ls -l /proc/985/exe
    3⤵
    PID:2195
- - /bin/cat
    cat /proc/988/comm
    3⤵
    PID:2197
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2200
- - /bin/ls
    ls -l /proc/988/exe
    3⤵
    PID:2199
- - /bin/cat
    cat /proc/990/comm
    3⤵
    PID:2201
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2204
- - /bin/ls
    ls -l /proc/990/exe
    3⤵
    PID:2203
- - /bin/cat
    cat /proc/995/comm
    3⤵
    PID:2205
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2208
- - /bin/ls
    ls -l /proc/995/exe
    3⤵
    PID:2207
- /bin/sh
  sh -c "pgrep -x '16' 2>/dev/null"
  2⤵
  PID:1608
- - /usr/bin/pgrep
    pgrep -x 16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1610
- /bin/sh
  sh -c "pgrep -x '.16' 2>/dev/null"
  2⤵
  PID:1622
- - /usr/bin/pgrep
    pgrep -x .16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1624
- /bin/sh
  sh -c "pgrep -x '16' 2>/dev/null"
  2⤵
  PID:1901
- - /usr/bin/pgrep
    pgrep -x 16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1903
- /bin/sh
  sh -c "pgrep -x '.16' 2>/dev/null"
  2⤵
  PID:1912
- - /usr/bin/pgrep
    pgrep -x .16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1914
- /bin/sh
  sh -c "pkill -9 -f '.b0s'; pkill -9 -f 'b0s'; pkill -9 -f 'yum.log'; pkill -9 -f 'apt.log'; rm -f \"\$HOME/.bash_history\" /var/tmp/apt.log /var/tmp/yum.log"
  2⤵
  PID:2209
- - /usr/bin/pkill
    pkill -9 -f .b0s
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2210
- /bin/sh
  sh -c "pgrep -x '16' 2>/dev/null"
  2⤵
  PID:2211
- - /usr/bin/pgrep
    pgrep -x 16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2212
- /bin/sh
  sh -c "pgrep -x '.16' 2>/dev/null"
  2⤵
  PID:2213
- - /usr/bin/pgrep
    pgrep -x .16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2214
- /bin/sh
  sh -c "ps -eo pid,comm,%cpu | awk '\$2==\"16\"' | sort -k3nr | awk 'NR>1{print \$1}' | xargs kill 2>/dev/null || pgrep -x '16' | tail -n +2 | xargs kill 2>/dev/null"
  2⤵
  PID:2410
- - /usr/bin/awk
    awk "\$2==\"16\""
    3⤵
    PID:2412
- - /bin/ps
    ps -eo "pid,comm,%cpu"
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2411
- - /usr/bin/sort
    sort -k3nr
    3⤵
    PID:2413
- - /usr/bin/awk
    awk "NR>1{print \$1}"
    3⤵
    PID:2414
- - /usr/bin/xargs
    xargs kill
    3⤵
    PID:2415
  - - /usr/local/sbin/kill
      kill
      4⤵
      PID:2432
  - - /usr/local/bin/kill
      kill
      4⤵
      PID:2432
  - - /usr/sbin/kill
      kill
      4⤵
      PID:2432
  - - /usr/bin/kill
      kill
      4⤵
      PID:2432
  - - /sbin/kill
      kill
      4⤵
      PID:2432
  - - /bin/kill
      kill
      4⤵
      Reads CPU attributes
      PID:2432
- - /usr/bin/xargs
    xargs kill
    3⤵
    PID:2436
  - - /usr/local/sbin/kill
      kill
      4⤵
      PID:2452
  - - /usr/local/bin/kill
      kill
      4⤵
      PID:2452
  - - /usr/sbin/kill
      kill
      4⤵
      PID:2452
  - - /usr/bin/kill
      kill
      4⤵
      PID:2452
  - - /sbin/kill
      kill
      4⤵
      PID:2452
  - - /bin/kill
      kill
      4⤵
      Reads CPU attributes
      PID:2452
- - /usr/bin/tail
    tail -n +2
    3⤵
    PID:2435
- - /usr/bin/pgrep
    pgrep -x 16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2434
- /bin/sh
  sh -c "for p in /proc/[0-9]*; do pid=\${p#/proc/}; [ \"\$pid\" = \"\$\$\" ] && continue; read name rest < \"\$p/stat\"; name=\${name#(}; name=\${name%)}; [ \"\$name\" = \"16\" ] && echo \"\$pid \$((\$(awk '{print \$14+\$15}' \"\$p/stat\")))\"; done | sort -k2nr | awk 'NR>1{print \$1}' | while read pid; do kill -9 \"\$pid\" 2>/dev/null; done"
  2⤵
  PID:2453
- - /usr/bin/awk
    awk "NR>1{print \$1}"
    3⤵
    PID:2456
- - /usr/bin/sort
    sort -k2nr
    3⤵
    PID:2455
- - /usr/bin/awk
    awk "{print \$14+\$15}" /proc/16/stat
    3⤵
    PID:2554
- /bin/sh
  sh -c "pids=\$(pgrep -x 'X0-lock'); if [ -n \"\$pids\" ]; then alive=\$(echo \"\$pids\" | xargs ps -o pid= -p 2>/dev/null | wc -l); if [ \$alive -gt 1 ]; then oldest=\$(echo \"\$pids\" | xargs ps -o pid=,etime= -p 2>/dev/null | sort -k2 | head -1 | awk '{print \$1}'); echo \"\$pids\" | grep -v \"\$oldest\" | xargs kill -9 2>/dev/null; elif [ \$alive -eq 0 ]; then true; else echo \"\$pids\"; fi; fi"
  2⤵
  PID:2695
- - /usr/bin/pgrep
    pgrep -x X0-lock
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2696
- /bin/sh
  sh -c "for p in /proc/[0-9]*; do pid=\${p#/proc/}; [ \"\$pid\" = \"\$\$\" ] && continue; read name rest < \"\$p/stat\"; name=\${name#(}; name=\${name%)}; [ \"\$name\" = \"X0-lock\" ] && echo \"\$pid \$(awk '{print \$22}' \"\$p/stat\")\"; done | sort -k2n | awk 'NR>1{print \$1}' | while read pid; do kill -9 \"\$pid\" 2>/dev/null; done"
  2⤵
  - Reads runtime system information
  PID:2706
- - /usr/bin/awk
    awk "NR>1{print \$1}"
    3⤵
    PID:2712
- - /usr/bin/sort
    sort -k2n
    3⤵
    PID:2711

/var/tmp/.16
/var/tmp/.16
1⤵
- Modifies the dynamic linker configuration file
- Creates/modifies environment variables
- Modifies Bash startup script
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:2218
- /bin/sh
  sh -c "ps -eo pid,comm,%cpu 2>/dev/null | awk '\$2==\"16\"' 2>/dev/null | sort -k3nr 2>/dev/null | awk 'NR>1{print \$1}' 2>/dev/null | xargs -r kill 2>/dev/null"
  2⤵
  PID:2226
- - /usr/bin/awk
    awk "\$2==\"16\""
    3⤵
    PID:2228
- - /usr/bin/awk
    awk "NR>1{print \$1}"
    3⤵
    PID:2230
- - /usr/bin/sort
    sort -k3nr
    3⤵
    PID:2229
- - /bin/ps
    ps -eo "pid,comm,%cpu"
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2227
- - /usr/bin/xargs
    xargs -r kill
    3⤵
    PID:2231
- /bin/sh
  sh -c "pids=\$(pgrep -x '16' 2>/dev/null) && [ -n \"\$pids\" ] && [ \"\$(echo \"\$pids\" | wc -l 2>/dev/null)\" -gt 1 ] 2>/dev/null && echo \"\$pids\" | xargs -r ps -o pid=,pcpu= -p 2>/dev/null | sort -k2 -nr 2>/dev/null | awk 'NR>1 {print \$1}' 2>/dev/null | xargs -r kill -9 2>/dev/null"
  2⤵
  PID:2232
- - /usr/bin/pgrep
    pgrep -x 16
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2233
- - /usr/bin/wc
    wc -l
    3⤵
    PID:2236
- /bin/sh
  sh -c "(ps -o pid=,pcpu= -C '16' 2>/dev/null || ps -eo pid,pcpu,comm 2>/dev/null | grep '16' 2>/dev/null | grep -v grep 2>/dev/null) 2>/dev/null | tr -s ' ' 2>/dev/null | sort -k2 -nr 2>/dev/null | tail -n +2 2>/dev/null | cut -d' ' -f1 2>/dev/null | while read pid; do [ -n \"\$pid\" ] && kill -9 \"\$pid\" 2>/dev/null; done"
  2⤵
  PID:2237
- - /usr/bin/sort
    sort -k2 -nr
    3⤵
    PID:2240
- - /usr/bin/cut
    cut "-d " -f1
    3⤵
    PID:2242
- - /usr/bin/tail
    tail -n +2
    3⤵
    PID:2241
- - /usr/bin/tr
    tr -s " "
    3⤵
    PID:2239
- - /bin/ps
    ps -o "pid=,pcpu=" -C 16
    3⤵
    - Reads CPU attributes
    PID:2244
- /bin/sh
  sh -c "for pid in \$(pgrep -f sshd); do path=\$(readlink -f /proc/\$pid/exe 2>/dev/null); echo \"\$path\" | grep -qE \"^(/tmp/|/dev/shm/|/var/tmp/|\$HOME/).*sshd\" && [[ \"\$path\" != \"/usr/sbin/sshd\" ]] && kill -9 \$pid 2>/dev/null; done 2>/dev/null"
  2⤵
  PID:2275
- - /usr/bin/pgrep
    pgrep -f sshd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:2277
- - /bin/readlink
    readlink -f /proc/571/exe
    3⤵
    PID:2281
- - /bin/grep
    grep -qE "^(/tmp/|/dev/shm/|/var/tmp/|/).*sshd"
    3⤵
    PID:2283
- - /bin/readlink
    readlink -f /proc/2275/exe
    3⤵
    PID:2284
- - /bin/grep
    grep -qE "^(/tmp/|/dev/shm/|/var/tmp/|/).*sshd"
    3⤵
    PID:2286
- /bin/sh
  sh -c "crontab -l 2>/dev/null"
  2⤵
  PID:2276
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:2278
- /bin/sh
  sh -c "crontab -"
  2⤵
  PID:2279
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:2280
- /bin/sh
  sh -c "for p in /proc/[0-9]*; do n=\$(cat \$p/comm 2>/dev/null); x=\$(ls -l \$p/exe 2>/dev/null | awk '{print \$NF}'); case \"\$x\" in *\"(deleted)\"*) [ \"\$n\" = \"sshd\" ] && kill -9 \${p##*/} && echo \"Killed \${p##*/} - \$x\";; /usr/sbin/*|/sbin/*) ;; /home/*|/tmp/*|/dev/shm/*|/var/tmp/*|/var/*) [ \"\$n\" = \"sshd\" ] && kill -9 \${p##*/} && echo \"Killed \${p##*/} - \$x\";; esac; done"
  2⤵
  PID:2287
- - /bin/cat
    cat /proc/1/comm
    3⤵
    PID:2288
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2291
- - /bin/ls
    ls -l /proc/1/exe
    3⤵
    PID:2290
- - /bin/cat
    cat /proc/10/comm
    3⤵
    PID:2292
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2295
- - /bin/ls
    ls -l /proc/10/exe
    3⤵
    PID:2294
- - /bin/cat
    cat /proc/1005/comm
    3⤵
    PID:2296
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2299
- - /bin/ls
    ls -l /proc/1005/exe
    3⤵
    PID:2298
- - /bin/cat
    cat /proc/1009/comm
    3⤵
    PID:2300
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2303
- - /bin/ls
    ls -l /proc/1009/exe
    3⤵
    PID:2302
- - /bin/cat
    cat /proc/1018/comm
    3⤵
    PID:2304
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2307
- - /bin/ls
    ls -l /proc/1018/exe
    3⤵
    PID:2306
- - /bin/cat
    cat /proc/1032/comm
    3⤵
    PID:2308
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2311
- - /bin/ls
    ls -l /proc/1032/exe
    3⤵
    PID:2310
- - /bin/cat
    cat /proc/1037/comm
    3⤵
    PID:2312
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2315
- - /bin/ls
    ls -l /proc/1037/exe
    3⤵
    PID:2314
- - /bin/cat
    cat /proc/1041/comm
    3⤵
    PID:2316
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2319
- - /bin/ls
    ls -l /proc/1041/exe
    3⤵
    PID:2318
- - /bin/cat
    cat /proc/1045/comm
    3⤵
    PID:2320
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2323
- - /bin/ls
    ls -l /proc/1045/exe
    3⤵
    PID:2322
- - /bin/cat
    cat /proc/1049/comm
    3⤵
    PID:2324
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2327
- - /bin/ls
    ls -l /proc/1049/exe
    3⤵
    PID:2326
- - /bin/cat
    cat /proc/1053/comm
    3⤵
    PID:2328
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2331
- - /bin/ls
    ls -l /proc/1053/exe
    3⤵
    PID:2330
- - /bin/cat
    cat /proc/1057/comm
    3⤵
    PID:2332
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2335
- - /bin/ls
    ls -l /proc/1057/exe
    3⤵
    PID:2334
- - /bin/cat
    cat /proc/1062/comm
    3⤵
    PID:2336
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2339
- - /bin/ls
    ls -l /proc/1062/exe
    3⤵
    PID:2338
- - /bin/cat
    cat /proc/1066/comm
    3⤵
    PID:2340
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2343
- - /bin/ls
    ls -l /proc/1066/exe
    3⤵
    PID:2342
- - /bin/cat
    cat /proc/1068/comm
    3⤵
    PID:2344
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2347
- - /bin/ls
    ls -l /proc/1068/exe
    3⤵
    PID:2346
- - /bin/cat
    cat /proc/1070/comm
    3⤵
    PID:2348
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2352
- - /bin/ls
    ls -l /proc/1070/exe
    3⤵
    PID:2351
- - /bin/cat
    cat /proc/1072/comm
    3⤵
    PID:2353
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2356
- - /bin/ls
    ls -l /proc/1072/exe
    3⤵
    PID:2355
- - /bin/cat
    cat /proc/1074/comm
    3⤵
    PID:2357
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2360
- - /bin/ls
    ls -l /proc/1074/exe
    3⤵
    PID:2359
- - /bin/cat
    cat /proc/1083/comm
    3⤵
    PID:2361
- - /bin/ls
    ls -l /proc/1083/exe
    3⤵
    PID:2363
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2364
- - /bin/cat
    cat /proc/1084/comm
    3⤵
    PID:2365
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2368
- - /bin/ls
    ls -l /proc/1084/exe
    3⤵
    PID:2367
- - /bin/cat
    cat /proc/1088/comm
    3⤵
    PID:2369
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2372
- - /bin/ls
    ls -l /proc/1088/exe
    3⤵
    PID:2371
- - /bin/cat
    cat /proc/1090/comm
    3⤵
    PID:2373
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2376
- - /bin/ls
    ls -l /proc/1090/exe
    3⤵
    PID:2375
- - /bin/cat
    cat /proc/1095/comm
    3⤵
    PID:2377
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2380
- - /bin/ls
    ls -l /proc/1095/exe
    3⤵
    PID:2379
- - /bin/cat
    cat /proc/11/comm
    3⤵
    PID:2381
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2384
- - /bin/ls
    ls -l /proc/11/exe
    3⤵
    PID:2383
- - /bin/cat
    cat /proc/1103/comm
    3⤵
    PID:2385
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2389
- - /bin/ls
    ls -l /proc/1103/exe
    3⤵
    PID:2388
- - /bin/cat
    cat /proc/1106/comm
    3⤵
    PID:2390
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2393
- - /bin/ls
    ls -l /proc/1106/exe
    3⤵
    PID:2392
- - /bin/cat
    cat /proc/1107/comm
    3⤵
    PID:2394
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2397
- - /bin/ls
    ls -l /proc/1107/exe
    3⤵
    PID:2396
- - /bin/cat
    cat /proc/1108/comm
    3⤵
    PID:2398
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2401
- - /bin/ls
    ls -l /proc/1108/exe
    3⤵
    PID:2400
- - /bin/cat
    cat /proc/1109/comm
    3⤵
    PID:2402
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2405
- - /bin/ls
    ls -l /proc/1109/exe
    3⤵
    PID:2404
- - /bin/cat
    cat /proc/1112/comm
    3⤵
    PID:2406
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2409
- - /bin/ls
    ls -l /proc/1112/exe
    3⤵
    PID:2408
- - /bin/cat
    cat /proc/1114/comm
    3⤵
    PID:2416
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2419
- - /bin/ls
    ls -l /proc/1114/exe
    3⤵
    PID:2418
- - /bin/cat
    cat /proc/115/comm
    3⤵
    PID:2420
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2423
- - /bin/ls
    ls -l /proc/115/exe
    3⤵
    PID:2422
- - /bin/cat
    cat /proc/1155/comm
    3⤵
    PID:2424
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2427
- - /bin/ls
    ls -l /proc/1155/exe
    3⤵
    PID:2426
- - /bin/cat
    cat /proc/1168/comm
    3⤵
    PID:2428
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2431
- - /bin/ls
    ls -l /proc/1168/exe
    3⤵
    PID:2430
- - /bin/cat
    cat /proc/1169/comm
    3⤵
    PID:2433
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2439
- - /bin/ls
    ls -l /proc/1169/exe
    3⤵
    PID:2438
- - /bin/cat
    cat /proc/1170/comm
    3⤵
    PID:2440
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    - Reads runtime system information
    PID:2443
- - /bin/ls
    ls -l /proc/1170/exe
    3⤵
    PID:2442
- - /bin/cat
    cat /proc/1188/comm
    3⤵
    PID:2444
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2447
- - /bin/ls
    ls -l /proc/1188/exe
    3⤵
    PID:2446
- - /bin/cat
    cat /proc/12/comm
    3⤵
    PID:2448
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2451
- - /bin/ls
    ls -l /proc/12/exe
    3⤵
    PID:2450
- - /bin/cat
    cat /proc/1204/comm
    3⤵
    PID:2458
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2461
- - /bin/ls
    ls -l /proc/1204/exe
    3⤵
    PID:2460
- - /bin/cat
    cat /proc/1206/comm
    3⤵
    PID:2462
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2465
- - /bin/ls
    ls -l /proc/1206/exe
    3⤵
    PID:2464
- - /bin/cat
    cat /proc/1262/comm
    3⤵
    PID:2466
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2469
- - /bin/ls
    ls -l /proc/1262/exe
    3⤵
    PID:2468
- - /bin/cat
    cat /proc/1268/comm
    3⤵
    PID:2470
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2473
- - /bin/ls
    ls -l /proc/1268/exe
    3⤵
    PID:2472
- - /bin/cat
    cat /proc/13/comm
    3⤵
    PID:2474
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2477
- - /bin/ls
    ls -l /proc/13/exe
    3⤵
    PID:2476
- - /bin/cat
    cat /proc/1308/comm
    3⤵
    PID:2478
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2481
- - /bin/ls
    ls -l /proc/1308/exe
    3⤵
    PID:2480
- - /bin/cat
    cat /proc/1310/comm
    3⤵
    PID:2482
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2485
- - /bin/ls
    ls -l /proc/1310/exe
    3⤵
    PID:2484
- - /bin/cat
    cat /proc/1325/comm
    3⤵
    PID:2486
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2489
- - /bin/ls
    ls -l /proc/1325/exe
    3⤵
    PID:2488
- - /bin/cat
    cat /proc/1332/comm
    3⤵
    PID:2490
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2493
- - /bin/ls
    ls -l /proc/1332/exe
    3⤵
    PID:2492
- - /bin/cat
    cat /proc/1352/comm
    3⤵
    PID:2494
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2497
- - /bin/ls
    ls -l /proc/1352/exe
    3⤵
    PID:2496
- - /bin/cat
    cat /proc/1361/comm
    3⤵
    PID:2498
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2501
- - /bin/ls
    ls -l /proc/1361/exe
    3⤵
    PID:2500
- - /bin/cat
    cat /proc/137/comm
    3⤵
    PID:2502
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2505
- - /bin/ls
    ls -l /proc/137/exe
    3⤵
    PID:2504
- - /bin/cat
    cat /proc/1390/comm
    3⤵
    PID:2506
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2509
- - /bin/ls
    ls -l /proc/1390/exe
    3⤵
    PID:2508
- - /bin/cat
    cat /proc/14/comm
    3⤵
    PID:2510
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2513
- - /bin/ls
    ls -l /proc/14/exe
    3⤵
    PID:2512
- - /bin/cat
    cat /proc/1468/comm
    3⤵
    PID:2514
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2517
- - /bin/ls
    ls -l /proc/1468/exe
    3⤵
    PID:2516
- - /bin/cat
    cat /proc/1493/comm
    3⤵
    PID:2518
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2521
- - /bin/ls
    ls -l /proc/1493/exe
    3⤵
    PID:2520
- - /bin/cat
    cat /proc/1497/comm
    3⤵
    PID:2522
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2525
- - /bin/ls
    ls -l /proc/1497/exe
    3⤵
    PID:2524
- - /bin/cat
    cat /proc/1498/comm
    3⤵
    PID:2526
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2529
- - /bin/ls
    ls -l /proc/1498/exe
    3⤵
    PID:2528
- - /bin/cat
    cat /proc/1499/comm
    3⤵
    PID:2530
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2533
- - /bin/ls
    ls -l /proc/1499/exe
    3⤵
    PID:2532
- - /bin/cat
    cat /proc/15/comm
    3⤵
    PID:2534
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2537
- - /bin/ls
    ls -l /proc/15/exe
    3⤵
    PID:2536
- - /bin/cat
    cat /proc/1503/comm
    3⤵
    PID:2538
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2541
- - /bin/ls
    ls -l /proc/1503/exe
    3⤵
    PID:2540
- - /bin/cat
    cat /proc/1549/comm
    3⤵
    PID:2542
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2545
- - /bin/ls
    ls -l /proc/1549/exe
    3⤵
    PID:2544
- - /bin/cat
    cat /proc/16/comm
    3⤵
    PID:2546
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2549
- - /bin/ls
    ls -l /proc/16/exe
    3⤵
    PID:2548
- - /bin/cat
    cat /proc/168/comm
    3⤵
    PID:2550
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2553
- - /bin/ls
    ls -l /proc/168/exe
    3⤵
    PID:2552
- - /bin/cat
    cat /proc/169/comm
    3⤵
    - Reads runtime system information
    PID:2555
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2558
- - /bin/ls
    ls -l /proc/169/exe
    3⤵
    PID:2557
- - /bin/cat
    cat /proc/17/comm
    3⤵
    PID:2559
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2562
- - /bin/ls
    ls -l /proc/17/exe
    3⤵
    PID:2561
- - /bin/cat
    cat /proc/170/comm
    3⤵
    PID:2563
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2566
- - /bin/ls
    ls -l /proc/170/exe
    3⤵
    PID:2565
- - /bin/cat
    cat /proc/171/comm
    3⤵
    PID:2567
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2570
- - /bin/ls
    ls -l /proc/171/exe
    3⤵
    PID:2569
- - /bin/cat
    cat /proc/172/comm
    3⤵
    PID:2571
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2574
- - /bin/ls
    ls -l /proc/172/exe
    3⤵
    PID:2573
- - /bin/cat
    cat /proc/173/comm
    3⤵
    PID:2575
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2578
- - /bin/ls
    ls -l /proc/173/exe
    3⤵
    PID:2577
- - /bin/cat
    cat /proc/174/comm
    3⤵
    PID:2579
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2582
- - /bin/ls
    ls -l /proc/174/exe
    3⤵
    PID:2581
- - /bin/cat
    cat /proc/175/comm
    3⤵
    PID:2583
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2586
- - /bin/ls
    ls -l /proc/175/exe
    3⤵
    PID:2585
- - /bin/cat
    cat /proc/176/comm
    3⤵
    PID:2587
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2590
- - /bin/ls
    ls -l /proc/176/exe
    3⤵
    PID:2589
- - /bin/cat
    cat /proc/177/comm
    3⤵
    PID:2591
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2594
- - /bin/ls
    ls -l /proc/177/exe
    3⤵
    PID:2593
- - /bin/cat
    cat /proc/178/comm
    3⤵
    PID:2595
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2598
- - /bin/ls
    ls -l /proc/178/exe
    3⤵
    PID:2597
- - /bin/cat
    cat /proc/179/comm
    3⤵
    PID:2599
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2602
- - /bin/ls
    ls -l /proc/179/exe
    3⤵
    PID:2601
- - /bin/cat
    cat /proc/18/comm
    3⤵
    PID:2603
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2606
- - /bin/ls
    ls -l /proc/18/exe
    3⤵
    PID:2605
- - /bin/cat
    cat /proc/180/comm
    3⤵
    PID:2607
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2610
- - /bin/ls
    ls -l /proc/180/exe
    3⤵
    PID:2609
- - /bin/cat
    cat /proc/181/comm
    3⤵
    PID:2611
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2614
- - /bin/ls
    ls -l /proc/181/exe
    3⤵
    PID:2613
- - /bin/cat
    cat /proc/182/comm
    3⤵
    PID:2615
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2618
- - /bin/ls
    ls -l /proc/182/exe
    3⤵
    PID:2617
- - /bin/cat
    cat /proc/183/comm
    3⤵
    PID:2619
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2622
- - /bin/ls
    ls -l /proc/183/exe
    3⤵
    PID:2621
- - /bin/cat
    cat /proc/184/comm
    3⤵
    PID:2623
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2626
- - /bin/ls
    ls -l /proc/184/exe
    3⤵
    PID:2625
- - /bin/cat
    cat /proc/185/comm
    3⤵
    PID:2627
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2630
- - /bin/ls
    ls -l /proc/185/exe
    3⤵
    PID:2629
- - /bin/cat
    cat /proc/187/comm
    3⤵
    PID:2631
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2634
- - /bin/ls
    ls -l /proc/187/exe
    3⤵
    PID:2633
- - /bin/cat
    cat /proc/19/comm
    3⤵
    PID:2635
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2638
- - /bin/ls
    ls -l /proc/19/exe
    3⤵
    PID:2637
- - /bin/cat
    cat /proc/2/comm
    3⤵
    PID:2639
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2642
- - /bin/ls
    ls -l /proc/2/exe
    3⤵
    PID:2641
- - /bin/cat
    cat /proc/20/comm
    3⤵
    PID:2643
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2646
- - /bin/ls
    ls -l /proc/20/exe
    3⤵
    PID:2645
- - /bin/cat
    cat /proc/21/comm
    3⤵
    PID:2647
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2650
- - /bin/ls
    ls -l /proc/21/exe
    3⤵
    PID:2649
- - /bin/cat
    cat /proc/212/comm
    3⤵
    PID:2651
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2654
- - /bin/ls
    ls -l /proc/212/exe
    3⤵
    PID:2653
- - /bin/cat
    cat /proc/213/comm
    3⤵
    PID:2655
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2658
- - /bin/ls
    ls -l /proc/213/exe
    3⤵
    PID:2657
- - /bin/cat
    cat /proc/22/comm
    3⤵
    PID:2659
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2662
- - /bin/ls
    ls -l /proc/22/exe
    3⤵
    PID:2661
- - /bin/cat
    cat /proc/2220/comm
    3⤵
    PID:2663
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2666
- - /bin/ls
    ls -l /proc/2220/exe
    3⤵
    PID:2665
- - /bin/cat
    cat /proc/2287/comm
    3⤵
    - Reads runtime system information
    PID:2667
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2670
- - /bin/ls
    ls -l /proc/2287/exe
    3⤵
    PID:2669
- - /bin/cat
    cat /proc/23/comm
    3⤵
    PID:2671
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2674
- - /bin/ls
    ls -l /proc/23/exe
    3⤵
    PID:2673
- - /bin/cat
    cat /proc/24/comm
    3⤵
    PID:2675
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2678
- - /bin/ls
    ls -l /proc/24/exe
    3⤵
    PID:2677
- - /bin/cat
    cat /proc/25/comm
    3⤵
    PID:2679
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2682
- - /bin/ls
    ls -l /proc/25/exe
    3⤵
    PID:2681
- - /bin/cat
    cat /proc/26/comm
    3⤵
    PID:2683
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2686
- - /bin/ls
    ls -l /proc/26/exe
    3⤵
    PID:2685
- - /bin/cat
    cat /proc/261/comm
    3⤵
    PID:2687
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2690
- - /bin/ls
    ls -l /proc/261/exe
    3⤵
    PID:2689
- - /bin/cat
    cat /proc/27/comm
    3⤵
    PID:2691
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2694
- - /bin/ls
    ls -l /proc/27/exe
    3⤵
    PID:2693
- - /bin/cat
    cat /proc/279/comm
    3⤵
    PID:2697
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2700
- - /bin/ls
    ls -l /proc/279/exe
    3⤵
    PID:2699
- - /bin/cat
    cat /proc/28/comm
    3⤵
    PID:2701
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2704
- - /bin/ls
    ls -l /proc/28/exe
    3⤵
    PID:2703
- - /bin/cat
    cat /proc/29/comm
    3⤵
    PID:2705
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2709
- - /bin/ls
    ls -l /proc/29/exe
    3⤵
    PID:2708
- - /bin/cat
    cat /proc/3/comm
    3⤵
    PID:2714
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2717
- - /bin/ls
    ls -l /proc/3/exe
    3⤵
    PID:2716
- - /bin/cat
    cat /proc/30/comm
    3⤵
    PID:2718
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2721
- - /bin/ls
    ls -l /proc/30/exe
    3⤵
    PID:2720
- - /bin/cat
    cat /proc/31/comm
    3⤵
    PID:2722
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2725
- - /bin/ls
    ls -l /proc/31/exe
    3⤵
    PID:2724
- - /bin/cat
    cat /proc/32/comm
    3⤵
    PID:2726
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2729
- - /bin/ls
    ls -l /proc/32/exe
    3⤵
    PID:2728
- - /bin/cat
    cat /proc/321/comm
    3⤵
    PID:2730
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2733
- - /bin/ls
    ls -l /proc/321/exe
    3⤵
    PID:2732
- - /bin/cat
    cat /proc/324/comm
    3⤵
    PID:2734
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2737
- - /bin/ls
    ls -l /proc/324/exe
    3⤵
    PID:2736
- - /bin/cat
    cat /proc/34/comm
    3⤵
    PID:2738
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2741
- - /bin/ls
    ls -l /proc/34/exe
    3⤵
    PID:2740
- - /bin/cat
    cat /proc/35/comm
    3⤵
    PID:2742
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2745
- - /bin/ls
    ls -l /proc/35/exe
    3⤵
    PID:2744
- - /bin/cat
    cat /proc/36/comm
    3⤵
    PID:2746
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2749
- - /bin/ls
    ls -l /proc/36/exe
    3⤵
    PID:2748
- - /bin/cat
    cat /proc/4/comm
    3⤵
    PID:2750
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2753
- - /bin/ls
    ls -l /proc/4/exe
    3⤵
    PID:2752
- - /bin/cat
    cat /proc/424/comm
    3⤵
    PID:2754
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2757
- - /bin/ls
    ls -l /proc/424/exe
    3⤵
    PID:2756
- - /bin/cat
    cat /proc/435/comm
    3⤵
    PID:2758
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2761
- - /bin/ls
    ls -l /proc/435/exe
    3⤵
    PID:2760
- - /bin/cat
    cat /proc/442/comm
    3⤵
    PID:2762
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2765
- - /bin/ls
    ls -l /proc/442/exe
    3⤵
    PID:2764
- - /bin/cat
    cat /proc/450/comm
    3⤵
    PID:2766
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2769
- - /bin/ls
    ls -l /proc/450/exe
    3⤵
    PID:2768
- - /bin/cat
    cat /proc/456/comm
    3⤵
    PID:2770
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2773
- - /bin/ls
    ls -l /proc/456/exe
    3⤵
    PID:2772
- - /bin/cat
    cat /proc/460/comm
    3⤵
    PID:2774
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2777
- - /bin/ls
    ls -l /proc/460/exe
    3⤵
    PID:2776
- - /bin/cat
    cat /proc/462/comm
    3⤵
    PID:2778
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2781
- - /bin/ls
    ls -l /proc/462/exe
    3⤵
    PID:2780
- - /bin/cat
    cat /proc/467/comm
    3⤵
    PID:2782
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2785
- - /bin/ls
    ls -l /proc/467/exe
    3⤵
    PID:2784
- - /bin/cat
    cat /proc/472/comm
    3⤵
    PID:2786
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2789
- - /bin/ls
    ls -l /proc/472/exe
    3⤵
    PID:2788
- - /bin/cat
    cat /proc/473/comm
    3⤵
    PID:2790
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2793
- - /bin/ls
    ls -l /proc/473/exe
    3⤵
    PID:2792
- - /bin/cat
    cat /proc/481/comm
    3⤵
    PID:2794
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2797
- - /bin/ls
    ls -l /proc/481/exe
    3⤵
    PID:2796
- - /bin/cat
    cat /proc/490/comm
    3⤵
    PID:2798
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2801
- - /bin/ls
    ls -l /proc/490/exe
    3⤵
    PID:2800
- - /bin/cat
    cat /proc/495/comm
    3⤵
    PID:2802
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2805
- - /bin/ls
    ls -l /proc/495/exe
    3⤵
    PID:2804
- - /bin/cat
    cat /proc/5/comm
    3⤵
    PID:2806
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2809
- - /bin/ls
    ls -l /proc/5/exe
    3⤵
    PID:2808
- - /bin/cat
    cat /proc/501/comm
    3⤵
    PID:2810
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2813
- - /bin/ls
    ls -l /proc/501/exe
    3⤵
    PID:2812
- - /bin/cat
    cat /proc/502/comm
    3⤵
    PID:2814
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2817
- - /bin/ls
    ls -l /proc/502/exe
    3⤵
    PID:2816
- - /bin/cat
    cat /proc/511/comm
    3⤵
    PID:2818
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2821
- - /bin/ls
    ls -l /proc/511/exe
    3⤵
    PID:2820
- - /bin/cat
    cat /proc/540/comm
    3⤵
    PID:2822
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2825
- - /bin/ls
    ls -l /proc/540/exe
    3⤵
    PID:2824
- - /bin/cat
    cat /proc/542/comm
    3⤵
    PID:2826
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2829
- - /bin/ls
    ls -l /proc/542/exe
    3⤵
    PID:2828
- - /bin/cat
    cat /proc/565/comm
    3⤵
    PID:2830
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2833
- - /bin/ls
    ls -l /proc/565/exe
    3⤵
    PID:2832
- - /bin/cat
    cat /proc/571/comm
    3⤵
    PID:2834
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2837
- - /bin/ls
    ls -l /proc/571/exe
    3⤵
    PID:2836
- - /bin/cat
    cat /proc/581/comm
    3⤵
    PID:2838
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2841
- - /bin/ls
    ls -l /proc/581/exe
    3⤵
    PID:2840
- - /bin/cat
    cat /proc/595/comm
    3⤵
    PID:2842
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2845
- - /bin/ls
    ls -l /proc/595/exe
    3⤵
    PID:2844
- - /bin/cat
    cat /proc/6/comm
    3⤵
    PID:2846
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2849
- - /bin/ls
    ls -l /proc/6/exe
    3⤵
    PID:2848
- - /bin/cat
    cat /proc/618/comm
    3⤵
    PID:2850
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2853
- - /bin/ls
    ls -l /proc/618/exe
    3⤵
    PID:2852
- - /bin/cat
    cat /proc/619/comm
    3⤵
    PID:2854
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2857
- - /bin/ls
    ls -l /proc/619/exe
    3⤵
    PID:2856
- - /bin/cat
    cat /proc/656/comm
    3⤵
    PID:2858
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2861
- - /bin/ls
    ls -l /proc/656/exe
    3⤵
    PID:2860
- - /bin/cat
    cat /proc/664/comm
    3⤵
    PID:2862
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2865
- - /bin/ls
    ls -l /proc/664/exe
    3⤵
    PID:2864
- - /bin/cat
    cat /proc/667/comm
    3⤵
    PID:2866
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2869
- - /bin/ls
    ls -l /proc/667/exe
    3⤵
    PID:2868
- - /bin/cat
    cat /proc/680/comm
    3⤵
    PID:2870
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2873
- - /bin/ls
    ls -l /proc/680/exe
    3⤵
    PID:2872
- - /bin/cat
    cat /proc/681/comm
    3⤵
    PID:2874
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2877
- - /bin/ls
    ls -l /proc/681/exe
    3⤵
    PID:2876
- - /bin/cat
    cat /proc/683/comm
    3⤵
    PID:2878
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2881
- - /bin/ls
    ls -l /proc/683/exe
    3⤵
    PID:2880
- - /bin/cat
    cat /proc/7/comm
    3⤵
    PID:2882
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2885
- - /bin/ls
    ls -l /proc/7/exe
    3⤵
    PID:2884
- - /bin/cat
    cat /proc/709/comm
    3⤵
    PID:2886
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2889
- - /bin/ls
    ls -l /proc/709/exe
    3⤵
    PID:2888
- - /bin/cat
    cat /proc/717/comm
    3⤵
    PID:2890
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2893
- - /bin/ls
    ls -l /proc/717/exe
    3⤵
    PID:2892
- - /bin/cat
    cat /proc/731/comm
    3⤵
    PID:2894
- - /usr/bin/awk
    awk "{print \$NF}"
    3⤵
    PID:2897
- - /bin/ls
    ls -l /proc/731/exe
    3⤵
    PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable