102bfe850243f122aa9bf9066c113d1832b7bec6547de230e5f084da5ef8121b

Analysis

max time kernel
124s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
11/10/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dissmpsl.elf
Size 270KB
Sample261011-b2gn4swt9m
SHA256 102bfe850243f122aa9bf9066c113d1832b7bec6547de230e5f084da5ef8121b
MD5 36b81bf6cd8bdfe46602ef3434d89eea
SHA1 b2930ca37545f19e3f3629e9619f75291e450b85
SHA512 4a5152473085661dca3f89f8d685cd7a2f5e1f5d59dc03e831d1cff119bb6e62208608162738ebb864b9be949501424d93bbcf76b214ff2b6901b8e456ad895b
SSDEEP 3072:YpK76P8rve/Zqoigxa3vd8IlU8Syzn3zaRZOQbG3qC:YpIlvKZqjgMjOMDBQbbC
TLSH
T19144B649ABA10EFBE8ABDE3306E90B0225CC650712A43F3A7A74D514F55B54F49E3C78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Modifies systemd 2 TTPs 64 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf
File opened for modification	/etc/systemd/system/systemd-resolved-helper.service	dissmpsl.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf
File opened for modification	/tmp/.kworker	dissmpsl.elf

/tmp/dissmpsl.elf
/tmp/dissmpsl.elf
1⤵
- Modifies systemd
PID:805
- /bin/sh
  sh /tmp/.kworker
  2⤵
  PID:807
- - /tmp/dissmpsl.elf
    /tmp/dissmpsl.elf
    3⤵
    - Writes file to tmp directory
    PID:812
  - - /bin/sh
      sh /tmp/.kworker
      4⤵
      PID:813
    - - /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        5⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:817
      - /bin/sh
        
        sh /tmp/.kworker
        6⤵
        
        PID:818
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        7⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:822
        
        /bin/sh
        
        sh /tmp/.kworker
        8⤵
        
        PID:824
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        9⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:828
        
        /bin/sh
        
        sh /tmp/.kworker
        10⤵
        
        PID:829
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        11⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:834
        
        /bin/sh
        
        sh /tmp/.kworker
        12⤵
        
        PID:836
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        13⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:840
        
        /bin/sh
        
        sh /tmp/.kworker
        14⤵
        
        PID:841
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        15⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:845
        
        /bin/sh
        
        sh /tmp/.kworker
        16⤵
        
        PID:866
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        17⤵
        Writes file to tmp directory
        
        PID:870
        
        /bin/sh
        
        sh /tmp/.kworker
        18⤵
        
        PID:871
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        19⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:873
        
        /bin/sh
        
        sh /tmp/.kworker
        20⤵
        
        PID:874
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        21⤵
        Modifies systemd
        
        PID:878
        
        /bin/sh
        
        sh /tmp/.kworker
        22⤵
        
        PID:879
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        23⤵
        Writes file to tmp directory
        
        PID:881
        
        /bin/sh
        
        sh /tmp/.kworker
        24⤵
        
        PID:883
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        25⤵
        Writes file to tmp directory
        
        PID:889
        
        /bin/sh
        
        sh /tmp/.kworker
        26⤵
        
        PID:890
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        27⤵
        Modifies systemd
        
        PID:893
        
        /bin/sh
        
        sh /tmp/.kworker
        28⤵
        
        PID:895
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        29⤵
        Modifies systemd
        
        PID:900
        
        /bin/sh
        
        sh /tmp/.kworker
        30⤵
        
        PID:902
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        31⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:905
        
        /bin/sh
        
        sh /tmp/.kworker
        32⤵
        
        PID:908
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        33⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:910
        
        /bin/sh
        
        sh /tmp/.kworker
        34⤵
        
        PID:911
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        35⤵
        Writes file to tmp directory
        
        PID:922
        
        /bin/sh
        
        sh /tmp/.kworker
        36⤵
        
        PID:923
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        37⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:928
        
        /bin/sh
        
        sh /tmp/.kworker
        38⤵
        
        PID:939
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        39⤵
        Writes file to tmp directory
        
        PID:947
        
        /bin/sh
        
        sh /tmp/.kworker
        40⤵
        
        PID:948
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        41⤵
        Modifies systemd
        
        PID:954
        
        /bin/sh
        
        sh /tmp/.kworker
        42⤵
        
        PID:955
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        43⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:960
        
        /bin/sh
        
        sh /tmp/.kworker
        44⤵
        
        PID:961
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        45⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:965
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        46⤵
        
        PID:967
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        47⤵
        Reads runtime system information
        
        PID:968
        
        /bin/sh
        
        sh /tmp/.kworker
        46⤵
        
        PID:966
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        47⤵
        Writes file to tmp directory
        
        PID:970
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        48⤵
        
        PID:972
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        49⤵
        Reads runtime system information
        
        PID:973
        
        /bin/sh
        
        sh /tmp/.kworker
        48⤵
        
        PID:971
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        49⤵
        
        PID:974
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        50⤵
        
        PID:977
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        51⤵
        
        PID:979
        
        /bin/sh
        
        sh /tmp/.kworker
        50⤵
        
        PID:976
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        51⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:978
        
        /bin/sh
        
        sh /tmp/.kworker
        52⤵
        
        PID:980
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        53⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:984
        
        /bin/sh
        
        sh /tmp/.kworker
        54⤵
        
        PID:985
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        55⤵
        Writes file to tmp directory
        
        PID:988
        
        /bin/sh
        
        sh /tmp/.kworker
        56⤵
        
        PID:990
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        57⤵
        Modifies systemd
        
        PID:993
        
        /bin/sh
        
        sh /tmp/.kworker
        58⤵
        
        PID:994
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        59⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:998
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        60⤵
        
        PID:1000
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        61⤵
        
        PID:1001
        
        /bin/sh
        
        sh /tmp/.kworker
        60⤵
        
        PID:999
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        61⤵
        Modifies systemd
        
        PID:1002
        
        /bin/sh
        
        sh /tmp/.kworker
        62⤵
        
        PID:1003
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        63⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1009
        
        /bin/sh
        
        sh /tmp/.kworker
        64⤵
        
        PID:1010
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        65⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1013
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        66⤵
        
        PID:1016
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        67⤵
        Reads runtime system information
        
        PID:1018
        
        /bin/sh
        
        sh /tmp/.kworker
        66⤵
        
        PID:1014
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        67⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1019
        
        /bin/sh
        
        sh /tmp/.kworker
        68⤵
        
        PID:1020
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        69⤵
        Modifies systemd
        
        PID:1039
        
        /bin/sh
        
        sh /tmp/.kworker
        70⤵
        
        PID:1041
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        71⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1043
        
        /bin/sh
        
        sh /tmp/.kworker
        72⤵
        
        PID:1045
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        73⤵
        Writes file to tmp directory
        
        PID:1048
        
        /bin/sh
        
        sh /tmp/.kworker
        74⤵
        
        PID:1049
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        75⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1053
        
        /bin/sh
        
        sh /tmp/.kworker
        76⤵
        
        PID:1054
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        77⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1058
        
        /bin/sh
        
        sh /tmp/.kworker
        78⤵
        
        PID:1059
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        79⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1061
        
        /bin/sh
        
        sh /tmp/.kworker
        80⤵
        
        PID:1063
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        81⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1066
        
        /bin/sh
        
        sh /tmp/.kworker
        82⤵
        
        PID:1068
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        83⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1071
        
        /bin/sh
        
        sh /tmp/.kworker
        84⤵
        
        PID:1072
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        85⤵
        Writes file to tmp directory
        
        PID:1075
        
        /bin/sh
        
        sh /tmp/.kworker
        86⤵
        
        PID:1077
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        87⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1081
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        88⤵
        
        PID:1084
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        89⤵
        Reads runtime system information
        
        PID:1085
        
        /bin/sh
        
        sh /tmp/.kworker
        88⤵
        
        PID:1083
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        89⤵
        Writes file to tmp directory
        
        PID:1086
        
        /bin/sh
        
        sh /tmp/.kworker
        90⤵
        
        PID:1087
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        91⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1090
        
        /bin/sh
        
        sh /tmp/.kworker
        92⤵
        
        PID:1091
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        93⤵
        
        PID:1094
        
        /bin/sh
        
        sh /tmp/.kworker
        94⤵
        
        PID:1096
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        95⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1111
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        96⤵
        
        PID:1118
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        97⤵
        
        PID:1119
        
        /bin/sh
        
        sh /tmp/.kworker
        96⤵
        
        PID:1117
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        97⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1120
        
        /bin/sh
        
        sh /tmp/.kworker
        98⤵
        
        PID:1121
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        99⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1124
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        100⤵
        
        PID:1126
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        101⤵
        Reads runtime system information
        
        PID:1127
        
        /bin/sh
        
        sh /tmp/.kworker
        100⤵
        
        PID:1125
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        101⤵
        Modifies systemd
        
        PID:1128
        
        /bin/sh
        
        sh /tmp/.kworker
        102⤵
        
        PID:1129
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        103⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1131
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        104⤵
        
        PID:1134
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        105⤵
        Reads runtime system information
        
        PID:1136
        
        /bin/sh
        
        sh /tmp/.kworker
        104⤵
        
        PID:1133
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        105⤵
        Modifies systemd
        
        PID:1137
        
        /bin/sh
        
        sh /tmp/.kworker
        106⤵
        
        PID:1138
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        107⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1140
        
        /bin/sh
        
        sh /tmp/.kworker
        108⤵
        
        PID:1142
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        109⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1144
        
        /bin/sh
        
        sh /tmp/.kworker
        110⤵
        
        PID:1145
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        111⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1151
        
        /bin/sh
        
        sh /tmp/.kworker
        112⤵
        
        PID:1152
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        113⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1155
        
        /bin/sh
        
        sh /tmp/.kworker
        114⤵
        
        PID:1156
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        115⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1159
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        116⤵
        
        PID:1162
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        117⤵
        Reads runtime system information
        
        PID:1163
        
        /bin/sh
        
        sh /tmp/.kworker
        116⤵
        
        PID:1161
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        117⤵
        Modifies systemd
        
        PID:1164
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        118⤵
        
        PID:1166
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        119⤵
        Reads runtime system information
        
        PID:1168
        
        /bin/sh
        
        sh /tmp/.kworker
        118⤵
        
        PID:1165
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        119⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1169
        
        /bin/sh
        
        sh /tmp/.kworker
        120⤵
        
        PID:1170
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        121⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1173
        
        /bin/sh
        
        sh /tmp/.kworker
        122⤵
        
        PID:1175
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        123⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1178
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        124⤵
        
        PID:1180
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        125⤵
        Reads runtime system information
        
        PID:1181
        
        /bin/sh
        
        sh /tmp/.kworker
        124⤵
        
        PID:1179
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        125⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1194
        
        /bin/sh
        
        sh /tmp/.kworker
        126⤵
        
        PID:1197
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        127⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1203
        
        /bin/sh
        
        sh /tmp/.kworker
        128⤵
        
        PID:1204
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        129⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1208
        
        /bin/sh
        
        sh /tmp/.kworker
        130⤵
        
        PID:1209
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        131⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1211
        
        /bin/sh
        
        sh /tmp/.kworker
        132⤵
        
        PID:1212
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        133⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1215
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        134⤵
        
        PID:1218
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        135⤵
        Reads runtime system information
        
        PID:1220
        
        /bin/sh
        
        sh /tmp/.kworker
        134⤵
        
        PID:1217
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        135⤵
        Modifies systemd
        
        PID:1219
        
        /bin/sh
        
        sh /tmp/.kworker
        136⤵
        
        PID:1221
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        137⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1224
        
        /bin/sh
        
        sh /tmp/.kworker
        138⤵
        
        PID:1226
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        139⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1229
        
        /bin/sh
        
        sh /tmp/.kworker
        140⤵
        
        PID:1230
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        141⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1233
        
        /bin/sh
        
        sh /tmp/.kworker
        142⤵
        
        PID:1234
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        143⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1237
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        144⤵
        
        PID:1239
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        145⤵
        
        PID:1240
        
        /bin/sh
        
        sh /tmp/.kworker
        144⤵
        
        PID:1238
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        145⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1241
        
        /bin/sh
        
        sh /tmp/.kworker
        146⤵
        
        PID:1242
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        147⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1245
        
        /bin/sh
        
        sh /tmp/.kworker
        148⤵
        
        PID:1246
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        149⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1248
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        150⤵
        
        PID:1251
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        151⤵
        
        PID:1252
        
        /bin/sh
        
        sh /tmp/.kworker
        150⤵
        
        PID:1250
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        151⤵
        
        PID:1254
        
        /bin/sh
        
        sh /tmp/.kworker
        152⤵
        
        PID:1255
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        153⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1279
        
        /bin/sh
        
        sh /tmp/.kworker
        154⤵
        
        PID:1280
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        155⤵
        Writes file to tmp directory
        
        PID:1288
        
        /bin/sh
        
        sh /tmp/.kworker
        156⤵
        
        PID:1293
        
        /tmp/dissmpsl.elf
        
        /tmp/dissmpsl.elf
        157⤵
        Modifies systemd
        Writes file to tmp directory
        
        PID:1300
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        156⤵
        
        PID:1297
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        154⤵
        
        PID:1281
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        155⤵
        
        PID:1292
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        152⤵
        
        PID:1256
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        153⤵
        
        PID:1272
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        148⤵
        
        PID:1247
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        149⤵
        Reads runtime system information
        
        PID:1249
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        146⤵
        
        PID:1243
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        147⤵
        Reads runtime system information
        
        PID:1244
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        142⤵
        
        PID:1235
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        143⤵
        Reads runtime system information
        
        PID:1236
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        140⤵
        
        PID:1231
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        141⤵
        Reads runtime system information
        
        PID:1232
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        138⤵
        
        PID:1227
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        139⤵
        
        PID:1228
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        136⤵
        
        PID:1222
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        137⤵
        Reads runtime system information
        
        PID:1223
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        132⤵
        
        PID:1214
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        133⤵
        Reads runtime system information
        
        PID:1216
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        130⤵
        
        PID:1210
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        131⤵
        Reads runtime system information
        
        PID:1213
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        128⤵
        
        PID:1206
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        129⤵
        Reads runtime system information
        
        PID:1207
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        126⤵
        
        PID:1198
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        127⤵
        Reads runtime system information
        
        PID:1202
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        122⤵
        
        PID:1176
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        123⤵
        Reads runtime system information
        
        PID:1177
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        120⤵
        
        PID:1171
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        121⤵
        Reads runtime system information
        
        PID:1172
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        114⤵
        
        PID:1157
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        115⤵
        Reads runtime system information
        
        PID:1158
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        112⤵
        
        PID:1153
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        113⤵
        Reads runtime system information
        
        PID:1154
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        110⤵
        
        PID:1146
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        111⤵
        Reads runtime system information
        
        PID:1148
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        108⤵
        
        PID:1149
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        109⤵
        Reads runtime system information
        
        PID:1150
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        106⤵
        
        PID:1139
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        107⤵
        
        PID:1141
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        102⤵
        
        PID:1130
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        103⤵
        Reads runtime system information
        
        PID:1132
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        98⤵
        
        PID:1122
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        99⤵
        Reads runtime system information
        
        PID:1123
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        94⤵
        
        PID:1098
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        95⤵
        
        PID:1112
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        92⤵
        
        PID:1092
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        93⤵
        
        PID:1095
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        90⤵
        
        PID:1088
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        91⤵
        Reads runtime system information
        
        PID:1089
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        86⤵
        
        PID:1078
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        87⤵
        
        PID:1080
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        84⤵
        
        PID:1073
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        85⤵
        Reads runtime system information
        
        PID:1076
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        82⤵
        
        PID:1069
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        83⤵
        
        PID:1070
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        80⤵
        
        PID:1064
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        81⤵
        Reads runtime system information
        
        PID:1067
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        78⤵
        
        PID:1060
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        79⤵
        Reads runtime system information
        
        PID:1062
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        76⤵
        
        PID:1055
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        77⤵
        Reads runtime system information
        
        PID:1056
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        74⤵
        
        PID:1050
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        75⤵
        Reads runtime system information
        
        PID:1052
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        72⤵
        
        PID:1046
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        73⤵
        Reads runtime system information
        
        PID:1047
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        70⤵
        
        PID:1042
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        71⤵
        Reads runtime system information
        
        PID:1044
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        68⤵
        
        PID:1031
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        69⤵
        Reads runtime system information
        
        PID:1038
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        64⤵
        
        PID:1011
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        65⤵
        Reads runtime system information
        
        PID:1012
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        62⤵
        
        PID:1005
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        63⤵
        Reads runtime system information
        
        PID:1008
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        58⤵
        
        PID:995
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        59⤵
        Reads runtime system information
        
        PID:997
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        56⤵
        
        PID:991
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        57⤵
        
        PID:992
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        54⤵
        
        PID:986
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        55⤵
        Reads runtime system information
        
        PID:987
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        52⤵
        
        PID:981
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        53⤵
        Reads runtime system information
        
        PID:983
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        44⤵
        
        PID:962
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        45⤵
        Reads runtime system information
        
        PID:963
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        42⤵
        
        PID:956
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        43⤵
        Reads runtime system information
        
        PID:959
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        40⤵
        
        PID:949
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        41⤵
        Reads runtime system information
        
        PID:957
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        38⤵
        
        PID:944
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        39⤵
        
        PID:946
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        36⤵
        
        PID:925
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        37⤵
        Reads runtime system information
        
        PID:927
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        36⤵
        
        PID:1294
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        37⤵
        
        PID:1302
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        34⤵
        
        PID:912
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        35⤵
        Reads runtime system information
        
        PID:921
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        34⤵
        
        PID:1298
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        32⤵
        
        PID:909
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        33⤵
        Reads runtime system information
        
        PID:919
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        32⤵
        
        PID:1299
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        30⤵
        
        PID:903
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        31⤵
        Reads runtime system information
        
        PID:906
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        30⤵
        
        PID:1303
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        28⤵
        
        PID:896
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        29⤵
        
        PID:901
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        28⤵
        
        PID:1295
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        29⤵
        
        PID:1301
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        26⤵
        
        PID:891
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        27⤵
        Reads runtime system information
        
        PID:894
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        26⤵
        
        PID:1283
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        27⤵
        
        PID:1289
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        24⤵
        
        PID:885
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        25⤵
        Reads runtime system information
        
        PID:887
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        24⤵
        
        PID:1282
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        25⤵
        
        PID:1291
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        22⤵
        
        PID:880
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        23⤵
        Reads runtime system information
        
        PID:882
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        22⤵
        
        PID:1284
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        23⤵
        
        PID:1290
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        20⤵
        
        PID:876
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        21⤵
        Reads runtime system information
        
        PID:877
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        20⤵
        
        PID:1258
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        21⤵
        Reads runtime system information
        
        PID:1271
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        18⤵
        
        PID:872
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        19⤵
        Reads runtime system information
        
        PID:875
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        18⤵
        
        PID:1257
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        19⤵
        
        PID:1270
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        16⤵
        
        PID:867
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        17⤵
        Reads runtime system information
        
        PID:869
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        16⤵
        
        PID:1274
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        17⤵
        
        PID:1278
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        14⤵
        
        PID:842
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        15⤵
        Reads runtime system information
        
        PID:846
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        14⤵
        
        PID:1253
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        15⤵
        
        PID:1260
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        12⤵
        
        PID:837
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        13⤵
        Reads runtime system information
        
        PID:839
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        10⤵
        
        PID:830
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        11⤵
        Reads runtime system information
        
        PID:835
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        10⤵
        
        PID:1259
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        11⤵
        
        PID:1277
        
        /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        8⤵
        
        PID:825
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        9⤵
        Reads runtime system information
        
        PID:827
        
        /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        8⤵
        
        PID:1097
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        9⤵
        Reads runtime system information
        
        PID:1110
      - /bin/sh
        
        sh -c "systemctl daemon-reload >/dev/null 2>&1"
        6⤵
        
        PID:820
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        Reads runtime system information
        
        PID:823
      - /bin/sh
        
        sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
        6⤵
        
        PID:1191
        
        /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        7⤵
        
        PID:1196
  - - /bin/sh
      sh -c "systemctl daemon-reload >/dev/null 2>&1"
      4⤵
      PID:814
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Reads runtime system information
        
        PID:816
  - - /bin/sh
      sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
      4⤵
      PID:917
    - - /usr/bin/systemctl
        
        systemctl enable systemd-resolved-helper.service
        5⤵
        Reads runtime system information
        
        PID:924
  - - /bin/sh
      sh -c "systemctl start systemd-resolved-helper.service >/dev/null 2>&1"
      4⤵
      PID:1296
- /bin/sh
  sh -c "systemctl daemon-reload >/dev/null 2>&1"
  2⤵
  PID:808
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:811
- /bin/sh
  sh -c "systemctl enable systemd-resolved-helper.service >/dev/null 2>&1"
  2⤵
  PID:1017
- - /usr/bin/systemctl
    systemctl enable systemd-resolved-helper.service
    3⤵
    - Reads runtime system information
    PID:1037

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd-resolved-helper.service

Path /etc/systemd/system/systemd-resolved-helper.service
Size 282B
SHA256 4dac3d0b0b58e30fde168c15f5709c5b130d967cc1c7fba014e3080cb6ebda03
MD5 a6df90e3b6b6058115cd711c505ff922
SHA1 a5dab49166545644a6ed6f0b73d1c7d13032eaa6
SHA512 a47bce5c129dbf93c211a4e92ca7dbb7195f1b77296c2c11638b827abde0b9f52c0e8c4ba8d435e410f528680b8d4d3e6404b4b58153bd3cbdd352ca91ea7319
TLSH
T1D3D02B62AF2114C2C98934F68DE7EFA5CD143049A6CE4A7426E51F174FD7A86803059F
MD5 SHA1 SHA512 TLSH

Submit Download

.kworker

Path /tmp/.kworker
Size 131B
SHA256 cd7355c43bb5274f223e6887257a5ea4c139bc5384d7a30ae68077dd4d86d719
MD5 04b7115ac91a0a3b229f39a1a288d957
SHA1 3bc9a20f713b770a2d7e7bf78ad9eb998f5b7641
SHA512 2c96cc67bd1ada7ef68960cf027cd472046d6308a19b4092d92e1a369391bc69439b6ded2ce16d0530ca788f1dc540b706c8b20659ac1aa9bec01448d9efff6b
TLSH
T114C02B14D0000E20207440BCCC0CB4D4000130239CB62040F9CE3874AF382106AA2385
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads