e70289fc6447f602170549811635e82a9bdd3b85ea32c3f4eea140366acc00b3

Analysis

max time kernel
148s
max time network
148s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20/10/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cams.sh
Size 3KB
Sample261020-xd8zcatyes
SHA256 e70289fc6447f602170549811635e82a9bdd3b85ea32c3f4eea140366acc00b3
MD5 7cd2c75c1ad8a40baea80f8267ee11ca
SHA1 e50fdaf9f0fa6c9fd0ae25a6f073e8674c857c7c
SHA512 137675a05a68044acb1c07b1572067ebf4a786951ffd0236c89ad5b3a2bd9f8791eb2652a636c9a41b26cfac9153671fd3de378d9a82532adc36c8e9799a263e
TLSH
T10A712FF9B8328EA1B8C9007BBC6AB1999983C97B06542552A1C7EC74F13F808F176630
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2285	Process not Found
2298	Process not Found
2310	Process not Found
2327	Process not Found
2328	Process not Found
2343	Process not Found
2350	Process not Found
2357	Process not Found
2286	Process not Found
2292	Process not Found
2304	Process not Found
2316	Process not Found
2335	Process not Found
2364	Process not Found

Executes dropped EXE 24 IoCs

ioc	pid	Process
/tmp/.r2	2287	cams.sh
/tmp/.r2	2289	Process not Found
/var/tmp/.r2	2293	cams.sh
/var/tmp/.r2	2296	Process not Found
/dev/.r2	2299	cams.sh
/dev/.r2	2302	Process not Found
/dev/shm/.r2	2305	cams.sh
/dev/shm/.r2	2308	Process not Found
/opt/.r2	2311	cams.sh
/opt/.r2	2314	Process not Found
/mnt/.r2	2317	cams.sh
/mnt/.r2	2320	Process not Found
/tmp/.r1	2329	cams.sh
/tmp/.r1	2332	Process not Found
/var/tmp/.r1	2336	cams.sh
/var/tmp/.r1	2339	Process not Found
/dev/.r1	2344	cams.sh
/dev/.r1	2347	Process not Found
/dev/shm/.r1	2351	cams.sh
/dev/shm/.r1	2354	Process not Found
/opt/.r1	2358	cams.sh
/opt/.r1	2361	Process not Found
/mnt/.r1	2365	cams.sh
/mnt/.r1	2368	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/19/cmdline	cat
File opened for reading	/proc/4/cmdline	cat
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/160/cmdline	cat
File opened for reading	/proc/721/cmdline	cat
File opened for reading	/proc/9/cmdline	cat
File opened for reading	/proc/447/cmdline	cat
File opened for reading	/proc/73/cmdline	Process not Found
File opened for reading	/proc/177/cmdline	cat
File opened for reading	/proc/18/cmdline	cat
File opened for reading	/proc/339/cmdline	cat
File opened for reading	/proc/12/cmdline	cat
File opened for reading	/proc/70/cmdline	cat
File opened for reading	/proc/399/cmdline	cat
File opened for reading	/proc/17/cmdline	cat
File opened for reading	/proc/342/cmdline	cat
File opened for reading	/proc/722/cmdline	cat
File opened for reading	/proc/347/cmdline	Process not Found
File opened for reading	/proc/79/cmdline	Process not Found
File opened for reading	/proc/8/cmdline	Process not Found
File opened for reading	/proc/12/cmdline	cat
File opened for reading	/proc/1205/cmdline	cat
File opened for reading	/proc/345/cmdline	cat
File opened for reading	/proc/691/cmdline	cat
File opened for reading	/proc/157/cmdline	cat
File opened for reading	/proc/177/cmdline	cat
File opened for reading	/proc/20/cmdline	Process not Found
File opened for reading	/proc/20/cmdline	cat
File opened for reading	/proc/36/cmdline	cat
File opened for reading	/proc/10/cmdline	cat
File opened for reading	/proc/127/cmdline	Process not Found
File opened for reading	/proc/341/cmdline	Process not Found
File opened for reading	/proc/36/cmdline	Process not Found
File opened for reading	/proc/157/cmdline	cat
File opened for reading	/proc/342/cmdline	cat
File opened for reading	/proc/69/cmdline	cat
File opened for reading	/proc/447/cmdline	cat
File opened for reading	/proc/399/cmdline	Process not Found
File opened for reading	/proc/677/cmdline	Process not Found
File opened for reading	/proc/72/cmdline	Process not Found
File opened for reading	/proc/237/cmdline	cat
File opened for reading	/proc/37/cmdline	cat
File opened for reading	/proc/70/cmdline	cat
File opened for reading	/proc/76/cmdline	cat
File opened for reading	/proc/13/cmdline	cat
File opened for reading	/proc/19/cmdline	cat
File opened for reading	/proc/2/cmdline	cat
File opened for reading	/proc/685/cmdline	cat
File opened for reading	/proc/160/cmdline	cat
File opened for reading	/proc/37/cmdline	cat
File opened for reading	/proc/72/cmdline	cat
File opened for reading	/proc/394/cmdline	cat
File opened for reading	/proc/74/cmdline	cat
File opened for reading	/proc/69/cmdline	cat
File opened for reading	/proc/82/cmdline	cat
File opened for reading	/proc/16/cmdline	Process not Found
File opened for reading	/proc/677/cmdline	cat
File opened for reading	/proc/11/cmdline	cat
File opened for reading	/proc/73/cmdline	cat
File opened for reading	/proc/14/cmdline	Process not Found
File opened for reading	/proc/19/cmdline	Process not Found
File opened for reading	/proc/21/cmdline	cat
File opened for reading	/proc/688/cmdline	cat
File opened for reading	/proc/76/cmdline	cat

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
2277	Process not Found
2281	Process not Found
2284	Process not Found
2325	Process not Found

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.r2	Process not Found
File opened for modification	/dev/shm/.r1	Process not Found

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r1	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r2	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found

/tmp/cams.sh
/tmp/cams.sh
1⤵
- Executes dropped EXE
PID:725
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:736
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/126/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/127/exe
  2⤵
  PID:741
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:743
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:745
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:747
- /bin/readlink
  readlink /proc/157/exe
  2⤵
  PID:748
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:750
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:753
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:754
- /bin/readlink
  readlink /proc/177/exe
  2⤵
  PID:756
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:758
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:760
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:762
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:763
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:765
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:766
- /bin/readlink
  readlink /proc/237/exe
  2⤵
  PID:768
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:769
- /bin/readlink
  readlink /proc/253/exe
  2⤵
  PID:770
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:771
- /bin/readlink
  readlink /proc/339/exe
  2⤵
  PID:773
- /bin/readlink
  readlink /proc/341/exe
  2⤵
  PID:774
- /bin/readlink
  readlink /proc/342/exe
  2⤵
  PID:776
- /bin/readlink
  readlink /proc/345/exe
  2⤵
  PID:778
- /bin/readlink
  readlink /proc/347/exe
  2⤵
  PID:779
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:780
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:781
- /bin/readlink
  readlink /proc/393/exe
  2⤵
  PID:783
- /bin/readlink
  readlink /proc/394/exe
  2⤵
  PID:784
- /bin/readlink
  readlink /proc/399/exe
  2⤵
  PID:785
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:786
- /bin/readlink
  readlink /proc/447/exe
  2⤵
  PID:787
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:788
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:789
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:790
- /bin/readlink
  readlink /proc/685/exe
  2⤵
  PID:792
- /bin/readlink
  readlink /proc/688/exe
  2⤵
  PID:793
- /bin/readlink
  readlink /proc/69/exe
  2⤵
  PID:794
- /bin/readlink
  readlink /proc/690/exe
  2⤵
  PID:795
- /bin/readlink
  readlink /proc/691/exe
  2⤵
  PID:796
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:797
- /bin/readlink
  readlink /proc/70/exe
  2⤵
  PID:798
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:799
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:800
- /bin/readlink
  readlink /proc/716/exe
  2⤵
  PID:801
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:802
- /bin/readlink
  readlink /proc/721/exe
  2⤵
  PID:803
- /bin/readlink
  readlink /proc/722/exe
  2⤵
  PID:804
- /bin/readlink
  readlink /proc/723/exe
  2⤵
  PID:805
- /bin/readlink
  readlink /proc/725/exe
  2⤵
  PID:806
- /bin/readlink
  readlink /proc/726/exe
  2⤵
  PID:807
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:808
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:809
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:810
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:811
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:812
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:813
- /bin/readlink
  readlink /proc/81/exe
  2⤵
  PID:814
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:815
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:816
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:817
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:818
- /bin/grep
  grep -q .ghl
  2⤵
  PID:819
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:821
- /bin/grep
  grep -q .ghl
  2⤵
  PID:822
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:820
- /bin/grep
  grep -q .ghl
  2⤵
  PID:825
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:824
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:823
- /bin/grep
  grep -q .ghl
  2⤵
  PID:828
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:827
- /bin/cat
  cat /proc/110/cmdline
  2⤵
  PID:826
- /bin/grep
  grep -q .ghl
  2⤵
  PID:831
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:830
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  - Reads runtime system information
  PID:829
- /bin/grep
  grep -q .ghl
  2⤵
  PID:834
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:833
- /bin/cat
  cat /proc/126/cmdline
  2⤵
  PID:832
- /bin/grep
  grep -q .ghl
  2⤵
  PID:837
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:836
- /bin/cat
  cat /proc/127/cmdline
  2⤵
  PID:835
- /bin/grep
  grep -q .ghl
  2⤵
  PID:840
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:839
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:838
- /bin/grep
  grep -q .ghl
  2⤵
  PID:843
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:842
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:841
- /bin/grep
  grep -q .ghl
  2⤵
  PID:846
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:845
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:844
- /bin/grep
  grep -q .ghl
  2⤵
  PID:849
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:848
- /bin/cat
  cat /proc/157/cmdline
  2⤵
  - Reads runtime system information
  PID:847
- /bin/grep
  grep -q .ghl
  2⤵
  PID:852
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:851
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:850
- /bin/grep
  grep -q .ghl
  2⤵
  PID:855
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:854
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  PID:853
- /bin/grep
  grep -q .ghl
  2⤵
  PID:858
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:857
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:856
- /bin/cat
  cat /proc/177/cmdline
  2⤵
  PID:859
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:860
- /bin/grep
  grep -q .ghl
  2⤵
  PID:861
- /bin/grep
  grep -q .ghl
  2⤵
  PID:864
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:863
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:862
- /bin/grep
  grep -q .ghl
  2⤵
  PID:867
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:866
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  PID:865
- /bin/grep
  grep -q .ghl
  2⤵
  PID:870
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:869
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  - Reads runtime system information
  PID:868
- /bin/grep
  grep -q .ghl
  2⤵
  PID:873
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:872
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:871
- /bin/grep
  grep -q .ghl
  2⤵
  PID:876
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:875
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  - Reads runtime system information
  PID:874
- /bin/grep
  grep -q .ghl
  2⤵
  PID:879
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:878
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:877
- /bin/grep
  grep -q .ghl
  2⤵
  PID:882
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:881
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:880
- /bin/grep
  grep -q .ghl
  2⤵
  PID:885
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:884
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:883
- /bin/grep
  grep -q .ghl
  2⤵
  PID:888
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:887
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:886
- /bin/grep
  grep -q .ghl
  2⤵
  PID:891
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:890
- /bin/cat
  cat /proc/253/cmdline
  2⤵
  PID:889
- /bin/grep
  grep -q .ghl
  2⤵
  PID:894
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:893
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:892
- /bin/grep
  grep -q .ghl
  2⤵
  PID:897
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:896
- /bin/cat
  cat /proc/339/cmdline
  2⤵
  PID:895
- /bin/grep
  grep -q .ghl
  2⤵
  PID:900
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:899
- /bin/cat
  cat /proc/341/cmdline
  2⤵
  PID:898
- /bin/grep
  grep -q .ghl
  2⤵
  PID:903
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:902
- /bin/cat
  cat /proc/342/cmdline
  2⤵
  PID:901
- /bin/grep
  grep -q .ghl
  2⤵
  PID:906
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:905
- /bin/cat
  cat /proc/345/cmdline
  2⤵
  PID:904
- /bin/grep
  grep -q .ghl
  2⤵
  PID:909
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:908
- /bin/cat
  cat /proc/347/cmdline
  2⤵
  PID:907
- /bin/grep
  grep -q .ghl
  2⤵
  PID:912
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:911
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:910
- /bin/grep
  grep -q .ghl
  2⤵
  PID:915
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:914
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  PID:913
- /bin/grep
  grep -q .ghl
  2⤵
  PID:918
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:917
- /bin/cat
  cat /proc/393/cmdline
  2⤵
  PID:916
- /bin/grep
  grep -q .ghl
  2⤵
  PID:921
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:920
- /bin/cat
  cat /proc/394/cmdline
  2⤵
  PID:919
- /bin/grep
  grep -q .ghl
  2⤵
  PID:924
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:923
- /bin/cat
  cat /proc/399/cmdline
  2⤵
  PID:922
- /bin/grep
  grep -q .ghl
  2⤵
  PID:927
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:926
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:925
- /bin/grep
  grep -q .ghl
  2⤵
  PID:930
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:929
- /bin/cat
  cat /proc/447/cmdline
  2⤵
  PID:928
- /bin/grep
  grep -q .ghl
  2⤵
  PID:933
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:932
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  PID:931
- /bin/grep
  grep -q .ghl
  2⤵
  PID:936
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:935
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:934
- /bin/grep
  grep -q .ghl
  2⤵
  PID:939
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:938
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  - Reads runtime system information
  PID:937
- /bin/grep
  grep -q .ghl
  2⤵
  PID:942
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:941
- /bin/cat
  cat /proc/685/cmdline
  2⤵
  - Reads runtime system information
  PID:940
- /bin/grep
  grep -q .ghl
  2⤵
  PID:945
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:944
- /bin/cat
  cat /proc/688/cmdline
  2⤵
  - Reads runtime system information
  PID:943
- /bin/grep
  grep -q .ghl
  2⤵
  PID:948
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:947
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  PID:946
- /bin/grep
  grep -q .ghl
  2⤵
  PID:951
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:950
- /bin/cat
  cat /proc/690/cmdline
  2⤵
  PID:949
- /bin/grep
  grep -q .ghl
  2⤵
  PID:954
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:953
- /bin/cat
  cat /proc/691/cmdline
  2⤵
  PID:952
- /bin/grep
  grep -q .ghl
  2⤵
  PID:957
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:956
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:955
- /bin/grep
  grep -q .ghl
  2⤵
  PID:960
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:959
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  PID:958
- /bin/grep
  grep -q .ghl
  2⤵
  PID:963
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:962
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:961
- /bin/grep
  grep -q .ghl
  2⤵
  PID:966
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:965
- /bin/cat
  cat /proc/714/cmdline
  2⤵
  PID:964
- /bin/grep
  grep -q .ghl
  2⤵
  PID:969
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:968
- /bin/cat
  cat /proc/716/cmdline
  2⤵
  PID:967
- /bin/grep
  grep -q .ghl
  2⤵
  PID:972
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:971
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  PID:970
- /bin/grep
  grep -q .ghl
  2⤵
  PID:975
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:974
- /bin/cat
  cat /proc/721/cmdline
  2⤵
  - Reads runtime system information
  PID:973
- /bin/grep
  grep -q .ghl
  2⤵
  PID:978
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:977
- /bin/cat
  cat /proc/722/cmdline
  2⤵
  PID:976
- /bin/grep
  grep -q .ghl
  2⤵
  PID:981
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:980
- /bin/cat
  cat /proc/723/cmdline
  2⤵
  PID:979
- /bin/grep
  grep -q .ghl
  2⤵
  PID:984
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:983
- /bin/cat
  cat /proc/725/cmdline
  2⤵
  PID:982
- /bin/grep
  grep -q .ghl
  2⤵
  PID:987
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:986
- /bin/cat
  cat /proc/728/cmdline
  2⤵
  PID:985
- /bin/grep
  grep -q .ghl
  2⤵
  PID:990
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:989
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  PID:988
- /bin/grep
  grep -q .ghl
  2⤵
  PID:993
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:992
- /bin/cat
  cat /proc/730/cmdline
  2⤵
  PID:991
- /bin/grep
  grep -q .ghl
  2⤵
  PID:997
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:996
- /bin/cat
  cat /proc/74/cmdline
  2⤵
  PID:995
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1001
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1000
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  PID:999
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1004
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1003
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:1002
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1007
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1006
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  PID:1005
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1011
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1010
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  PID:1009
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1014
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1013
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  PID:1012
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1018
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1017
- /bin/cat
  cat /proc/82/cmdline
  2⤵
  PID:1016
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1021
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1020
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  - Reads runtime system information
  PID:1019
- /bin/grep
  grep -q .g3
  2⤵
  PID:1025
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1024
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1023
- /bin/grep
  grep -q .g3
  2⤵
  PID:1029
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1028
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:1027
- /bin/grep
  grep -q .g3
  2⤵
  PID:1032
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1031
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  - Reads runtime system information
  PID:1030
- /bin/grep
  grep -q .g3
  2⤵
  PID:1035
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1034
- /bin/cat
  cat /proc/110/cmdline
  2⤵
  PID:1033
- /bin/grep
  grep -q .g3
  2⤵
  PID:1039
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1038
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  - Reads runtime system information
  PID:1037
- /bin/grep
  grep -q .g3
  2⤵
  PID:1043
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1042
- /bin/cat
  cat /proc/126/cmdline
  2⤵
  PID:1041
- /bin/grep
  grep -q .g3
  2⤵
  PID:1046
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1045
- /bin/cat
  cat /proc/127/cmdline
  2⤵
  PID:1044
- /bin/grep
  grep -q .g3
  2⤵
  PID:1050
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1049
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:1048
- /bin/grep
  grep -q .g3
  2⤵
  PID:1054
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1053
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1052
- /bin/grep
  grep -q .g3
  2⤵
  PID:1057
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1056
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1055
- /bin/grep
  grep -q .g3
  2⤵
  PID:1060
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1059
- /bin/cat
  cat /proc/157/cmdline
  2⤵
  PID:1058
- /bin/grep
  grep -q .g3
  2⤵
  PID:1064
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1063
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:1062
- /bin/grep
  grep -q .g3
  2⤵
  PID:1068
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1067
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  PID:1066
- /bin/grep
  grep -q .g3
  2⤵
  PID:1071
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1070
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:1069
- /bin/grep
  grep -q .g3
  2⤵
  PID:1074
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1073
- /bin/cat
  cat /proc/177/cmdline
  2⤵
  - Reads runtime system information
  PID:1072
- /bin/grep
  grep -q .g3
  2⤵
  PID:1078
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1077
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  - Reads runtime system information
  PID:1076
- /bin/grep
  grep -q .g3
  2⤵
  PID:1082
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1081
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  PID:1080
- /bin/grep
  grep -q .g3
  2⤵
  PID:1085
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1084
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1083
- /bin/grep
  grep -q .g3
  2⤵
  PID:1088
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1087
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  - Reads runtime system information
  PID:1086
- /bin/grep
  grep -q .g3
  2⤵
  PID:1092
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1091
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1090
- /bin/grep
  grep -q .g3
  2⤵
  PID:1096
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1095
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:1094
- /bin/grep
  grep -q .g3
  2⤵
  PID:1099
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1098
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1097
- /bin/grep
  grep -q .g3
  2⤵
  PID:1102
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1101
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:1100
- /bin/grep
  grep -q .g3
  2⤵
  PID:1106
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1105
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:1104
- /bin/grep
  grep -q .g3
  2⤵
  PID:1110
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1109
- /bin/cat
  cat /proc/253/cmdline
  2⤵
  PID:1108
- /bin/grep
  grep -q .g3
  2⤵
  PID:1113
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1112
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1111
- /bin/grep
  grep -q .g3
  2⤵
  PID:1116
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1115
- /bin/cat
  cat /proc/339/cmdline
  2⤵
  - Reads runtime system information
  PID:1114
- /bin/grep
  grep -q .g3
  2⤵
  PID:1120
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1119
- /bin/cat
  cat /proc/341/cmdline
  2⤵
  PID:1118
- /bin/grep
  grep -q .g3
  2⤵
  PID:1124
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1123
- /bin/cat
  cat /proc/342/cmdline
  2⤵
  - Reads runtime system information
  PID:1122
- /bin/grep
  grep -q .g3
  2⤵
  PID:1127
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1126
- /bin/cat
  cat /proc/345/cmdline
  2⤵
  PID:1125
- /bin/grep
  grep -q .g3
  2⤵
  PID:1130
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1129
- /bin/cat
  cat /proc/347/cmdline
  2⤵
  PID:1128
- /bin/grep
  grep -q .g3
  2⤵
  PID:1134
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1133
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  - Reads runtime system information
  PID:1132
- /bin/grep
  grep -q .g3
  2⤵
  PID:1138
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1137
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  - Reads runtime system information
  PID:1136
- /bin/grep
  grep -q .g3
  2⤵
  PID:1141
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1140
- /bin/cat
  cat /proc/393/cmdline
  2⤵
  PID:1139
- /bin/grep
  grep -q .g3
  2⤵
  PID:1144
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1143
- /bin/cat
  cat /proc/394/cmdline
  2⤵
  PID:1142
- /bin/grep
  grep -q .g3
  2⤵
  PID:1148
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1147
- /bin/cat
  cat /proc/399/cmdline
  2⤵
  PID:1146
- /bin/grep
  grep -q .g3
  2⤵
  PID:1152
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1151
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  - Reads runtime system information
  PID:1150
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1156
- /bin/cat
  cat /proc/447/cmdline
  2⤵
  PID:1155
- /bin/grep
  grep -q .g3
  2⤵
  PID:1157
- /bin/grep
  grep -q .g3
  2⤵
  PID:1160
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1159
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  PID:1158
- /bin/grep
  grep -q .g3
  2⤵
  PID:1164
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1163
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:1162
- /bin/grep
  grep -q .g3
  2⤵
  PID:1167
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1166
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:1165
- /bin/grep
  grep -q .g3
  2⤵
  PID:1171
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1170
- /bin/cat
  cat /proc/685/cmdline
  2⤵
  PID:1169
- /bin/grep
  grep -q .g3
  2⤵
  PID:1174
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1173
- /bin/cat
  cat /proc/688/cmdline
  2⤵
  PID:1172
- /bin/grep
  grep -q .g3
  2⤵
  PID:1178
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1177
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  PID:1176
- /bin/grep
  grep -q .g3
  2⤵
  PID:1181
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1180
- /bin/cat
  cat /proc/690/cmdline
  2⤵
  PID:1179
- /bin/grep
  grep -q .g3
  2⤵
  PID:1186
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1185
- /bin/cat
  cat /proc/691/cmdline
  2⤵
  PID:1184
- /bin/grep
  grep -q .g3
  2⤵
  PID:1190
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1189
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1188
- /bin/grep
  grep -q .g3
  2⤵
  PID:1193
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1192
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  - Reads runtime system information
  PID:1191
- /bin/grep
  grep -q .g3
  2⤵
  PID:1196
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1195
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:1194
- /bin/grep
  grep -q .g3
  2⤵
  PID:1200
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1199
- /bin/cat
  cat /proc/714/cmdline
  2⤵
  PID:1198
- /bin/grep
  grep -q .g3
  2⤵
  PID:1204
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1203
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  PID:1202
- /bin/grep
  grep -q .g3
  2⤵
  PID:1208
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1207
- /bin/cat
  cat /proc/721/cmdline
  2⤵
  PID:1206
- /bin/grep
  grep -q .g3
  2⤵
  PID:1213
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1212
- /bin/cat
  cat /proc/722/cmdline
  2⤵
  PID:1211
- /bin/grep
  grep -q .g3
  2⤵
  PID:1217
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1216
- /bin/cat
  cat /proc/723/cmdline
  2⤵
  PID:1215
- /bin/grep
  grep -q .g3
  2⤵
  PID:1220
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1219
- /bin/cat
  cat /proc/725/cmdline
  2⤵
  PID:1218
- /bin/grep
  grep -q .g3
  2⤵
  PID:1223
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1222
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  - Reads runtime system information
  PID:1221
- /bin/grep
  grep -q .g3
  2⤵
  PID:1227
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1226
- /bin/cat
  cat /proc/730/cmdline
  2⤵
  PID:1225
- /bin/grep
  grep -q .g3
  2⤵
  PID:1231
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1230
- /bin/cat
  cat /proc/74/cmdline
  2⤵
  PID:1229
- /bin/grep
  grep -q .g3
  2⤵
  PID:1234
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1233
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  PID:1232
- /bin/grep
  grep -q .g3
  2⤵
  PID:1238
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1237
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:1236
- /bin/grep
  grep -q .g3
  2⤵
  PID:1242
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1241
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  PID:1240
- /bin/grep
  grep -q .g3
  2⤵
  PID:1246
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1245
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  PID:1244
- /bin/grep
  grep -q .g3
  2⤵
  PID:1249
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1248
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  PID:1247
- /bin/grep
  grep -q .g3
  2⤵
  PID:1252
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1251
- /bin/cat
  cat /proc/82/cmdline
  2⤵
  PID:1250
- /bin/grep
  grep -q .g3
  2⤵
  PID:1256
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1255
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  PID:1254
- /bin/grep
  grep -q .g4
  2⤵
  PID:1259
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1258
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1257
- /bin/grep
  grep -q .g4
  2⤵
  PID:1262
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1261
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:1260
- /bin/grep
  grep -q .g4
  2⤵
  PID:1265
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1264
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:1263
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1267
- /bin/grep
  grep -q .g4
  2⤵
  PID:1268
- /bin/cat
  cat /proc/110/cmdline
  2⤵
  PID:1266
- /bin/grep
  grep -q .g4
  2⤵
  PID:1272
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1271
- /bin/cat
  cat /proc/1183/cmdline
  2⤵
  PID:1270
- /bin/grep
  grep -q .g4
  2⤵
  PID:1275
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1274
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:1273
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1277
- /bin/cat
  cat /proc/1205/cmdline
  2⤵
  - Reads runtime system information
  PID:1276
- /bin/grep
  grep -q .g4
  2⤵
  PID:1278
- /bin/grep
  grep -q .g4
  2⤵
  PID:1281
- /bin/cat
  cat /proc/1243/cmdline
  2⤵
  PID:1279
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1280
- /bin/grep
  grep -q .g4
  2⤵
  PID:1284
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1283
- /bin/cat
  cat /proc/126/cmdline
  2⤵
  PID:1282
- /bin/grep
  grep -q .g4
  2⤵
  PID:1287
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1286
- /bin/cat
  cat /proc/127/cmdline
  2⤵
  PID:1285
- /bin/grep
  grep -q .g4
  2⤵
  PID:1290
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1289
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:1288
- /bin/grep
  grep -q .g4
  2⤵
  PID:1293
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1292
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1291
- /bin/grep
  grep -q .g4
  2⤵
  PID:1296
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1295
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1294
- /bin/grep
  grep -q .g4
  2⤵
  PID:1299
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1298
- /bin/cat
  cat /proc/157/cmdline
  2⤵
  PID:1297
- /bin/grep
  grep -q .g4
  2⤵
  PID:1302
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1301
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:1300
- /bin/grep
  grep -q .g4
  2⤵
  PID:1305
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1304
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  - Reads runtime system information
  PID:1303
- /bin/grep
  grep -q .g4
  2⤵
  PID:1308
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1307
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:1306
- /bin/grep
  grep -q .g4
  2⤵
  PID:1311
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1310
- /bin/cat
  cat /proc/177/cmdline
  2⤵
  PID:1309
- /bin/grep
  grep -q .g4
  2⤵
  PID:1314
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1313
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:1312
- /bin/grep
  grep -q .g4
  2⤵
  PID:1317
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1316
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  PID:1315
- /bin/grep
  grep -q .g4
  2⤵
  PID:1320
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1319
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1318
- /bin/grep
  grep -q .g4
  2⤵
  PID:1323
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1322
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:1321
- /bin/grep
  grep -q .g4
  2⤵
  PID:1326
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1325
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1324
- /bin/grep
  grep -q .g4
  2⤵
  PID:1329
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1328
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:1327
- /bin/grep
  grep -q .g4
  2⤵
  PID:1332
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1331
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1330
- /bin/grep
  grep -q .g4
  2⤵
  PID:1335
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1334
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  - Reads runtime system information
  PID:1333
- /bin/grep
  grep -q .g4
  2⤵
  PID:1338
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1337
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:1336
- /bin/grep
  grep -q .g4
  2⤵
  PID:1341
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1340
- /bin/cat
  cat /proc/253/cmdline
  2⤵
  PID:1339
- /bin/grep
  grep -q .g4
  2⤵
  PID:1344
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1343
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1342
- /bin/grep
  grep -q .g4
  2⤵
  PID:1347
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1346
- /bin/cat
  cat /proc/339/cmdline
  2⤵
  PID:1345
- /bin/grep
  grep -q .g4
  2⤵
  PID:1350
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1349
- /bin/cat
  cat /proc/341/cmdline
  2⤵
  PID:1348
- /bin/grep
  grep -q .g4
  2⤵
  PID:1353
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1352
- /bin/cat
  cat /proc/342/cmdline
  2⤵
  - Reads runtime system information
  PID:1351
- /bin/grep
  grep -q .g4
  2⤵
  PID:1356
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1355
- /bin/cat
  cat /proc/345/cmdline
  2⤵
  PID:1354
- /bin/grep
  grep -q .g4
  2⤵
  PID:1359
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1358
- /bin/cat
  cat /proc/347/cmdline
  2⤵
  PID:1357
- /bin/grep
  grep -q .g4
  2⤵
  PID:1362
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1361
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:1360
- /bin/grep
  grep -q .g4
  2⤵
  PID:1365
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1364
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  - Reads runtime system information
  PID:1363
- /bin/grep
  grep -q .g4
  2⤵
  PID:1368
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1367
- /bin/cat
  cat /proc/393/cmdline
  2⤵
  PID:1366
- /bin/grep
  grep -q .g4
  2⤵
  PID:1371
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1370
- /bin/cat
  cat /proc/394/cmdline
  2⤵
  PID:1369
- /bin/grep
  grep -q .g4
  2⤵
  PID:1374
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1373
- /bin/cat
  cat /proc/399/cmdline
  2⤵
  PID:1372
- /bin/grep
  grep -q .g4
  2⤵
  PID:1377
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1376
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:1375
- /bin/grep
  grep -q .g4
  2⤵
  PID:1380
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1379
- /bin/cat
  cat /proc/447/cmdline
  2⤵
  PID:1378
- /bin/grep
  grep -q .g4
  2⤵
  PID:1383
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1382
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  PID:1381
- /bin/grep
  grep -q .g4
  2⤵
  PID:1386
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1385
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:1384
- /bin/grep
  grep -q .g4
  2⤵
  PID:1389
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1388
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:1387
- /bin/grep
  grep -q .g4
  2⤵
  PID:1392
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1391
- /bin/cat
  cat /proc/685/cmdline
  2⤵
  PID:1390
- /bin/grep
  grep -q .g4
  2⤵
  PID:1395
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1394
- /bin/cat
  cat /proc/688/cmdline
  2⤵
  PID:1393
- /bin/grep
  grep -q .g4
  2⤵
  PID:1398
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1397
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  - Reads runtime system information
  PID:1396
- /bin/grep
  grep -q .g4
  2⤵
  PID:1401
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1400
- /bin/cat
  cat /proc/690/cmdline
  2⤵
  PID:1399
- /bin/grep
  grep -q .g4
  2⤵
  PID:1404
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1403
- /bin/cat
  cat /proc/691/cmdline
  2⤵
  PID:1402
- /bin/grep
  grep -q .g4
  2⤵
  PID:1407
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1406
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1405
- /bin/grep
  grep -q .g4
  2⤵
  PID:1410
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1409
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  PID:1408
- /bin/grep
  grep -q .g4
  2⤵
  PID:1413
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1412
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:1411
- /bin/grep
  grep -q .g4
  2⤵
  PID:1416
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1415
- /bin/cat
  cat /proc/714/cmdline
  2⤵
  PID:1414
- /bin/grep
  grep -q .g4
  2⤵
  PID:1419
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1418
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  - Reads runtime system information
  PID:1417
- /bin/grep
  grep -q .g4
  2⤵
  PID:1422
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1421
- /bin/cat
  cat /proc/721/cmdline
  2⤵
  PID:1420
- /bin/grep
  grep -q .g4
  2⤵
  PID:1425
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1424
- /bin/cat
  cat /proc/722/cmdline
  2⤵
  PID:1423
- /bin/grep
  grep -q .g4
  2⤵
  PID:1428
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1427
- /bin/cat
  cat /proc/723/cmdline
  2⤵
  PID:1426
- /bin/grep
  grep -q .g4
  2⤵
  PID:1431
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1430
- /bin/cat
  cat /proc/725/cmdline
  2⤵
  PID:1429
- /bin/grep
  grep -q .g4
  2⤵
  PID:1434
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1433
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  PID:1432
- /bin/grep
  grep -q .g4
  2⤵
  PID:1437
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1436
- /bin/cat
  cat /proc/730/cmdline
  2⤵
  PID:1435
- /bin/grep
  grep -q .g4
  2⤵
  PID:1440
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1439
- /bin/cat
  cat /proc/74/cmdline
  2⤵
  PID:1438
- /bin/grep
  grep -q .g4
  2⤵
  PID:1443
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1442
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  - Reads runtime system information
  PID:1441
- /bin/grep
  grep -q .g4
  2⤵
  PID:1446
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1445
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:1444
- /bin/grep
  grep -q .g4
  2⤵
  PID:1449
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1448
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  PID:1447
- /bin/grep
  grep -q .g4
  2⤵
  PID:1452
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1451
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  PID:1450
- /bin/grep
  grep -q .g4
  2⤵
  PID:1455
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1454
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  PID:1453
- /bin/grep
  grep -q .g4
  2⤵
  PID:1458
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1457
- /bin/cat
  cat /proc/82/cmdline
  2⤵
  - Reads runtime system information
  PID:1456
- /bin/grep
  grep -q .g4
  2⤵
  PID:1461
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1460
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  PID:1459
- /bin/grep
  grep -q .r1
  2⤵
  PID:1464
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1463
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1462
- /bin/grep
  grep -q .r1
  2⤵
  PID:1467
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1466
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:1465
- /bin/grep
  grep -q .r1
  2⤵
  PID:1470
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1469
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:1468
- /bin/grep
  grep -q .r1
  2⤵
  PID:1473
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1472
- /bin/cat
  cat /proc/110/cmdline
  2⤵
  PID:1471
- /bin/grep
  grep -q .r1
  2⤵
  PID:1476
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1475
- /bin/cat
  cat /proc/1183/cmdline
  2⤵
  PID:1474
- /bin/grep
  grep -q .r1
  2⤵
  PID:1479
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1478
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:1477
- /bin/grep
  grep -q .r1
  2⤵
  PID:1482
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1481
- /bin/cat
  cat /proc/1205/cmdline
  2⤵
  PID:1480
- /bin/grep
  grep -q .r1
  2⤵
  PID:1488
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1487
- /bin/cat
  cat /proc/1243/cmdline
  2⤵
  PID:1486
- /bin/grep
  grep -q .r1
  2⤵
  PID:1491
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1490
- /bin/cat
  cat /proc/126/cmdline
  2⤵
  PID:1489
- /bin/grep
  grep -q .r1
  2⤵
  PID:1495
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1494
- /bin/cat
  cat /proc/127/cmdline
  2⤵
  PID:1493
- /bin/grep
  grep -q .r1
  2⤵
  PID:1499
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1498
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:1497
- /bin/grep
  grep -q .r1
  2⤵
  PID:1502
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1501
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1500
- /bin/grep
  grep -q .r1
  2⤵
  PID:1505
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1504
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1503
- /bin/grep
  grep -q .r1
  2⤵
  PID:1509
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1508
- /bin/cat
  cat /proc/157/cmdline
  2⤵
  PID:1507
- /bin/grep
  grep -q .r1
  2⤵
  PID:1513
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1512
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:1511
- /bin/grep
  grep -q .r1
  2⤵
  PID:1516
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1515
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  - Reads runtime system information
  PID:1514
- /bin/grep
  grep -q .r1
  2⤵
  PID:1519
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1518
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:1517
- /bin/grep
  grep -q .r1
  2⤵
  PID:1523
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1522
- /bin/cat
  cat /proc/177/cmdline
  2⤵
  PID:1521
- /bin/grep
  grep -q .r1
  2⤵
  PID:1527
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1526
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:1525
- /bin/grep
  grep -q .r1
  2⤵
  PID:1530
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1529
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  - Reads runtime system information
  PID:1528
- /bin/grep
  grep -q .r1
  2⤵
  PID:1534
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1533
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1532
- /bin/grep
  grep -q .r1
  2⤵
  PID:1537
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1536
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:1535
- /bin/grep
  grep -q .r1
  2⤵
  PID:1541
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1540
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1539
- /bin/grep
  grep -q .r1
  2⤵
  PID:1544
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1543
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:1542
- /bin/grep
  grep -q .r1
  2⤵
  PID:1548
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1547
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1546
- /bin/grep
  grep -q .r1
  2⤵
  PID:1552
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1551
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:1550
- /bin/grep
  grep -q .r1
  2⤵
  PID:1555
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1554
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:1553
- /bin/grep
  grep -q .r1
  2⤵
  PID:1559
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1558
- /bin/cat
  cat /proc/253/cmdline
  2⤵
  PID:1557
- /bin/grep
  grep -q .r1
  2⤵
  PID:1562
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1561
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1560
- /bin/grep
  grep -q .r1
  2⤵
  PID:1566
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1565
- /bin/cat
  cat /proc/339/cmdline
  2⤵
  PID:1564
- /bin/grep
  grep -q .r1
  2⤵
  PID:1569
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1568
- /bin/cat
  cat /proc/341/cmdline
  2⤵
  PID:1567
- /bin/grep
  grep -q .r1
  2⤵
  PID:1573
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1572
- /bin/cat
  cat /proc/342/cmdline
  2⤵
  PID:1571
- /bin/grep
  grep -q .r1
  2⤵
  PID:1577
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1576
- /bin/cat
  cat /proc/345/cmdline
  2⤵
  - Reads runtime system information
  PID:1575
- /bin/grep
  grep -q .r1
  2⤵
  PID:1580
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1579
- /bin/cat
  cat /proc/347/cmdline
  2⤵
  PID:1578
- /bin/grep
  grep -q .r1
  2⤵
  PID:1583
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1582
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:1581
- /bin/grep
  grep -q .r1
  2⤵
  PID:1587
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1586
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  PID:1585
- /bin/grep
  grep -q .r1
  2⤵
  PID:1591
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1590
- /bin/cat
  cat /proc/393/cmdline
  2⤵
  PID:1589
- /bin/grep
  grep -q .r1
  2⤵
  PID:1594
- /bin/cat
  cat /proc/394/cmdline
  2⤵
  - Reads runtime system information
  PID:1592
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1593
- /bin/cat
  cat /proc/399/cmdline
  2⤵
  - Reads runtime system information
  PID:1595
- /bin/grep
  grep -q .r1
  2⤵
  PID:1597
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1596
- /bin/grep
  grep -q .r1
  2⤵
  PID:1601
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1600
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:1599
- /bin/grep
  grep -q .r1
  2⤵
  PID:1605
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1604
- /bin/cat
  cat /proc/447/cmdline
  2⤵
  - Reads runtime system information
  PID:1603
- /bin/grep
  grep -q .r1
  2⤵
  PID:1608
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1607
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  PID:1606
- /bin/grep
  grep -q .r1
  2⤵
  PID:1612
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1611
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:1610
- /bin/grep
  grep -q .r1
  2⤵
  PID:1615
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1614
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:1613
- /bin/grep
  grep -q .r1
  2⤵
  PID:1619
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1618
- /bin/cat
  cat /proc/685/cmdline
  2⤵
  PID:1617
- /bin/grep
  grep -q .r1
  2⤵
  PID:1622
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1621
- /bin/cat
  cat /proc/688/cmdline
  2⤵
  PID:1620
- /bin/grep
  grep -q .r1
  2⤵
  PID:1626
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1625
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  PID:1624
- /bin/grep
  grep -q .r1
  2⤵
  PID:1630
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1629
- /bin/cat
  cat /proc/690/cmdline
  2⤵
  PID:1628
- /bin/grep
  grep -q .r1
  2⤵
  PID:1633
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1632
- /bin/cat
  cat /proc/691/cmdline
  2⤵
  PID:1631
- /bin/grep
  grep -q .r1
  2⤵
  PID:1637
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1636
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1635
- /bin/grep
  grep -q .r1
  2⤵
  PID:1640
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1639
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  - Reads runtime system information
  PID:1638
- /bin/grep
  grep -q .r1
  2⤵
  PID:1644
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1643
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:1642
- /bin/grep
  grep -q .r1
  2⤵
  PID:1647
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1646
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  PID:1645
- /bin/grep
  grep -q .r1
  2⤵
  PID:1651
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1650
- /bin/cat
  cat /proc/721/cmdline
  2⤵
  PID:1649
- /bin/grep
  grep -q .r1
  2⤵
  PID:1655
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1654
- /bin/cat
  cat /proc/722/cmdline
  2⤵
  PID:1653
- /bin/grep
  grep -q .r1
  2⤵
  PID:1658
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1657
- /bin/cat
  cat /proc/723/cmdline
  2⤵
  PID:1656
- /bin/grep
  grep -q .r1
  2⤵
  PID:1661
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1660
- /bin/cat
  cat /proc/725/cmdline
  2⤵
  PID:1659
- /bin/grep
  grep -q .r1
  2⤵
  PID:1666
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1665
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  PID:1664
- /bin/grep
  grep -q .r1
  2⤵
  PID:1669
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1668
- /bin/cat
  cat /proc/730/cmdline
  2⤵
  PID:1667
- /bin/grep
  grep -q .r1
  2⤵
  PID:1672
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1671
- /bin/cat
  cat /proc/74/cmdline
  2⤵
  - Reads runtime system information
  PID:1670
- /bin/grep
  grep -q .r1
  2⤵
  PID:1676
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1675
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  - Reads runtime system information
  PID:1674
- /bin/grep
  grep -q .r1
  2⤵
  PID:1679
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1678
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:1677
- /bin/grep
  grep -q .r1
  2⤵
  PID:1683
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1682
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  PID:1681
- /bin/grep
  grep -q .r1
  2⤵
  PID:1686
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1685
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  PID:1684
- /bin/grep
  grep -q .r1
  2⤵
  PID:1689
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1688
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  PID:1687
- /bin/grep
  grep -q .r1
  2⤵
  PID:1692
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1691
- /bin/cat
  cat /proc/82/cmdline
  2⤵
  PID:1690
- /bin/grep
  grep -q .r1
  2⤵
  PID:1695
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1694
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  PID:1693
- /bin/grep
  grep -q .r2
  2⤵
  PID:1698
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1697
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1696
- /bin/grep
  grep -q .r2
  2⤵
  PID:1701
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1700
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  - Reads runtime system information
  PID:1699
- /bin/grep
  grep -q .r2
  2⤵
  PID:1704
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1703
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:1702
- /bin/grep
  grep -q .r2
  2⤵
  PID:1707
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1706
- /bin/cat
  cat /proc/110/cmdline
  2⤵
  PID:1705
- /bin/grep
  grep -q .r2
  2⤵
  PID:1710
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1709
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:1708
- /bin/grep
  grep -q .r2
  2⤵
  PID:1713
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1712
- /bin/cat
  cat /proc/126/cmdline
  2⤵
  PID:1711
- /bin/grep
  grep -q .r2
  2⤵
  PID:1716
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1715
- /bin/cat
  cat /proc/127/cmdline
  2⤵
  PID:1714
- /bin/grep
  grep -q .r2
  2⤵
  PID:1719
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1718
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  - Reads runtime system information
  PID:1717
- /bin/grep
  grep -q .r2
  2⤵
  PID:1722
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1721
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1720
- /bin/grep
  grep -q .r2
  2⤵
  PID:1725
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1724
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1723
- /bin/grep
  grep -q .r2
  2⤵
  PID:1728
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1727
- /bin/cat
  cat /proc/157/cmdline
  2⤵
  - Reads runtime system information
  PID:1726
- /bin/grep
  grep -q .r2
  2⤵
  PID:1731
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1730
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:1729
- /bin/grep
  grep -q .r2
  2⤵
  PID:1734
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1733
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  PID:1732
- /bin/grep
  grep -q .r2
  2⤵
  PID:1737
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1736
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  - Reads runtime system information
  PID:1735
- /bin/grep
  grep -q .r2
  2⤵
  PID:1740
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1739
- /bin/cat
  cat /proc/177/cmdline
  2⤵
  - Reads runtime system information
  PID:1738
- /bin/grep
  grep -q .r2
  2⤵
  PID:1743
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1742
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:1741
- /bin/grep
  grep -q .r2
  2⤵
  PID:1746
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1745
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  - Reads runtime system information
  PID:1744
- /bin/grep
  grep -q .r2
  2⤵
  PID:1749
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1748
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1747
- /bin/grep
  grep -q .r2
  2⤵
  PID:1752
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1751
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:1750
- /bin/grep
  grep -q .r2
  2⤵
  PID:1755
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1754
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1753
- /bin/grep
  grep -q .r2
  2⤵
  PID:1758
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1757
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:1756
- /bin/grep
  grep -q .r2
  2⤵
  PID:1761
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1760
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1759
- /bin/grep
  grep -q .r2
  2⤵
  PID:1764
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1763
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:1762
- /bin/grep
  grep -q .r2
  2⤵
  PID:1767
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1766
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:1765
- /bin/grep
  grep -q .r2
  2⤵
  PID:1770
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1769
- /bin/cat
  cat /proc/253/cmdline
  2⤵
  PID:1768
- /bin/grep
  grep -q .r2
  2⤵
  PID:1773
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1772
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1771
- /bin/grep
  grep -q .r2
  2⤵
  PID:1776
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1775
- /bin/cat
  cat /proc/339/cmdline
  2⤵
  PID:1774
- /bin/grep
  grep -q .r2
  2⤵
  PID:1779
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1778
- /bin/cat
  cat /proc/341/cmdline
  2⤵
  PID:1777
- /bin/grep
  grep -q .r2
  2⤵
  PID:1782
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1781
- /bin/cat
  cat /proc/342/cmdline
  2⤵
  PID:1780
- /bin/grep
  grep -q .r2
  2⤵
  PID:1785
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1784
- /bin/cat
  cat /proc/345/cmdline
  2⤵
  PID:1783
- /bin/grep
  grep -q .r2
  2⤵
  PID:1788
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1787
- /bin/cat
  cat /proc/347/cmdline
  2⤵
  PID:1786
- /bin/grep
  grep -q .r2
  2⤵
  PID:1791
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1790
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:1789
- /bin/grep
  grep -q .r2
  2⤵
  PID:1794
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1793
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  PID:1792
- /bin/grep
  grep -q .r2
  2⤵
  PID:1797
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1796
- /bin/cat
  cat /proc/393/cmdline
  2⤵
  PID:1795
- /bin/grep
  grep -q .r2
  2⤵
  PID:1800
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1799
- /bin/cat
  cat /proc/394/cmdline
  2⤵
  PID:1798
- /bin/grep
  grep -q .r2
  2⤵
  PID:1803
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1802
- /bin/cat
  cat /proc/399/cmdline
  2⤵
  PID:1801
- /bin/grep
  grep -q .r2
  2⤵
  PID:1806
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1805
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:1804
- /bin/grep
  grep -q .r2
  2⤵
  PID:1809
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1808
- /bin/cat
  cat /proc/447/cmdline
  2⤵
  - Reads runtime system information
  PID:1807
- /bin/grep
  grep -q .r2
  2⤵
  PID:1812
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1811
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  PID:1810
- /bin/grep
  grep -q .r2
  2⤵
  PID:1815
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1814
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:1813
- /bin/grep
  grep -q .r2
  2⤵
  PID:1818
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1817
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:1816
- /bin/grep
  grep -q .r2
  2⤵
  PID:1821
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1820
- /bin/cat
  cat /proc/685/cmdline
  2⤵
  PID:1819
- /bin/grep
  grep -q .r2
  2⤵
  PID:1824
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1823
- /bin/cat
  cat /proc/688/cmdline
  2⤵
  PID:1822
- /bin/grep
  grep -q .r2
  2⤵
  PID:1827
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1826
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  - Reads runtime system information
  PID:1825
- /bin/grep
  grep -q .r2
  2⤵
  PID:1830
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1829
- /bin/cat
  cat /proc/690/cmdline
  2⤵
  PID:1828
- /bin/grep
  grep -q .r2
  2⤵
  PID:1833
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1832
- /bin/cat
  cat /proc/691/cmdline
  2⤵
  - Reads runtime system information
  PID:1831
- /bin/grep
  grep -q .r2
  2⤵
  PID:1836
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1835
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1834
- /bin/grep
  grep -q .r2
  2⤵
  PID:1839
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1838
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  PID:1837
- /bin/grep
  grep -q .r2
  2⤵
  PID:1842
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1841
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:1840
- /bin/grep
  grep -q .r2
  2⤵
  PID:1845
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1844
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  PID:1843
- /bin/grep
  grep -q .r2
  2⤵
  PID:1848
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1847
- /bin/cat
  cat /proc/721/cmdline
  2⤵
  PID:1846
- /bin/grep
  grep -q .r2
  2⤵
  PID:1851
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1850
- /bin/cat
  cat /proc/722/cmdline
  2⤵
  - Reads runtime system information
  PID:1849

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.r1

Path /tmp/.r1
Size 129KB
SHA256 931006bf7a74a2f3a38acf54cbd26598c000e3206212633f0c7fe581bf7e91a2
MD5 20446661d9d1c01a1d961a5014d1edf0
SHA1 f2fa2f38892c9d6586d5268c2bfe91d4e6084e5d
SHA512 61ff384d5f8afa39d91d85d2f96bca0a30aac7d08f62d71e956e88dd4f5847428dbb816908afa8ca52c8cfa0bb783045ae8c4c8f0d72b2a27d49877f4966b2dc
SSDEEP 3072:K6mLO3ClOAvRCbLMETMWrneInEdF7o2l:TClJvRWLbMWrnZEz7o2l
TLSH
T15AD36C03DF940F9FC4AFCE70827E825719E68C8B83D1A66A517C8D8CB6BD25646D784C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.r2

Path /tmp/.r2
Size 129KB
SHA256 aeeed924d51367cac9d17fbcec0a557fee13d36de3e487fd2e94df3df5da767c
MD5 45fe3c58f38956655ac7bacd71e3557c
SHA1 789f0d23fd2f91d533f89a5d14c66932aaeda568
SHA512 5837a81a03e3c80660f8528c4101597246bc8f810c67d360fe18eb5c248b2a888d9746b98084505d3bba9da45b47ca9102195dc4a870a7b54a9a51c7121676d4
SSDEEP 1536:R3t/2DgnWwD4HhKtQnz7dH6EH9Btlk+rKoiJQwMqGq5hOSlFRMrrxxttttCVs:R3JccD4HhIQnzRBbN8QHDq5lFefxj
TLSH
T1D2D35D8377114FD0C319E37109F74A669EDA1A830AF29AC1537DDA207B31A69781BFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 58939572e04166bd41612a781e9cce89e80853a1032d0e6bc506a1e93b9ed999
MD5 412455f8e9db447801b95fe22ee9e610
SHA1 1946c8589e9d5cfb4ec621ea99e28b0a63bcbd32
SHA512 9684412ff66c074e8a3e7dc5292c003c8563bea5f9f10de252ede8c764d977fd058517ea4fcaf66416428c15b774ea2ffe085d28c690a389717cea6992626785
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 b5540677eeb3baf2b2c2aaa828f6652a6a93154c9f359e42a7332aeb78d1b678
MD5 b76a692bb22b474d35575c049c3d9bd4
SHA1 665a6297d26a20700d5710bcd4b963d4ced9e95a
SHA512 de1659d7eeaf46dd9a0bcf6c616f55dad3c811e1628a72dc1e4ce3d3712d9eca7c675bc4ee9f3b12792255803a7f56a02fee93c2d6af3c9352e9b1814ca45b52
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 c5e8d7a510ae8fdd479a80ae491b9aab43fcbb0bddc1369cf3fb87f4f441af4e
MD5 d1d96a16a33aafc94b0077f59f935ff4
SHA1 5cb3681f8c2bd506ec01f3ce29e34028f5088cae
SHA512 9ea02c6c3f91df76a9333f7a2769231151c81dd74ec3b8efa3857dbc98f8cc1e9319ace04d8ef0235dfafdd84965f7b9a9a1b272892a455ff01d95319272efaf
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 e2072075a85aef532f58aa78b9c6b316a56f3fc03946889e5a5565ffd0df647c
MD5 14a47f5bf4c5b0fa3f8e4abc97c5f11e
SHA1 a9ff574809c81ac1c3f8a7b6fd33a9a88c868741
SHA512 1c8dabf12ae77a715bae5811d40fa03eab4737d4bb216a72cbf3bbcc82d7d6d71926ea013ee0b1ec0fd165ee773ec36914cfd37da4b2b70e94aa7c24d6557c9f
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 f3d4bf44b48212b85e5b1c902e3b2779ba4e080ef76e70cdd4ca5d651b4fb3c6
MD5 e45327216740b4bbe4cec8133b1fe2c2
SHA1 e6cbb5030164738536e62ed92c4903364125655a
SHA512 1929e444078fe0d9bd8e5c382664ddebe137b0ab26708ac279b86d65917b28e9562c7a14467efbe84ebe3c45bc0ff16603a8e6b5751bb439efb5d6f6107005f9
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 0449eb1a50317f07c0c797eeb898ee562bc18a02925dfec8da488791634771ca
MD5 090e2fca2771dbb1e3482dd9c9cb07e3
SHA1 b662e487df51a1c8c1fcec5632b0016553ceb1a8
SHA512 cf9662f874f74a12bef15fe0369544df5871a71c1d18a36a30e5bb2f99e65fff27b2df9b6476a3468a814c5661889c9a0fb60c72c588741b820fe3a60f10f141
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads