5b05621471c622dc4a6c823efccc8f33d0e86de55c0bd795b413ffec519868aa

Analysis

max time kernel
149s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/08/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 714B
Sample260811-w3929sar21
SHA256 5b05621471c622dc4a6c823efccc8f33d0e86de55c0bd795b413ffec519868aa
MD5 d8cf20f89856d437bd90a49b72bbdad9
SHA1 7dbc0a337657869f1576e438cb3fadf1060eaa78
SHA512 9e6a4b00c6c23d3a4b59f9c636ba9df5a8c68777ee13fbf23e72d3e6ab432d2b810fe9dad3271c6d63618b7c119fa1d585ff47f4323ab88f008581aa972250cb
TLSH
T114012851268C1EF51D41E734DA82A04861764612CE57A40A62229D9C6F3613E93EC836
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 37 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/easy_clientihL	sh
File opened for modification	/tmp/easy_clientoxM	sh
File opened for modification	/tmp/easy_clientKvI	mktemp
File opened for modification	/tmp/easy_clientgwH	mktemp
File opened for modification	/tmp/easy_clientHjO	mktemp
File opened for modification	/tmp/easy_clientFUV	sh
File opened for modification	/tmp/easy_clientgeT	sh
File opened for modification	/tmp/easy_clientGbn	mktemp
File opened for modification	/tmp/easy_clientj8u	sh
File opened for modification	/tmp/easy_clientlyv	mktemp
File opened for modification	/tmp/easy_clientbFC	sh
File opened for modification	/tmp/easy_clientHjO	sh
File opened for modification	/tmp/easy_client0aH	mktemp
File opened for modification	/tmp/easy_client0aH	sh
File opened for modification	/tmp/easy_clientKvI	sh
File opened for modification	/tmp/easy_clientoRh	mktemp
File opened for modification	/tmp/easy_clientIpW	sh
File opened for modification	/tmp/easy_clientsbb	mktemp
File opened for modification	/tmp/easy_clientfsN	mktemp
File opened for modification	/tmp/easy_clientbw4	sh
File opened for modification	/tmp/easy_clientgp3	mktemp
File opened for modification	/tmp/easy_client3gF	mktemp
File opened for modification	/tmp/easy_clientTjX	mktemp
File opened for modification	/tmp/easy_clientgp3	sh
File opened for modification	/tmp/easy_clientN76	mktemp
File opened for modification	/tmp/easy_clientGbn	sh
File opened for modification	/tmp/easy_client6g7	mktemp
File opened for modification	/tmp/easy_clientbw4	mktemp
File opened for modification	/tmp/easy_clientihL	mktemp
File opened for modification	/tmp/easy_clientbFC	mktemp
File opened for modification	/tmp/easy_clientFxC	mktemp
File opened for modification	/tmp/easy_clientNYf	mktemp
File opened for modification	/tmp/easy_client0i2	mktemp
File opened for modification	/tmp/easy_clientlyv	sh
File opened for modification	/tmp/easy_clientp4d	sh
File opened for modification	/tmp/easy_clientoRh	sh
File opened for modification	/tmp/easy_clientIpW	mktemp
File opened for modification	/tmp/easy_clientN76	sh
File opened for modification	/tmp/easy_clientFK4	sh
File opened for modification	/tmp/easy_client8TI	mktemp
File opened for modification	/tmp/easy_clientHPn	mktemp
File opened for modification	/tmp/easy_clientj8u	mktemp
File opened for modification	/tmp/easy_clienttTZ	mktemp
File opened for modification	/tmp/easy_client6Wf	sh
File opened for modification	/tmp/easy_clientTjX	sh
File opened for modification	/tmp/easy_clientekn	sh
File opened for modification	/tmp/easy_client6g7	sh
File opened for modification	/tmp/easy_clientoxM	mktemp
File opened for modification	/tmp/easy_client46p	mktemp
File opened for modification	/tmp/easy_clientt9l	sh
File opened for modification	/tmp/easy_clientFxC	sh
File opened for modification	/tmp/easy_clientADC	mktemp
File opened for modification	/tmp/easy_clientADC	sh
File opened for modification	/tmp/easy_clientfsN	sh
File opened for modification	/tmp/easy_clientekn	mktemp
File opened for modification	/tmp/easy_clientgeT	mktemp
File opened for modification	/tmp/easy_clientNYf	sh
File opened for modification	/tmp/easy_clientFK4	mktemp
File opened for modification	/tmp/easy_client36f	mktemp
File opened for modification	/tmp/easy_clientt9l	mktemp
File opened for modification	/tmp/easy_clientp4d	mktemp
File opened for modification	/tmp/easy_clienttTZ	sh
File opened for modification	/tmp/easy_clientFUV	mktemp
File opened for modification	/tmp/easy_client70N	mktemp

/tmp/x
/tmp/x
1⤵
PID:1495

/usr/local/sbin/sh
sh /tmp/x
1⤵
PID:1495

/usr/local/bin/sh
sh /tmp/x
1⤵
PID:1495

/usr/sbin/sh
sh /tmp/x
1⤵
PID:1495

/usr/bin/sh
sh /tmp/x
1⤵
PID:1495

/sbin/sh
sh /tmp/x
1⤵
PID:1495

/bin/sh
sh /tmp/x
1⤵
- Writes file to tmp directory
PID:1495
- /usr/bin/curl
  curl --version
  2⤵
  PID:1496
- /bin/mkdir
  mkdir -p /tmp
  2⤵
  - Reads runtime system information
  PID:1497
- /bin/mktemp
  mktemp -t easy_clientXXX
  2⤵
  - Writes file to tmp directory
  PID:1499
- /usr/bin/curl
  curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
  2⤵
  PID:1500
- /tmp/x
  /tmp/x "=" -zsh
  2⤵
  PID:1510
- /usr/local/sbin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:1510
- /usr/local/bin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:1510
- /usr/sbin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:1510
- /usr/bin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:1510
- /sbin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:1510
- /bin/sh
  sh /tmp/x "=" -zsh
  2⤵
  - Writes file to tmp directory
  PID:1510
- - /usr/bin/curl
    curl --version
    3⤵
    PID:1511
- - /bin/mkdir
    mkdir -p /tmp
    3⤵
    - Reads runtime system information
    PID:1512
- - /bin/mktemp
    mktemp -t easy_clientXXX
    3⤵
    - Writes file to tmp directory
    PID:1514
- - /usr/bin/curl
    curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
    3⤵
    PID:1515
- - /tmp/x
    /tmp/x "=" -zsh
    3⤵
    PID:1517
- - /usr/local/sbin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:1517
- - /usr/local/bin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:1517
- - /usr/sbin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:1517
- - /usr/bin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:1517
- - /sbin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:1517
- - /bin/sh
    sh /tmp/x "=" -zsh
    3⤵
    - Writes file to tmp directory
    PID:1517
  - - /usr/bin/curl
      curl --version
      4⤵
      PID:1518
  - - /bin/mkdir
      mkdir -p /tmp
      4⤵
      Reads runtime system information
      PID:1519
  - - /bin/mktemp
      mktemp -t easy_clientXXX
      4⤵
      Writes file to tmp directory
      PID:1521
  - - /usr/bin/curl
      curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
      4⤵
      PID:1522
  - - /tmp/x
      /tmp/x "=" -zsh
      4⤵
      PID:1524
  - - /usr/local/sbin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:1524
  - - /usr/local/bin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:1524
  - - /usr/sbin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:1524
  - - /usr/bin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:1524
  - - /sbin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:1524
  - - /bin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:1524
    - - /usr/bin/curl
        
        curl --version
        5⤵
        
        PID:1525
    - - /bin/mkdir
        
        mkdir -p /tmp
        5⤵
        Reads runtime system information
        
        PID:1526
    - - /bin/mktemp
        
        mktemp -t easy_clientXXX
        5⤵
        Writes file to tmp directory
        
        PID:1528
    - - /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        5⤵
        
        PID:1529
    - - /tmp/x
        
        /tmp/x "=" -zsh
        5⤵
        
        PID:1531
    - - /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:1531
    - - /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:1531
    - - /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:1531
    - - /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:1531
    - - /sbin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:1531
    - - /bin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:1531
      - /usr/bin/curl
        
        curl --version
        6⤵
        
        PID:1532
      - /bin/mkdir
        
        mkdir -p /tmp
        6⤵
        Reads runtime system information
        
        PID:1533
      - /bin/mktemp
        
        mktemp -t easy_clientXXX
        6⤵
        Writes file to tmp directory
        
        PID:1535
      - /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        6⤵
        
        PID:1536
      - /tmp/x
        
        /tmp/x "=" -zsh
        6⤵
        
        PID:1538
      - /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:1538
      - /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:1538
      - /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:1538
      - /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:1538
      - /sbin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:1538
      - /bin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        Writes file to tmp directory
        
        PID:1538
        
        /usr/bin/curl
        
        curl --version
        7⤵
        
        PID:1539
        
        /bin/mkdir
        
        mkdir -p /tmp
        7⤵
        Reads runtime system information
        
        PID:1540
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        7⤵
        Writes file to tmp directory
        
        PID:1542
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        7⤵
        
        PID:1543
        
        /tmp/x
        
        /tmp/x "=" -zsh
        7⤵
        
        PID:1545
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:1545
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:1545
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:1545
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:1545
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:1545
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:1545
        
        /usr/bin/curl
        
        curl --version
        8⤵
        
        PID:1546
        
        /bin/mkdir
        
        mkdir -p /tmp
        8⤵
        Reads runtime system information
        
        PID:1547
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        8⤵
        Writes file to tmp directory
        
        PID:1549
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        8⤵
        
        PID:1550
        
        /tmp/x
        
        /tmp/x "=" -zsh
        8⤵
        
        PID:1552
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:1552
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:1552
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:1552
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:1552
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:1552
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:1552
        
        /usr/bin/curl
        
        curl --version
        9⤵
        
        PID:1553
        
        /bin/mkdir
        
        mkdir -p /tmp
        9⤵
        Reads runtime system information
        
        PID:1554
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        9⤵
        Writes file to tmp directory
        
        PID:1556
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        9⤵
        
        PID:1557
        
        /tmp/x
        
        /tmp/x "=" -zsh
        9⤵
        
        PID:1559
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:1559
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:1559
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:1559
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:1559
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:1559
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        Writes file to tmp directory
        
        PID:1559
        
        /usr/bin/curl
        
        curl --version
        10⤵
        
        PID:1560
        
        /bin/mkdir
        
        mkdir -p /tmp
        10⤵
        Reads runtime system information
        
        PID:1561
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        10⤵
        Writes file to tmp directory
        
        PID:1563
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        10⤵
        
        PID:1564
        
        /tmp/x
        
        /tmp/x "=" -zsh
        10⤵
        
        PID:1566
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:1566
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:1566
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:1566
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:1566
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:1566
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        Writes file to tmp directory
        
        PID:1566
        
        /usr/bin/curl
        
        curl --version
        11⤵
        
        PID:1567
        
        /bin/mkdir
        
        mkdir -p /tmp
        11⤵
        Reads runtime system information
        
        PID:1568
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        11⤵
        Writes file to tmp directory
        
        PID:1570
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        11⤵
        
        PID:1571
        
        /tmp/x
        
        /tmp/x "=" -zsh
        11⤵
        
        PID:1573
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:1573
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:1573
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:1573
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:1573
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:1573
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        Writes file to tmp directory
        
        PID:1573
        
        /usr/bin/curl
        
        curl --version
        12⤵
        
        PID:1574
        
        /bin/mkdir
        
        mkdir -p /tmp
        12⤵
        Reads runtime system information
        
        PID:1575
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        12⤵
        Writes file to tmp directory
        
        PID:1577
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        12⤵
        
        PID:1578
        
        /tmp/x
        
        /tmp/x "=" -zsh
        12⤵
        
        PID:1580
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:1580
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:1580
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:1580
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:1580
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:1580
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        Writes file to tmp directory
        
        PID:1580
        
        /usr/bin/curl
        
        curl --version
        13⤵
        
        PID:1581
        
        /bin/mkdir
        
        mkdir -p /tmp
        13⤵
        Reads runtime system information
        
        PID:1582
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        13⤵
        Writes file to tmp directory
        
        PID:1584
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        13⤵
        
        PID:1585
        
        /tmp/x
        
        /tmp/x "=" -zsh
        13⤵
        
        PID:1587
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:1587
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:1587
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:1587
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:1587
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:1587
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        Writes file to tmp directory
        
        PID:1587
        
        /usr/bin/curl
        
        curl --version
        14⤵
        
        PID:1588
        
        /bin/mkdir
        
        mkdir -p /tmp
        14⤵
        Reads runtime system information
        
        PID:1589
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        14⤵
        Writes file to tmp directory
        
        PID:1591
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        14⤵
        
        PID:1592
        
        /tmp/x
        
        /tmp/x "=" -zsh
        14⤵
        
        PID:1594
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:1594
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:1594
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:1594
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:1594
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:1594
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        Writes file to tmp directory
        
        PID:1594
        
        /usr/bin/curl
        
        curl --version
        15⤵
        
        PID:1595
        
        /bin/mkdir
        
        mkdir -p /tmp
        15⤵
        Reads runtime system information
        
        PID:1596
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        15⤵
        Writes file to tmp directory
        
        PID:1598
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        15⤵
        
        PID:1599
        
        /tmp/x
        
        /tmp/x "=" -zsh
        15⤵
        
        PID:1601
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:1601
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:1601
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:1601
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:1601
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:1601
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        Writes file to tmp directory
        
        PID:1601
        
        /usr/bin/curl
        
        curl --version
        16⤵
        
        PID:1602
        
        /bin/mkdir
        
        mkdir -p /tmp
        16⤵
        Reads runtime system information
        
        PID:1603
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        16⤵
        Writes file to tmp directory
        
        PID:1605
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        16⤵
        
        PID:1606
        
        /tmp/x
        
        /tmp/x "=" -zsh
        16⤵
        
        PID:1608
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:1608
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:1608
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:1608
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:1608
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:1608
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:1608
        
        /usr/bin/curl
        
        curl --version
        17⤵
        
        PID:1609
        
        /bin/mkdir
        
        mkdir -p /tmp
        17⤵
        Reads runtime system information
        
        PID:1610
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        17⤵
        Writes file to tmp directory
        
        PID:1612
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        17⤵
        
        PID:1613
        
        /tmp/x
        
        /tmp/x "=" -zsh
        17⤵
        
        PID:1615
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:1615
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:1615
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:1615
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:1615
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:1615
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:1615
        
        /usr/bin/curl
        
        curl --version
        18⤵
        
        PID:1616
        
        /bin/mkdir
        
        mkdir -p /tmp
        18⤵
        Reads runtime system information
        
        PID:1617
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        18⤵
        Writes file to tmp directory
        
        PID:1619
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        18⤵
        
        PID:1620
        
        /tmp/x
        
        /tmp/x "=" -zsh
        18⤵
        
        PID:1622
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:1622
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:1622
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:1622
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:1622
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:1622
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        Writes file to tmp directory
        
        PID:1622
        
        /usr/bin/curl
        
        curl --version
        19⤵
        
        PID:1623
        
        /bin/mkdir
        
        mkdir -p /tmp
        19⤵
        Reads runtime system information
        
        PID:1624
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        19⤵
        Writes file to tmp directory
        
        PID:1626
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        19⤵
        
        PID:1627
        
        /tmp/x
        
        /tmp/x "=" -zsh
        19⤵
        
        PID:1629
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:1629
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:1629
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:1629
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:1629
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:1629
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        Writes file to tmp directory
        
        PID:1629
        
        /usr/bin/curl
        
        curl --version
        20⤵
        
        PID:1630
        
        /bin/mkdir
        
        mkdir -p /tmp
        20⤵
        Reads runtime system information
        
        PID:1631
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        20⤵
        Writes file to tmp directory
        
        PID:1633
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        20⤵
        
        PID:1634
        
        /tmp/x
        
        /tmp/x "=" -zsh
        20⤵
        
        PID:1636
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:1636
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:1636
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:1636
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:1636
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:1636
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        Writes file to tmp directory
        
        PID:1636
        
        /usr/bin/curl
        
        curl --version
        21⤵
        
        PID:1637
        
        /bin/mkdir
        
        mkdir -p /tmp
        21⤵
        Reads runtime system information
        
        PID:1638
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        21⤵
        Writes file to tmp directory
        
        PID:1640
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        21⤵
        
        PID:1641
        
        /tmp/x
        
        /tmp/x "=" -zsh
        21⤵
        
        PID:1643
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:1643
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:1643
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:1643
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:1643
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:1643
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        Writes file to tmp directory
        
        PID:1643
        
        /usr/bin/curl
        
        curl --version
        22⤵
        
        PID:1644
        
        /bin/mkdir
        
        mkdir -p /tmp
        22⤵
        Reads runtime system information
        
        PID:1645
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        22⤵
        Writes file to tmp directory
        
        PID:1647
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        22⤵
        
        PID:1648
        
        /tmp/x
        
        /tmp/x "=" -zsh
        22⤵
        
        PID:1650
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:1650
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:1650
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:1650
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:1650
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:1650
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        Writes file to tmp directory
        
        PID:1650
        
        /usr/bin/curl
        
        curl --version
        23⤵
        
        PID:1651
        
        /bin/mkdir
        
        mkdir -p /tmp
        23⤵
        Reads runtime system information
        
        PID:1652
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        23⤵
        Writes file to tmp directory
        
        PID:1654
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        23⤵
        
        PID:1655
        
        /tmp/x
        
        /tmp/x "=" -zsh
        23⤵
        
        PID:1657
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:1657
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:1657
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:1657
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:1657
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:1657
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        Writes file to tmp directory
        
        PID:1657
        
        /usr/bin/curl
        
        curl --version
        24⤵
        
        PID:1658
        
        /bin/mkdir
        
        mkdir -p /tmp
        24⤵
        Reads runtime system information
        
        PID:1659
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        24⤵
        Writes file to tmp directory
        
        PID:1661
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        24⤵
        
        PID:1662
        
        /tmp/x
        
        /tmp/x "=" -zsh
        24⤵
        
        PID:1664
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:1664
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:1664
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:1664
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:1664
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:1664
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        Writes file to tmp directory
        
        PID:1664
        
        /usr/bin/curl
        
        curl --version
        25⤵
        
        PID:1665
        
        /bin/mkdir
        
        mkdir -p /tmp
        25⤵
        Reads runtime system information
        
        PID:1666
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        25⤵
        Writes file to tmp directory
        
        PID:1668
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        25⤵
        
        PID:1669
        
        /tmp/x
        
        /tmp/x "=" -zsh
        25⤵
        
        PID:1671
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:1671
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:1671
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:1671
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:1671
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:1671
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:1671
        
        /usr/bin/curl
        
        curl --version
        26⤵
        
        PID:1672
        
        /bin/mkdir
        
        mkdir -p /tmp
        26⤵
        Reads runtime system information
        
        PID:1673
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        26⤵
        Writes file to tmp directory
        
        PID:1675
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        26⤵
        
        PID:1676
        
        /tmp/x
        
        /tmp/x "=" -zsh
        26⤵
        
        PID:1678
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:1678
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:1678
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:1678
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:1678
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:1678
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        Writes file to tmp directory
        
        PID:1678
        
        /usr/bin/curl
        
        curl --version
        27⤵
        
        PID:1679
        
        /bin/mkdir
        
        mkdir -p /tmp
        27⤵
        Reads runtime system information
        
        PID:1680
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        27⤵
        Writes file to tmp directory
        
        PID:1682
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        27⤵
        
        PID:1683
        
        /tmp/x
        
        /tmp/x "=" -zsh
        27⤵
        
        PID:1685
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:1685
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:1685
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:1685
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:1685
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:1685
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        Writes file to tmp directory
        
        PID:1685
        
        /usr/bin/curl
        
        curl --version
        28⤵
        
        PID:1686
        
        /bin/mkdir
        
        mkdir -p /tmp
        28⤵
        Reads runtime system information
        
        PID:1687
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        28⤵
        Writes file to tmp directory
        
        PID:1689
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        28⤵
        
        PID:1690
        
        /tmp/x
        
        /tmp/x "=" -zsh
        28⤵
        
        PID:1692
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:1692
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:1692
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:1692
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:1692
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:1692
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        Writes file to tmp directory
        
        PID:1692
        
        /usr/bin/curl
        
        curl --version
        29⤵
        
        PID:1693
        
        /bin/mkdir
        
        mkdir -p /tmp
        29⤵
        Reads runtime system information
        
        PID:1694
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        29⤵
        Writes file to tmp directory
        
        PID:1696
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        29⤵
        
        PID:1697
        
        /tmp/x
        
        /tmp/x "=" -zsh
        29⤵
        
        PID:1699
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:1699
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:1699
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:1699
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:1699
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:1699
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        Writes file to tmp directory
        
        PID:1699
        
        /usr/bin/curl
        
        curl --version
        30⤵
        
        PID:1700
        
        /bin/mkdir
        
        mkdir -p /tmp
        30⤵
        Reads runtime system information
        
        PID:1701
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        30⤵
        
        PID:1703
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        30⤵
        
        PID:1704
        
        /tmp/x
        
        /tmp/x "=" -zsh
        30⤵
        
        PID:1706
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:1706
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:1706
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:1706
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:1706
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:1706
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        Writes file to tmp directory
        
        PID:1706
        
        /usr/bin/curl
        
        curl --version
        31⤵
        
        PID:1707
        
        /bin/mkdir
        
        mkdir -p /tmp
        31⤵
        Reads runtime system information
        
        PID:1708
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        31⤵
        Writes file to tmp directory
        
        PID:1710
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        31⤵
        
        PID:1711
        
        /tmp/x
        
        /tmp/x "=" -zsh
        31⤵
        
        PID:1713
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:1713
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:1713
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:1713
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:1713
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:1713
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        Writes file to tmp directory
        
        PID:1713
        
        /usr/bin/curl
        
        curl --version
        32⤵
        
        PID:1714
        
        /bin/mkdir
        
        mkdir -p /tmp
        32⤵
        Reads runtime system information
        
        PID:1715
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        32⤵
        Writes file to tmp directory
        
        PID:1717
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        32⤵
        
        PID:1718
        
        /tmp/x
        
        /tmp/x "=" -zsh
        32⤵
        
        PID:1720
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:1720
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:1720
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:1720
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:1720
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:1720
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        Writes file to tmp directory
        
        PID:1720
        
        /usr/bin/curl
        
        curl --version
        33⤵
        
        PID:1721
        
        /bin/mkdir
        
        mkdir -p /tmp
        33⤵
        Reads runtime system information
        
        PID:1722
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        33⤵
        Writes file to tmp directory
        
        PID:1724
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        33⤵
        
        PID:1725
        
        /tmp/x
        
        /tmp/x "=" -zsh
        33⤵
        
        PID:1729
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:1729
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:1729
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:1729
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:1729
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:1729
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        Writes file to tmp directory
        
        PID:1729
        
        /usr/bin/curl
        
        curl --version
        34⤵
        
        PID:1730
        
        /bin/mkdir
        
        mkdir -p /tmp
        34⤵
        Reads runtime system information
        
        PID:1731
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        34⤵
        Writes file to tmp directory
        
        PID:1733
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        34⤵
        
        PID:1734
        
        /tmp/x
        
        /tmp/x "=" -zsh
        34⤵
        
        PID:1736
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:1736
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:1736
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:1736
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:1736
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:1736
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:1736
        
        /usr/bin/curl
        
        curl --version
        35⤵
        
        PID:1737
        
        /bin/mkdir
        
        mkdir -p /tmp
        35⤵
        Reads runtime system information
        
        PID:1738
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        35⤵
        Writes file to tmp directory
        
        PID:1740
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        35⤵
        
        PID:1741
        
        /tmp/x
        
        /tmp/x "=" -zsh
        35⤵
        
        PID:1743
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1743
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1743
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1743
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1743
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1743
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        Writes file to tmp directory
        
        PID:1743
        
        /usr/bin/curl
        
        curl --version
        36⤵
        
        PID:1744
        
        /bin/mkdir
        
        mkdir -p /tmp
        36⤵
        Reads runtime system information
        
        PID:1745
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        36⤵
        Writes file to tmp directory
        
        PID:1747
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        36⤵
        
        PID:1748
        
        /tmp/x
        
        /tmp/x "=" -zsh
        36⤵
        
        PID:1750
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1750
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1750
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1750
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1750
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1750
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1750
        
        /usr/bin/curl
        
        curl --version
        37⤵
        
        PID:1751
        
        /bin/mkdir
        
        mkdir -p /tmp
        37⤵
        Reads runtime system information
        
        PID:1752
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        37⤵
        Writes file to tmp directory
        
        PID:1754
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        37⤵
        
        PID:1755
        
        /tmp/x
        
        /tmp/x "=" -zsh
        37⤵
        
        PID:1757
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1757
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1757
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1757
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1757
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1757
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        Writes file to tmp directory
        
        PID:1757
        
        /usr/bin/curl
        
        curl --version
        38⤵
        
        PID:1758
        
        /bin/mkdir
        
        mkdir -p /tmp
        38⤵
        Reads runtime system information
        
        PID:1759
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        38⤵
        Writes file to tmp directory
        
        PID:1761
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        38⤵
        
        PID:1762

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

easy_client6g7

Path /tmp/easy_client6g7
Size 20KB
SHA256 631dd0454e812a00e58c48a21bf66193673f46892aaf8fd718e2f3a664c0fddc
MD5 e631c49e8329354adf068935ed544020
SHA1 4e076b77e18996489124949409bbeeed5052fa2e
SHA512 bd0888402fcf8a3e86df27bf2dbdbe1d0d20070199d363a0a7e8d94c13effacbfb8a924a7cf9f34d841efa5ba3584d0090c5238195fba40ff055caf0cade8369
SSDEEP 192:xSS2AT9iLMmEDvf8sfO5OJatNNsd8sVINEBeRexvlNyz6LQlnpcek9t:xSS2AT9iLzxDbNsKsVIGwexvlN7otk3
TLSH
T18692058678CD8DF00645E2A49F43F419B76951234A1EBC08BB6C6D4CEF53778A3F924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download