5b05621471c622dc4a6c823efccc8f33d0e86de55c0bd795b413ffec519868aa

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/08/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 714B
Sample260811-w3929sar21
SHA256 5b05621471c622dc4a6c823efccc8f33d0e86de55c0bd795b413ffec519868aa
MD5 d8cf20f89856d437bd90a49b72bbdad9
SHA1 7dbc0a337657869f1576e438cb3fadf1060eaa78
SHA512 9e6a4b00c6c23d3a4b59f9c636ba9df5a8c68777ee13fbf23e72d3e6ab432d2b810fe9dad3271c6d63618b7c119fa1d585ff47f4323ab88f008581aa972250cb
TLSH
T114012851268C1EF51D41E734DA82A04861764612CE57A40A62229D9C6F3613E93EC836
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 64 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/easy_clientjHI	sh
File opened for modification	/tmp/easy_clientS8V	mktemp
File opened for modification	/tmp/easy_clientyIk	mktemp
File opened for modification	/tmp/easy_clientc5P	mktemp
File opened for modification	/tmp/easy_clientDXd	mktemp
File opened for modification	/tmp/easy_client38k	sh
File opened for modification	/tmp/easy_clientLIC	sh
File opened for modification	/tmp/easy_clientoSA	sh
File opened for modification	/tmp/easy_clientMit	sh
File opened for modification	/tmp/easy_clientBI8	mktemp
File opened for modification	/tmp/easy_clientEoS	mktemp
File opened for modification	/tmp/easy_clientQOn	sh
File opened for modification	/tmp/easy_clientYUA	sh
File opened for modification	/tmp/easy_clientMKf	sh
File opened for modification	/tmp/easy_client53O	sh
File opened for modification	/tmp/easy_clientS8V	sh
File opened for modification	/tmp/easy_clientaL0	sh
File opened for modification	/tmp/easy_clientwUW	sh
File opened for modification	/tmp/easy_clientTQK	mktemp
File opened for modification	/tmp/easy_clientMS8	sh
File opened for modification	/tmp/easy_clientt8P	mktemp
File opened for modification	/tmp/easy_clienti5j	mktemp
File opened for modification	/tmp/easy_client6Nv	sh
File opened for modification	/tmp/easy_clientqIs	sh
File opened for modification	/tmp/easy_clientHce	sh
File opened for modification	/tmp/easy_clientZY5	sh
File opened for modification	/tmp/easy_clientQOn	mktemp
File opened for modification	/tmp/easy_clientB6j	mktemp
File opened for modification	/tmp/easy_clientMS8	mktemp
File opened for modification	/tmp/easy_clientvx3	sh
File opened for modification	/tmp/easy_clientBI8	sh
File opened for modification	/tmp/easy_clientKco	sh
File opened for modification	/tmp/easy_clientKbD	mktemp
File opened for modification	/tmp/easy_clientC3h	sh
File opened for modification	/tmp/easy_clientoSA	mktemp
File opened for modification	/tmp/easy_clientW3b	sh
File opened for modification	/tmp/easy_clientSEH	mktemp
File opened for modification	/tmp/easy_clientYUA	mktemp
File opened for modification	/tmp/easy_clientLzV	mktemp
File opened for modification	/tmp/easy_client2u3	sh
File opened for modification	/tmp/easy_clienthuQ	mktemp
File opened for modification	/tmp/easy_clientMRB	sh
File opened for modification	/tmp/easy_clientxSY	mktemp
File opened for modification	/tmp/easy_clientBaY	sh
File opened for modification	/tmp/easy_clientW3b	mktemp
File opened for modification	/tmp/easy_client38k	mktemp
File opened for modification	/tmp/easy_clientB6j	sh
File opened for modification	/tmp/easy_client2u3	mktemp
File opened for modification	/tmp/easy_client6Nv	mktemp
File opened for modification	/tmp/easy_clientMRB	mktemp
File opened for modification	/tmp/easy_clientQJP	sh
File opened for modification	/tmp/easy_clientxSY	sh
File opened for modification	/tmp/easy_clientuy5	sh
File opened for modification	/tmp/easy_clientymW	sh
File opened for modification	/tmp/easy_clienthuQ	sh
File opened for modification	/tmp/easy_clientPqM	mktemp
File opened for modification	/tmp/easy_clientjHI	mktemp
File opened for modification	/tmp/easy_clientFO9	mktemp
File opened for modification	/tmp/easy_clientt8P	sh
File opened for modification	/tmp/easy_client6kT	sh
File opened for modification	/tmp/easy_clientewB	sh
File opened for modification	/tmp/easy_clientPia	sh
File opened for modification	/tmp/easy_clientF2e	sh
File opened for modification	/tmp/easy_clientA7e	mktemp

/tmp/x
/tmp/x
1⤵
PID:643

/usr/local/sbin/sh
sh /tmp/x
1⤵
PID:643

/usr/local/bin/sh
sh /tmp/x
1⤵
PID:643

/usr/sbin/sh
sh /tmp/x
1⤵
PID:643

/usr/bin/sh
sh /tmp/x
1⤵
PID:643

/sbin/sh
sh /tmp/x
1⤵
PID:643

/bin/sh
sh /tmp/x
1⤵
PID:643
- /usr/bin/curl
  curl --version
  2⤵
  PID:646
- /bin/mkdir
  mkdir -p /tmp
  2⤵
  PID:665
- /bin/mktemp
  mktemp -t easy_clientXXX
  2⤵
  PID:668
- /usr/bin/curl
  curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
  2⤵
  PID:670
- /tmp/x
  /tmp/x "=" -zsh
  2⤵
  PID:721
- /usr/local/sbin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:721
- /usr/local/bin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:721
- /usr/sbin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:721
- /usr/bin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:721
- /sbin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:721
- /bin/sh
  sh /tmp/x "=" -zsh
  2⤵
  PID:721
- - /usr/bin/curl
    curl --version
    3⤵
    - Checks CPU configuration
    PID:722
- - /bin/mkdir
    mkdir -p /tmp
    3⤵
    - Reads runtime system information
    PID:724
- - /bin/mktemp
    mktemp -t easy_clientXXX
    3⤵
    PID:726
- - /usr/bin/curl
    curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
    3⤵
    - Checks CPU configuration
    PID:727
- - /tmp/x
    /tmp/x "=" -zsh
    3⤵
    PID:759
- - /usr/local/sbin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:759
- - /usr/local/bin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:759
- - /usr/sbin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:759
- - /usr/bin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:759
- - /sbin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:759
- - /bin/sh
    sh /tmp/x "=" -zsh
    3⤵
    PID:759
  - - /usr/bin/curl
      curl --version
      4⤵
      Checks CPU configuration
      Reads runtime system information
      PID:760
  - - /bin/mkdir
      mkdir -p /tmp
      4⤵
      PID:761
  - - /bin/mktemp
      mktemp -t easy_clientXXX
      4⤵
      Writes file to tmp directory
      PID:763
  - - /usr/bin/curl
      curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
      4⤵
      PID:764
  - - /tmp/x
      /tmp/x "=" -zsh
      4⤵
      PID:768
  - - /usr/local/sbin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:768
  - - /usr/local/bin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:768
  - - /usr/sbin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:768
  - - /usr/bin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:768
  - - /sbin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:768
  - - /bin/sh
      sh /tmp/x "=" -zsh
      4⤵
      PID:768
    - - /usr/bin/curl
        
        curl --version
        5⤵
        
        PID:769
    - - /bin/mkdir
        
        mkdir -p /tmp
        5⤵
        
        PID:770
    - - /bin/mktemp
        
        mktemp -t easy_clientXXX
        5⤵
        
        PID:772
    - - /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        5⤵
        
        PID:773
    - - /tmp/x
        
        /tmp/x "=" -zsh
        5⤵
        
        PID:775
    - - /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:775
    - - /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:775
    - - /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:775
    - - /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:775
    - - /sbin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:775
    - - /bin/sh
        
        sh /tmp/x "=" -zsh
        5⤵
        
        PID:775
      - /usr/bin/curl
        
        curl --version
        6⤵
        
        PID:776
      - /bin/mkdir
        
        mkdir -p /tmp
        6⤵
        
        PID:777
      - /bin/mktemp
        
        mktemp -t easy_clientXXX
        6⤵
        Writes file to tmp directory
        
        PID:779
      - /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        6⤵
        
        PID:780
      - /tmp/x
        
        /tmp/x "=" -zsh
        6⤵
        
        PID:782
      - /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:782
      - /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:782
      - /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:782
      - /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:782
      - /sbin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        
        PID:782
      - /bin/sh
        
        sh /tmp/x "=" -zsh
        6⤵
        Writes file to tmp directory
        
        PID:782
        
        /usr/bin/curl
        
        curl --version
        7⤵
        Reads runtime system information
        
        PID:783
        
        /bin/mkdir
        
        mkdir -p /tmp
        7⤵
        
        PID:784
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        7⤵
        
        PID:786
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        7⤵
        Checks CPU configuration
        
        PID:787
        
        /tmp/x
        
        /tmp/x "=" -zsh
        7⤵
        
        PID:789
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:789
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:789
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:789
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:789
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        
        PID:789
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        7⤵
        Writes file to tmp directory
        
        PID:789
        
        /usr/bin/curl
        
        curl --version
        8⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:790
        
        /bin/mkdir
        
        mkdir -p /tmp
        8⤵
        Reads runtime system information
        
        PID:791
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        8⤵
        
        PID:793
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        8⤵
        Checks CPU configuration
        
        PID:794
        
        /tmp/x
        
        /tmp/x "=" -zsh
        8⤵
        
        PID:798
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:798
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:798
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:798
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:798
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        
        PID:798
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        8⤵
        Writes file to tmp directory
        
        PID:798
        
        /usr/bin/curl
        
        curl --version
        9⤵
        
        PID:799
        
        /bin/mkdir
        
        mkdir -p /tmp
        9⤵
        Reads runtime system information
        
        PID:800
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        9⤵
        Writes file to tmp directory
        
        PID:802
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        9⤵
        Reads runtime system information
        
        PID:803
        
        /tmp/x
        
        /tmp/x "=" -zsh
        9⤵
        
        PID:805
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:805
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:805
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:805
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:805
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:805
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        9⤵
        
        PID:805
        
        /usr/bin/curl
        
        curl --version
        10⤵
        
        PID:806
        
        /bin/mkdir
        
        mkdir -p /tmp
        10⤵
        Reads runtime system information
        
        PID:807
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        10⤵
        
        PID:809
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        10⤵
        
        PID:810
        
        /tmp/x
        
        /tmp/x "=" -zsh
        10⤵
        
        PID:817
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:817
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:817
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:817
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:817
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:817
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        10⤵
        
        PID:817
        
        /usr/bin/curl
        
        curl --version
        11⤵
        Checks CPU configuration
        
        PID:818
        
        /bin/mkdir
        
        mkdir -p /tmp
        11⤵
        
        PID:819
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        11⤵
        Writes file to tmp directory
        
        PID:821
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        11⤵
        Checks CPU configuration
        
        PID:822
        
        /tmp/x
        
        /tmp/x "=" -zsh
        11⤵
        
        PID:824
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:824
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:824
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:824
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:824
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        
        PID:824
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        11⤵
        Writes file to tmp directory
        
        PID:824
        
        /usr/bin/curl
        
        curl --version
        12⤵
        
        PID:825
        
        /bin/mkdir
        
        mkdir -p /tmp
        12⤵
        
        PID:826
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        12⤵
        
        PID:828
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        12⤵
        Reads runtime system information
        
        PID:829
        
        /tmp/x
        
        /tmp/x "=" -zsh
        12⤵
        
        PID:832
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:832
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:832
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:832
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:832
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:832
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        12⤵
        
        PID:832
        
        /usr/bin/curl
        
        curl --version
        13⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:833
        
        /bin/mkdir
        
        mkdir -p /tmp
        13⤵
        
        PID:834
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        13⤵
        
        PID:836
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        13⤵
        
        PID:837
        
        /tmp/x
        
        /tmp/x "=" -zsh
        13⤵
        
        PID:841
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:841
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:841
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:841
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:841
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:841
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        13⤵
        
        PID:841
        
        /usr/bin/curl
        
        curl --version
        14⤵
        Checks CPU configuration
        
        PID:842
        
        /bin/mkdir
        
        mkdir -p /tmp
        14⤵
        
        PID:843
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        14⤵
        Writes file to tmp directory
        
        PID:845
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        14⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:846
        
        /tmp/x
        
        /tmp/x "=" -zsh
        14⤵
        
        PID:848
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:848
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:848
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:848
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:848
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        
        PID:848
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        14⤵
        Writes file to tmp directory
        
        PID:848
        
        /usr/bin/curl
        
        curl --version
        15⤵
        Checks CPU configuration
        
        PID:849
        
        /bin/mkdir
        
        mkdir -p /tmp
        15⤵
        
        PID:850
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        15⤵
        Writes file to tmp directory
        
        PID:852
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        15⤵
        Checks CPU configuration
        
        PID:853
        
        /tmp/x
        
        /tmp/x "=" -zsh
        15⤵
        
        PID:855
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:855
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:855
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:855
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:855
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:855
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        15⤵
        
        PID:855
        
        /usr/bin/curl
        
        curl --version
        16⤵
        
        PID:856
        
        /bin/mkdir
        
        mkdir -p /tmp
        16⤵
        
        PID:857
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        16⤵
        Writes file to tmp directory
        
        PID:859
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        16⤵
        Checks CPU configuration
        
        PID:860
        
        /tmp/x
        
        /tmp/x "=" -zsh
        16⤵
        
        PID:862
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:862
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:862
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:862
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:862
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:862
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        16⤵
        
        PID:862
        
        /usr/bin/curl
        
        curl --version
        17⤵
        Checks CPU configuration
        
        PID:863
        
        /bin/mkdir
        
        mkdir -p /tmp
        17⤵
        
        PID:864
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        17⤵
        
        PID:866
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        17⤵
        
        PID:867
        
        /tmp/x
        
        /tmp/x "=" -zsh
        17⤵
        
        PID:871
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:871
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:871
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:871
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:871
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:871
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        17⤵
        
        PID:871
        
        /usr/bin/curl
        
        curl --version
        18⤵
        Checks CPU configuration
        
        PID:872
        
        /bin/mkdir
        
        mkdir -p /tmp
        18⤵
        
        PID:873
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        18⤵
        
        PID:875
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        18⤵
        
        PID:876
        
        /tmp/x
        
        /tmp/x "=" -zsh
        18⤵
        
        PID:878
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:878
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:878
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:878
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:878
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        
        PID:878
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        18⤵
        Writes file to tmp directory
        
        PID:878
        
        /usr/bin/curl
        
        curl --version
        19⤵
        Checks CPU configuration
        
        PID:879
        
        /bin/mkdir
        
        mkdir -p /tmp
        19⤵
        
        PID:880
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        19⤵
        Writes file to tmp directory
        
        PID:882
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        19⤵
        
        PID:883
        
        /tmp/x
        
        /tmp/x "=" -zsh
        19⤵
        
        PID:885
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:885
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:885
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:885
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:885
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:885
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        19⤵
        
        PID:885
        
        /usr/bin/curl
        
        curl --version
        20⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:886
        
        /bin/mkdir
        
        mkdir -p /tmp
        20⤵
        
        PID:887
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        20⤵
        Writes file to tmp directory
        
        PID:889
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        20⤵
        
        PID:890
        
        /tmp/x
        
        /tmp/x "=" -zsh
        20⤵
        
        PID:894
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:894
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:894
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:894
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:894
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        
        PID:894
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        20⤵
        Writes file to tmp directory
        
        PID:894
        
        /usr/bin/curl
        
        curl --version
        21⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:895
        
        /bin/mkdir
        
        mkdir -p /tmp
        21⤵
        
        PID:896
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        21⤵
        Writes file to tmp directory
        
        PID:898
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        21⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:899
        
        /tmp/x
        
        /tmp/x "=" -zsh
        21⤵
        
        PID:901
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:901
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:901
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:901
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:901
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        
        PID:901
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        21⤵
        Writes file to tmp directory
        
        PID:901
        
        /usr/bin/curl
        
        curl --version
        22⤵
        Checks CPU configuration
        
        PID:902
        
        /bin/mkdir
        
        mkdir -p /tmp
        22⤵
        
        PID:903
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        22⤵
        Writes file to tmp directory
        
        PID:905
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        22⤵
        
        PID:906
        
        /tmp/x
        
        /tmp/x "=" -zsh
        22⤵
        
        PID:908
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:908
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:908
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:908
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:908
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        
        PID:908
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        22⤵
        Writes file to tmp directory
        
        PID:908
        
        /usr/bin/curl
        
        curl --version
        23⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:909
        
        /bin/mkdir
        
        mkdir -p /tmp
        23⤵
        
        PID:910
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        23⤵
        Writes file to tmp directory
        
        PID:912
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        23⤵
        
        PID:913
        
        /tmp/x
        
        /tmp/x "=" -zsh
        23⤵
        
        PID:915
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:915
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:915
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:915
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:915
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:915
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        23⤵
        
        PID:915
        
        /usr/bin/curl
        
        curl --version
        24⤵
        Checks CPU configuration
        
        PID:916
        
        /bin/mkdir
        
        mkdir -p /tmp
        24⤵
        
        PID:917
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        24⤵
        Writes file to tmp directory
        
        PID:919
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        24⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:920
        
        /tmp/x
        
        /tmp/x "=" -zsh
        24⤵
        
        PID:924
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:924
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:924
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:924
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:924
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        
        PID:924
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        24⤵
        Writes file to tmp directory
        
        PID:924
        
        /usr/bin/curl
        
        curl --version
        25⤵
        Reads runtime system information
        
        PID:925
        
        /bin/mkdir
        
        mkdir -p /tmp
        25⤵
        
        PID:926
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        25⤵
        
        PID:928
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        25⤵
        Checks CPU configuration
        
        PID:929
        
        /tmp/x
        
        /tmp/x "=" -zsh
        25⤵
        
        PID:931
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:931
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:931
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:931
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:931
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:931
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        25⤵
        
        PID:931
        
        /usr/bin/curl
        
        curl --version
        26⤵
        
        PID:932
        
        /bin/mkdir
        
        mkdir -p /tmp
        26⤵
        Reads runtime system information
        
        PID:933
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        26⤵
        Writes file to tmp directory
        
        PID:935
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        26⤵
        Checks CPU configuration
        
        PID:936
        
        /tmp/x
        
        /tmp/x "=" -zsh
        26⤵
        
        PID:938
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:938
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:938
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:938
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:938
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        
        PID:938
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        26⤵
        Writes file to tmp directory
        
        PID:938
        
        /usr/bin/curl
        
        curl --version
        27⤵
        Checks CPU configuration
        
        PID:939
        
        /bin/mkdir
        
        mkdir -p /tmp
        27⤵
        
        PID:940
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        27⤵
        
        PID:942
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        27⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:943
        
        /tmp/x
        
        /tmp/x "=" -zsh
        27⤵
        
        PID:945
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:945
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:945
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:945
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:945
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:945
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        27⤵
        
        PID:945
        
        /usr/bin/curl
        
        curl --version
        28⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:946
        
        /bin/mkdir
        
        mkdir -p /tmp
        28⤵
        
        PID:947
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        28⤵
        
        PID:949
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        28⤵
        Checks CPU configuration
        
        PID:950
        
        /tmp/x
        
        /tmp/x "=" -zsh
        28⤵
        
        PID:954
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:954
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:954
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:954
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:954
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        
        PID:954
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        28⤵
        Writes file to tmp directory
        
        PID:954
        
        /usr/bin/curl
        
        curl --version
        29⤵
        Reads runtime system information
        
        PID:955
        
        /bin/mkdir
        
        mkdir -p /tmp
        29⤵
        
        PID:956
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        29⤵
        Writes file to tmp directory
        
        PID:958
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        29⤵
        Checks CPU configuration
        
        PID:959
        
        /tmp/x
        
        /tmp/x "=" -zsh
        29⤵
        
        PID:961
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:961
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:961
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:961
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:961
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:961
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        29⤵
        
        PID:961
        
        /usr/bin/curl
        
        curl --version
        30⤵
        
        PID:962
        
        /bin/mkdir
        
        mkdir -p /tmp
        30⤵
        
        PID:963
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        30⤵
        
        PID:965
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        30⤵
        
        PID:966
        
        /tmp/x
        
        /tmp/x "=" -zsh
        30⤵
        
        PID:968
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:968
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:968
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:968
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:968
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        
        PID:968
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        30⤵
        Writes file to tmp directory
        
        PID:968
        
        /usr/bin/curl
        
        curl --version
        31⤵
        
        PID:969
        
        /bin/mkdir
        
        mkdir -p /tmp
        31⤵
        
        PID:970
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        31⤵
        
        PID:972
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        31⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:973
        
        /tmp/x
        
        /tmp/x "=" -zsh
        31⤵
        
        PID:975
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:975
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:975
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:975
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:975
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        
        PID:975
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        31⤵
        Writes file to tmp directory
        
        PID:975
        
        /usr/bin/curl
        
        curl --version
        32⤵
        Checks CPU configuration
        
        PID:976
        
        /bin/mkdir
        
        mkdir -p /tmp
        32⤵
        Reads runtime system information
        
        PID:977
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        32⤵
        
        PID:979
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        32⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:980
        
        /tmp/x
        
        /tmp/x "=" -zsh
        32⤵
        
        PID:982
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:982
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:982
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:982
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:982
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        
        PID:982
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        32⤵
        Writes file to tmp directory
        
        PID:982
        
        /usr/bin/curl
        
        curl --version
        33⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:983
        
        /bin/mkdir
        
        mkdir -p /tmp
        33⤵
        
        PID:984
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        33⤵
        Writes file to tmp directory
        
        PID:986
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        33⤵
        Reads runtime system information
        
        PID:987
        
        /tmp/x
        
        /tmp/x "=" -zsh
        33⤵
        
        PID:991
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:991
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:991
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:991
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:991
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        
        PID:991
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        33⤵
        Writes file to tmp directory
        
        PID:991
        
        /usr/bin/curl
        
        curl --version
        34⤵
        
        PID:992
        
        /bin/mkdir
        
        mkdir -p /tmp
        34⤵
        Reads runtime system information
        
        PID:993
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        34⤵
        Writes file to tmp directory
        
        PID:995
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        34⤵
        
        PID:996
        
        /tmp/x
        
        /tmp/x "=" -zsh
        34⤵
        
        PID:998
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:998
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:998
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:998
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:998
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        
        PID:998
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        34⤵
        Writes file to tmp directory
        
        PID:998
        
        /usr/bin/curl
        
        curl --version
        35⤵
        
        PID:999
        
        /bin/mkdir
        
        mkdir -p /tmp
        35⤵
        
        PID:1000
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        35⤵
        
        PID:1002
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        35⤵
        
        PID:1003
        
        /tmp/x
        
        /tmp/x "=" -zsh
        35⤵
        
        PID:1005
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1005
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1005
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1005
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1005
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1005
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        35⤵
        
        PID:1005
        
        /usr/bin/curl
        
        curl --version
        36⤵
        
        PID:1006
        
        /bin/mkdir
        
        mkdir -p /tmp
        36⤵
        
        PID:1007
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        36⤵
        
        PID:1009
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        36⤵
        Reads runtime system information
        
        PID:1010
        
        /tmp/x
        
        /tmp/x "=" -zsh
        36⤵
        
        PID:1012
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1012
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1012
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1012
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1012
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        
        PID:1012
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        36⤵
        Writes file to tmp directory
        
        PID:1012
        
        /usr/bin/curl
        
        curl --version
        37⤵
        Checks CPU configuration
        
        PID:1013
        
        /bin/mkdir
        
        mkdir -p /tmp
        37⤵
        
        PID:1014
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        37⤵
        
        PID:1016
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        37⤵
        Reads runtime system information
        
        PID:1017
        
        /tmp/x
        
        /tmp/x "=" -zsh
        37⤵
        
        PID:1019
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1019
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1019
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1019
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1019
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        
        PID:1019
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        37⤵
        Writes file to tmp directory
        
        PID:1019
        
        /usr/bin/curl
        
        curl --version
        38⤵
        Reads runtime system information
        
        PID:1020
        
        /bin/mkdir
        
        mkdir -p /tmp
        38⤵
        
        PID:1021
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        38⤵
        
        PID:1023
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        38⤵
        Reads runtime system information
        
        PID:1024
        
        /tmp/x
        
        /tmp/x "=" -zsh
        38⤵
        
        PID:1028
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        38⤵
        
        PID:1028
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        38⤵
        
        PID:1028
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        38⤵
        
        PID:1028
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        38⤵
        
        PID:1028
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        38⤵
        
        PID:1028
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        38⤵
        Writes file to tmp directory
        
        PID:1028
        
        /usr/bin/curl
        
        curl --version
        39⤵
        Checks CPU configuration
        
        PID:1029
        
        /bin/mkdir
        
        mkdir -p /tmp
        39⤵
        
        PID:1030
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        39⤵
        
        PID:1032
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        39⤵
        Checks CPU configuration
        
        PID:1033
        
        /tmp/x
        
        /tmp/x "=" -zsh
        39⤵
        
        PID:1035
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        39⤵
        
        PID:1035
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        39⤵
        
        PID:1035
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        39⤵
        
        PID:1035
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        39⤵
        
        PID:1035
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        39⤵
        
        PID:1035
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        39⤵
        
        PID:1035
        
        /usr/bin/curl
        
        curl --version
        40⤵
        Checks CPU configuration
        
        PID:1036
        
        /bin/mkdir
        
        mkdir -p /tmp
        40⤵
        
        PID:1037
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        40⤵
        Writes file to tmp directory
        
        PID:1039
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        40⤵
        
        PID:1040
        
        /tmp/x
        
        /tmp/x "=" -zsh
        40⤵
        
        PID:1042
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        40⤵
        
        PID:1042
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        40⤵
        
        PID:1042
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        40⤵
        
        PID:1042
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        40⤵
        
        PID:1042
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        40⤵
        
        PID:1042
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        40⤵
        Writes file to tmp directory
        
        PID:1042
        
        /usr/bin/curl
        
        curl --version
        41⤵
        Checks CPU configuration
        
        PID:1043
        
        /bin/mkdir
        
        mkdir -p /tmp
        41⤵
        
        PID:1044
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        41⤵
        Writes file to tmp directory
        
        PID:1046
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        41⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1047
        
        /tmp/x
        
        /tmp/x "=" -zsh
        41⤵
        
        PID:1049
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        41⤵
        
        PID:1049
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        41⤵
        
        PID:1049
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        41⤵
        
        PID:1049
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        41⤵
        
        PID:1049
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        41⤵
        
        PID:1049
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        41⤵
        Writes file to tmp directory
        
        PID:1049
        
        /usr/bin/curl
        
        curl --version
        42⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1050
        
        /bin/mkdir
        
        mkdir -p /tmp
        42⤵
        
        PID:1051
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        42⤵
        
        PID:1053
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        42⤵
        Reads runtime system information
        
        PID:1054
        
        /tmp/x
        
        /tmp/x "=" -zsh
        42⤵
        
        PID:1056
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        42⤵
        
        PID:1056
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        42⤵
        
        PID:1056
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        42⤵
        
        PID:1056
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        42⤵
        
        PID:1056
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        42⤵
        
        PID:1056
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        42⤵
        
        PID:1056
        
        /usr/bin/curl
        
        curl --version
        43⤵
        
        PID:1057
        
        /bin/mkdir
        
        mkdir -p /tmp
        43⤵
        
        PID:1058
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        43⤵
        Writes file to tmp directory
        
        PID:1060
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        43⤵
        Checks CPU configuration
        
        PID:1061
        
        /tmp/x
        
        /tmp/x "=" -zsh
        43⤵
        
        PID:1063
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        43⤵
        
        PID:1063
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        43⤵
        
        PID:1063
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        43⤵
        
        PID:1063
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        43⤵
        
        PID:1063
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        43⤵
        
        PID:1063
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        43⤵
        
        PID:1063
        
        /usr/bin/curl
        
        curl --version
        44⤵
        Reads runtime system information
        
        PID:1064
        
        /bin/mkdir
        
        mkdir -p /tmp
        44⤵
        
        PID:1066
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        44⤵
        Writes file to tmp directory
        
        PID:1068
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        44⤵
        
        PID:1069
        
        /tmp/x
        
        /tmp/x "=" -zsh
        44⤵
        
        PID:1072
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        44⤵
        
        PID:1072
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        44⤵
        
        PID:1072
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        44⤵
        
        PID:1072
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        44⤵
        
        PID:1072
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        44⤵
        
        PID:1072
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        44⤵
        Writes file to tmp directory
        
        PID:1072
        
        /usr/bin/curl
        
        curl --version
        45⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1073
        
        /bin/mkdir
        
        mkdir -p /tmp
        45⤵
        Reads runtime system information
        
        PID:1074
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        45⤵
        
        PID:1076
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        45⤵
        
        PID:1077
        
        /tmp/x
        
        /tmp/x "=" -zsh
        45⤵
        
        PID:1079
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        45⤵
        
        PID:1079
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        45⤵
        
        PID:1079
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        45⤵
        
        PID:1079
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        45⤵
        
        PID:1079
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        45⤵
        
        PID:1079
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        45⤵
        Writes file to tmp directory
        
        PID:1079
        
        /usr/bin/curl
        
        curl --version
        46⤵
        Checks CPU configuration
        
        PID:1080
        
        /bin/mkdir
        
        mkdir -p /tmp
        46⤵
        
        PID:1081
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        46⤵
        
        PID:1083
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        46⤵
        
        PID:1084
        
        /tmp/x
        
        /tmp/x "=" -zsh
        46⤵
        
        PID:1086
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        46⤵
        
        PID:1086
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        46⤵
        
        PID:1086
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        46⤵
        
        PID:1086
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        46⤵
        
        PID:1086
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        46⤵
        
        PID:1086
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        46⤵
        Writes file to tmp directory
        
        PID:1086
        
        /usr/bin/curl
        
        curl --version
        47⤵
        Checks CPU configuration
        
        PID:1087
        
        /bin/mkdir
        
        mkdir -p /tmp
        47⤵
        
        PID:1088
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        47⤵
        
        PID:1090
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        47⤵
        
        PID:1091
        
        /tmp/x
        
        /tmp/x "=" -zsh
        47⤵
        
        PID:1093
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        47⤵
        
        PID:1093
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        47⤵
        
        PID:1093
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        47⤵
        
        PID:1093
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        47⤵
        
        PID:1093
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        47⤵
        
        PID:1093
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        47⤵
        
        PID:1093
        
        /usr/bin/curl
        
        curl --version
        48⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1094
        
        /bin/mkdir
        
        mkdir -p /tmp
        48⤵
        
        PID:1095
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        48⤵
        
        PID:1097
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        48⤵
        
        PID:1098
        
        /tmp/x
        
        /tmp/x "=" -zsh
        48⤵
        
        PID:1100
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        48⤵
        
        PID:1100
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        48⤵
        
        PID:1100
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        48⤵
        
        PID:1100
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        48⤵
        
        PID:1100
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        48⤵
        
        PID:1100
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        48⤵
        Writes file to tmp directory
        
        PID:1100
        
        /usr/bin/curl
        
        curl --version
        49⤵
        
        PID:1101
        
        /bin/mkdir
        
        mkdir -p /tmp
        49⤵
        
        PID:1102
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        49⤵
        Writes file to tmp directory
        
        PID:1104
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        49⤵
        Checks CPU configuration
        
        PID:1105
        
        /tmp/x
        
        /tmp/x "=" -zsh
        49⤵
        
        PID:1109
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        49⤵
        
        PID:1109
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        49⤵
        
        PID:1109
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        49⤵
        
        PID:1109
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        49⤵
        
        PID:1109
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        49⤵
        
        PID:1109
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        49⤵
        
        PID:1109
        
        /usr/bin/curl
        
        curl --version
        50⤵
        
        PID:1110
        
        /bin/mkdir
        
        mkdir -p /tmp
        50⤵
        
        PID:1111
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        50⤵
        Writes file to tmp directory
        
        PID:1113
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        50⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1114
        
        /tmp/x
        
        /tmp/x "=" -zsh
        50⤵
        
        PID:1116
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        50⤵
        
        PID:1116
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        50⤵
        
        PID:1116
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        50⤵
        
        PID:1116
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        50⤵
        
        PID:1116
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        50⤵
        
        PID:1116
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        50⤵
        
        PID:1116
        
        /usr/bin/curl
        
        curl --version
        51⤵
        Reads runtime system information
        
        PID:1117
        
        /bin/mkdir
        
        mkdir -p /tmp
        51⤵
        
        PID:1118
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        51⤵
        
        PID:1120
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        51⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1121
        
        /tmp/x
        
        /tmp/x "=" -zsh
        51⤵
        
        PID:1123
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        51⤵
        
        PID:1123
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        51⤵
        
        PID:1123
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        51⤵
        
        PID:1123
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        51⤵
        
        PID:1123
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        51⤵
        
        PID:1123
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        51⤵
        Writes file to tmp directory
        
        PID:1123
        
        /usr/bin/curl
        
        curl --version
        52⤵
        Checks CPU configuration
        
        PID:1124
        
        /bin/mkdir
        
        mkdir -p /tmp
        52⤵
        
        PID:1125
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        52⤵
        
        PID:1127
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        52⤵
        Checks CPU configuration
        
        PID:1128
        
        /tmp/x
        
        /tmp/x "=" -zsh
        52⤵
        
        PID:1130
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        52⤵
        
        PID:1130
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        52⤵
        
        PID:1130
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        52⤵
        
        PID:1130
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        52⤵
        
        PID:1130
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        52⤵
        
        PID:1130
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        52⤵
        Writes file to tmp directory
        
        PID:1130
        
        /usr/bin/curl
        
        curl --version
        53⤵
        Checks CPU configuration
        
        PID:1131
        
        /bin/mkdir
        
        mkdir -p /tmp
        53⤵
        
        PID:1132
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        53⤵
        
        PID:1134
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        53⤵
        Reads runtime system information
        
        PID:1135
        
        /tmp/x
        
        /tmp/x "=" -zsh
        53⤵
        
        PID:1137
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        53⤵
        
        PID:1137
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        53⤵
        
        PID:1137
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        53⤵
        
        PID:1137
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        53⤵
        
        PID:1137
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        53⤵
        
        PID:1137
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        53⤵
        Writes file to tmp directory
        
        PID:1137
        
        /usr/bin/curl
        
        curl --version
        54⤵
        
        PID:1138
        
        /bin/mkdir
        
        mkdir -p /tmp
        54⤵
        
        PID:1139
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        54⤵
        Writes file to tmp directory
        
        PID:1141
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        54⤵
        Reads runtime system information
        
        PID:1142
        
        /tmp/x
        
        /tmp/x "=" -zsh
        54⤵
        
        PID:1145
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        54⤵
        
        PID:1145
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        54⤵
        
        PID:1145
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        54⤵
        
        PID:1145
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        54⤵
        
        PID:1145
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        54⤵
        
        PID:1145
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        54⤵
        
        PID:1145
        
        /usr/bin/curl
        
        curl --version
        55⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1146
        
        /bin/mkdir
        
        mkdir -p /tmp
        55⤵
        
        PID:1148
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        55⤵
        
        PID:1150
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        55⤵
        Reads runtime system information
        
        PID:1151
        
        /tmp/x
        
        /tmp/x "=" -zsh
        55⤵
        
        PID:1153
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        55⤵
        
        PID:1153
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        55⤵
        
        PID:1153
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        55⤵
        
        PID:1153
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        55⤵
        
        PID:1153
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        55⤵
        
        PID:1153
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        55⤵
        
        PID:1153
        
        /usr/bin/curl
        
        curl --version
        56⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1154
        
        /bin/mkdir
        
        mkdir -p /tmp
        56⤵
        Reads runtime system information
        
        PID:1155
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        56⤵
        
        PID:1157
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        56⤵
        
        PID:1158
        
        /tmp/x
        
        /tmp/x "=" -zsh
        56⤵
        
        PID:1160
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        56⤵
        
        PID:1160
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        56⤵
        
        PID:1160
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        56⤵
        
        PID:1160
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        56⤵
        
        PID:1160
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        56⤵
        
        PID:1160
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        56⤵
        Writes file to tmp directory
        
        PID:1160
        
        /usr/bin/curl
        
        curl --version
        57⤵
        Checks CPU configuration
        
        PID:1161
        
        /bin/mkdir
        
        mkdir -p /tmp
        57⤵
        
        PID:1162
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        57⤵
        
        PID:1164
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        57⤵
        
        PID:1165
        
        /tmp/x
        
        /tmp/x "=" -zsh
        57⤵
        
        PID:1167
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        57⤵
        
        PID:1167
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        57⤵
        
        PID:1167
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        57⤵
        
        PID:1167
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        57⤵
        
        PID:1167
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        57⤵
        
        PID:1167
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        57⤵
        Writes file to tmp directory
        
        PID:1167
        
        /usr/bin/curl
        
        curl --version
        58⤵
        Checks CPU configuration
        
        PID:1168
        
        /bin/mkdir
        
        mkdir -p /tmp
        58⤵
        
        PID:1169
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        58⤵
        
        PID:1171
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        58⤵
        
        PID:1172
        
        /tmp/x
        
        /tmp/x "=" -zsh
        58⤵
        
        PID:1174
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        58⤵
        
        PID:1174
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        58⤵
        
        PID:1174
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        58⤵
        
        PID:1174
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        58⤵
        
        PID:1174
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        58⤵
        
        PID:1174
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        58⤵
        Writes file to tmp directory
        
        PID:1174
        
        /usr/bin/curl
        
        curl --version
        59⤵
        Reads runtime system information
        
        PID:1175
        
        /bin/mkdir
        
        mkdir -p /tmp
        59⤵
        
        PID:1176
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        59⤵
        Writes file to tmp directory
        
        PID:1178
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        59⤵
        Reads runtime system information
        
        PID:1179
        
        /tmp/x
        
        /tmp/x "=" -zsh
        59⤵
        
        PID:1181
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        59⤵
        
        PID:1181
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        59⤵
        
        PID:1181
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        59⤵
        
        PID:1181
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        59⤵
        
        PID:1181
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        59⤵
        
        PID:1181
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        59⤵
        
        PID:1181
        
        /usr/bin/curl
        
        curl --version
        60⤵
        
        PID:1182
        
        /bin/mkdir
        
        mkdir -p /tmp
        60⤵
        Reads runtime system information
        
        PID:1183
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        60⤵
        
        PID:1185
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        60⤵
        Checks CPU configuration
        
        PID:1186
        
        /tmp/x
        
        /tmp/x "=" -zsh
        60⤵
        
        PID:1189
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        60⤵
        
        PID:1189
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        60⤵
        
        PID:1189
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        60⤵
        
        PID:1189
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        60⤵
        
        PID:1189
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        60⤵
        
        PID:1189
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        60⤵
        Writes file to tmp directory
        
        PID:1189
        
        /usr/bin/curl
        
        curl --version
        61⤵
        
        PID:1191
        
        /bin/mkdir
        
        mkdir -p /tmp
        61⤵
        Reads runtime system information
        
        PID:1192
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        61⤵
        Writes file to tmp directory
        
        PID:1194
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        61⤵
        Checks CPU configuration
        
        PID:1195
        
        /tmp/x
        
        /tmp/x "=" -zsh
        61⤵
        
        PID:1197
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        61⤵
        
        PID:1197
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        61⤵
        
        PID:1197
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        61⤵
        
        PID:1197
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        61⤵
        
        PID:1197
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        61⤵
        
        PID:1197
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        61⤵
        Writes file to tmp directory
        
        PID:1197
        
        /usr/bin/curl
        
        curl --version
        62⤵
        Checks CPU configuration
        
        PID:1198
        
        /bin/mkdir
        
        mkdir -p /tmp
        62⤵
        
        PID:1199
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        62⤵
        
        PID:1201
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        62⤵
        Checks CPU configuration
        
        PID:1202
        
        /tmp/x
        
        /tmp/x "=" -zsh
        62⤵
        
        PID:1204
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        62⤵
        
        PID:1204
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        62⤵
        
        PID:1204
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        62⤵
        
        PID:1204
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        62⤵
        
        PID:1204
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        62⤵
        
        PID:1204
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        62⤵
        
        PID:1204
        
        /usr/bin/curl
        
        curl --version
        63⤵
        Checks CPU configuration
        
        PID:1205
        
        /bin/mkdir
        
        mkdir -p /tmp
        63⤵
        
        PID:1206
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        63⤵
        
        PID:1208
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        63⤵
        Reads runtime system information
        
        PID:1209
        
        /tmp/x
        
        /tmp/x "=" -zsh
        63⤵
        
        PID:1211
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        63⤵
        
        PID:1211
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        63⤵
        
        PID:1211
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        63⤵
        
        PID:1211
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        63⤵
        
        PID:1211
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        63⤵
        
        PID:1211
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        63⤵
        Writes file to tmp directory
        
        PID:1211
        
        /usr/bin/curl
        
        curl --version
        64⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1212
        
        /bin/mkdir
        
        mkdir -p /tmp
        64⤵
        Reads runtime system information
        
        PID:1213
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        64⤵
        Writes file to tmp directory
        
        PID:1215
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        64⤵
        Reads runtime system information
        
        PID:1216
        
        /tmp/x
        
        /tmp/x "=" -zsh
        64⤵
        
        PID:1218
        
        /usr/local/sbin/sh
        
        sh /tmp/x "=" -zsh
        64⤵
        
        PID:1218
        
        /usr/local/bin/sh
        
        sh /tmp/x "=" -zsh
        64⤵
        
        PID:1218
        
        /usr/sbin/sh
        
        sh /tmp/x "=" -zsh
        64⤵
        
        PID:1218
        
        /usr/bin/sh
        
        sh /tmp/x "=" -zsh
        64⤵
        
        PID:1218
        
        /sbin/sh
        
        sh /tmp/x "=" -zsh
        64⤵
        
        PID:1218
        
        /bin/sh
        
        sh /tmp/x "=" -zsh
        64⤵
        Writes file to tmp directory
        
        PID:1218
        
        /usr/bin/curl
        
        curl --version
        65⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:1219
        
        /bin/mkdir
        
        mkdir -p /tmp
        65⤵
        Reads runtime system information
        
        PID:1220
        
        /bin/mktemp
        
        mktemp -t easy_clientXXX
        65⤵
        Writes file to tmp directory
        
        PID:1222
        
        /usr/bin/curl
        
        curl -k -f -s -S "https://easy.sh/client?client=easy&userMode=single&clientVersion="
        65⤵
        Reads runtime system information
        
        PID:1223

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

easy_clientyDl

Path /tmp/easy_clientyDl
Size 20KB
SHA256 631dd0454e812a00e58c48a21bf66193673f46892aaf8fd718e2f3a664c0fddc
MD5 e631c49e8329354adf068935ed544020
SHA1 4e076b77e18996489124949409bbeeed5052fa2e
SHA512 bd0888402fcf8a3e86df27bf2dbdbe1d0d20070199d363a0a7e8d94c13effacbfb8a924a7cf9f34d841efa5ba3584d0090c5238195fba40ff055caf0cade8369
SSDEEP 192:xSS2AT9iLMmEDvf8sfO5OJatNNsd8sVINEBeRexvlNyz6LQlnpcek9t:xSS2AT9iLzxDbNsKsVIGwexvlN7otk3
TLSH
T18692058678CD8DF00645E2A49F43F419B76951234A1EBC08BB6C6D4CEF53778A3F924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads