e70289fc6447f602170549811635e82a9bdd3b85ea32c3f4eea140366acc00b3

Analysis

max time kernel
148s
max time network
149s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/10/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cams.sh
Size 3KB
Sample261020-xd8zcatyes
SHA256 e70289fc6447f602170549811635e82a9bdd3b85ea32c3f4eea140366acc00b3
MD5 7cd2c75c1ad8a40baea80f8267ee11ca
SHA1 e50fdaf9f0fa6c9fd0ae25a6f073e8674c857c7c
SHA512 137675a05a68044acb1c07b1572067ebf4a786951ffd0236c89ad5b3a2bd9f8791eb2652a636c9a41b26cfac9153671fd3de378d9a82532adc36c8e9799a263e
TLSH
T10A712FF9B8328EA1B8C9007BBC6AB1999983C97B06542552A1C7EC74F13F808F176630
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2287	Process not Found
2317	Process not Found
2324	Process not Found
2331	Process not Found
2352	Process not Found
2274	Process not Found
2281	Process not Found
2293	Process not Found
2299	Process not Found
2305	Process not Found
2316	Process not Found
2338	Process not Found
2345	Process not Found
2275	Process not Found

Executes dropped EXE 24 IoCs

ioc	pid	Process
/tmp/.r1	2276	cams.sh
/tmp/.r1	2279	Process not Found
/var/tmp/.r1	2282	cams.sh
/var/tmp/.r1	2285	Process not Found
/dev/.r1	2288	cams.sh
/dev/.r1	2291	Process not Found
/dev/shm/.r1	2294	cams.sh
/dev/shm/.r1	2297	Process not Found
/opt/.r1	2300	cams.sh
/opt/.r1	2303	Process not Found
/mnt/.r1	2306	cams.sh
/mnt/.r1	2308	Process not Found
/tmp/.r2	2318	cams.sh
/tmp/.r2	2321	Process not Found
/var/tmp/.r2	2325	cams.sh
/var/tmp/.r2	2328	Process not Found
/dev/.r2	2332	cams.sh
/dev/.r2	2335	Process not Found
/dev/shm/.r2	2339	cams.sh
/dev/shm/.r2	2342	Process not Found
/opt/.r2	2346	cams.sh
/opt/.r2	2349	Process not Found
/mnt/.r2	2353	cams.sh
/mnt/.r2	2356	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/37/cmdline	cat
File opened for reading	/proc/24/cmdline	Process not Found
File opened for reading	/proc/16/cmdline	cat
File opened for reading	/proc/37/cmdline	cat
File opened for reading	/proc/81/cmdline	cat
File opened for reading	/proc/327/cmdline	cat
File opened for reading	/proc/19/cmdline	Process not Found
File opened for reading	/proc/16/cmdline	cat
File opened for reading	/proc/5/cmdline	cat
File opened for reading	/proc/79/cmdline	cat
File opened for reading	/proc/441/cmdline	cat
File opened for reading	/proc/677/cmdline	cat
File opened for reading	/proc/81/cmdline	Process not Found
File opened for reading	/proc/10/cmdline	Process not Found
File opened for reading	/proc/330/cmdline	cat
File opened for reading	/proc/69/cmdline	cat
File opened for reading	/proc/71/cmdline	cat
File opened for reading	/proc/152/cmdline	Process not Found
File opened for reading	/proc/714/cmdline	Process not Found
File opened for reading	/proc/13/cmdline	Process not Found
File opened for reading	/proc/388/cmdline	cat
File opened for reading	/proc/674/cmdline	cat
File opened for reading	/proc/716/cmdline	cat
File opened for reading	/proc/37/cmdline	cat
File opened for reading	/proc/6/cmdline	cat
File opened for reading	/proc/665/cmdline	cat
File opened for reading	/proc/388/cmdline	cat
File opened for reading	/proc/665/cmdline	Process not Found
File opened for reading	/proc/8/cmdline	cat
File opened for reading	/proc/68/cmdline	Process not Found
File opened for reading	/proc/76/cmdline	cat
File opened for reading	/proc/20/cmdline	cat
File opened for reading	/proc/5/cmdline	cat
File opened for reading	/proc/21/cmdline	Process not Found
File opened for reading	/proc/665/cmdline	cat
File opened for reading	/proc/237/cmdline	cat
File opened for reading	/proc/381/cmdline	cat
File opened for reading	/proc/72/cmdline	cat
File opened for reading	/proc/70/cmdline	cat
File opened for reading	/proc/712/cmdline	cat
File opened for reading	/proc/710/cmdline	Process not Found
File opened for reading	/proc/14/cmdline	Process not Found
File opened for reading	/proc/385/cmdline	cat
File opened for reading	/proc/24/cmdline	cat
File opened for reading	/proc/726/cmdline	Process not Found
File opened for reading	/proc/15/cmdline	Process not Found
File opened for reading	/proc/726/cmdline	Process not Found
File opened for reading	/proc/331/cmdline	cat
File opened for reading	/proc/9/cmdline	cat
File opened for reading	/proc/388/cmdline	cat
File opened for reading	/proc/4/cmdline	cat
File opened for reading	/proc/726/cmdline	cat
File opened for reading	/proc/726/cmdline	cat
File opened for reading	/proc/385/cmdline	Process not Found
File opened for reading	/proc/175/cmdline	cat
File opened for reading	/proc/160/cmdline	cat
File opened for reading	/proc/120/cmdline	Process not Found
File opened for reading	/proc/70/cmdline	Process not Found
File opened for reading	/proc/13/cmdline	cat
File opened for reading	/proc/22/cmdline	cat
File opened for reading	/proc/19/cmdline	cat
File opened for reading	/proc/5/cmdline	cat
File opened for reading	/proc/674/cmdline	cat
File opened for reading	/proc/152/cmdline	cat

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
2266	Process not Found
2270	Process not Found
2273	Process not Found
2313	Process not Found

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.r1	Process not Found
File opened for modification	/dev/shm/.r2	Process not Found

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.r1	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r8x	Process not Found
File opened for modification	/tmp/.r2	Process not Found
File opened for modification	/tmp/.r8xp	Process not Found
File opened for modification	/tmp/.r8x	Process not Found

/tmp/cams.sh
/tmp/cams.sh
1⤵
- Executes dropped EXE
PID:714
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:717
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/109/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/120/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/121/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:733
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:735
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/152/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:741
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:743
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:745
- /bin/readlink
  readlink /proc/175/exe
  2⤵
  PID:747
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:748
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:749
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:750
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:751
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:753
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:754
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:756
- /bin/readlink
  readlink /proc/237/exe
  2⤵
  PID:757
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:758
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:759
- /bin/readlink
  readlink /proc/324/exe
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/326/exe
  2⤵
  PID:762
- /bin/readlink
  readlink /proc/327/exe
  2⤵
  PID:764
- /bin/readlink
  readlink /proc/330/exe
  2⤵
  PID:766
- /bin/readlink
  readlink /proc/331/exe
  2⤵
  PID:767
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:768
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:769
- /bin/readlink
  readlink /proc/381/exe
  2⤵
  PID:770
- /bin/readlink
  readlink /proc/382/exe
  2⤵
  PID:772
- /bin/readlink
  readlink /proc/385/exe
  2⤵
  PID:773
- /bin/readlink
  readlink /proc/388/exe
  2⤵
  PID:774
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:775
- /bin/readlink
  readlink /proc/441/exe
  2⤵
  PID:776
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:777
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:778
- /bin/readlink
  readlink /proc/665/exe
  2⤵
  PID:779
- /bin/readlink
  readlink /proc/674/exe
  2⤵
  PID:781
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:782
- /bin/readlink
  readlink /proc/679/exe
  2⤵
  PID:783
- /bin/readlink
  readlink /proc/68/exe
  2⤵
  PID:784
- /bin/readlink
  readlink /proc/680/exe
  2⤵
  PID:785
- /bin/readlink
  readlink /proc/69/exe
  2⤵
  PID:786
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:787
- /bin/readlink
  readlink /proc/70/exe
  2⤵
  PID:788
- /bin/readlink
  readlink /proc/703/exe
  2⤵
  PID:789
- /bin/readlink
  readlink /proc/705/exe
  2⤵
  PID:790
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:791
- /bin/readlink
  readlink /proc/710/exe
  2⤵
  PID:792
- /bin/readlink
  readlink /proc/712/exe
  2⤵
  PID:793
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:794
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:795
- /bin/readlink
  readlink /proc/716/exe
  2⤵
  PID:796
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:797
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:798
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:799
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:800
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:801
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:802
- /bin/readlink
  readlink /proc/81/exe
  2⤵
  PID:803
- /bin/readlink
  readlink /proc/83/exe
  2⤵
  PID:804
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:805
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:807
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:806
- /bin/grep
  grep -q .ghl
  2⤵
  PID:808
- /bin/grep
  grep -q .ghl
  2⤵
  PID:811
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:810
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:809
- /bin/grep
  grep -q .ghl
  2⤵
  PID:814
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:813
- /bin/cat
  cat /proc/109/cmdline
  2⤵
  PID:812
- /bin/grep
  grep -q .ghl
  2⤵
  PID:817
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:816
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:815
- /bin/grep
  grep -q .ghl
  2⤵
  PID:820
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:819
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:818
- /bin/grep
  grep -q .ghl
  2⤵
  PID:823
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:822
- /bin/cat
  cat /proc/120/cmdline
  2⤵
  PID:821
- /bin/grep
  grep -q .ghl
  2⤵
  PID:826
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:825
- /bin/cat
  cat /proc/121/cmdline
  2⤵
  PID:824
- /bin/grep
  grep -q .ghl
  2⤵
  PID:829
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:828
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:827
- /bin/grep
  grep -q .ghl
  2⤵
  PID:832
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:831
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:830
- /bin/grep
  grep -q .ghl
  2⤵
  PID:835
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:834
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:833
- /bin/grep
  grep -q .ghl
  2⤵
  PID:838
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:837
- /bin/cat
  cat /proc/152/cmdline
  2⤵
  PID:836
- /bin/grep
  grep -q .ghl
  2⤵
  PID:841
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:840
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  - Reads runtime system information
  PID:839
- /bin/grep
  grep -q .ghl
  2⤵
  PID:844
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:843
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  PID:842
- /bin/grep
  grep -q .ghl
  2⤵
  PID:847
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:846
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:845
- /bin/grep
  grep -q .ghl
  2⤵
  PID:850
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:849
- /bin/cat
  cat /proc/175/cmdline
  2⤵
  PID:848
- /bin/grep
  grep -q .ghl
  2⤵
  PID:853
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:852
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:851
- /bin/grep
  grep -q .ghl
  2⤵
  PID:856
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:855
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  PID:854
- /bin/grep
  grep -q .ghl
  2⤵
  PID:859
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:858
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:857
- /bin/grep
  grep -q .ghl
  2⤵
  PID:862
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:861
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:860
- /bin/grep
  grep -q .ghl
  2⤵
  PID:865
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:864
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:863
- /bin/grep
  grep -q .ghl
  2⤵
  PID:868
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:867
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:866
- /bin/grep
  grep -q .ghl
  2⤵
  PID:871
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:870
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:869
- /bin/grep
  grep -q .ghl
  2⤵
  PID:874
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:873
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:872
- /bin/grep
  grep -q .ghl
  2⤵
  PID:877
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:876
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:875
- /bin/grep
  grep -q .ghl
  2⤵
  PID:880
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:879
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:878
- /bin/grep
  grep -q .ghl
  2⤵
  PID:883
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:882
- /bin/cat
  cat /proc/324/cmdline
  2⤵
  PID:881
- /bin/grep
  grep -q .ghl
  2⤵
  PID:886
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:885
- /bin/cat
  cat /proc/326/cmdline
  2⤵
  PID:884
- /bin/grep
  grep -q .ghl
  2⤵
  PID:889
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:888
- /bin/cat
  cat /proc/327/cmdline
  2⤵
  PID:887
- /bin/grep
  grep -q .ghl
  2⤵
  PID:892
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:891
- /bin/cat
  cat /proc/330/cmdline
  2⤵
  PID:890
- /bin/grep
  grep -q .ghl
  2⤵
  PID:895
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:894
- /bin/cat
  cat /proc/331/cmdline
  2⤵
  - Reads runtime system information
  PID:893
- /bin/grep
  grep -q .ghl
  2⤵
  PID:898
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:897
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:896
- /bin/grep
  grep -q .ghl
  2⤵
  PID:901
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:900
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  PID:899
- /bin/grep
  grep -q .ghl
  2⤵
  PID:904
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:903
- /bin/cat
  cat /proc/381/cmdline
  2⤵
  PID:902
- /bin/grep
  grep -q .ghl
  2⤵
  PID:907
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:906
- /bin/cat
  cat /proc/382/cmdline
  2⤵
  PID:905
- /bin/grep
  grep -q .ghl
  2⤵
  PID:910
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:909
- /bin/cat
  cat /proc/385/cmdline
  2⤵
  - Reads runtime system information
  PID:908
- /bin/grep
  grep -q .ghl
  2⤵
  PID:913
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:912
- /bin/cat
  cat /proc/388/cmdline
  2⤵
  PID:911
- /bin/grep
  grep -q .ghl
  2⤵
  PID:916
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:915
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:914
- /bin/grep
  grep -q .ghl
  2⤵
  PID:919
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:918
- /bin/cat
  cat /proc/441/cmdline
  2⤵
  PID:917
- /bin/grep
  grep -q .ghl
  2⤵
  PID:922
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:921
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  PID:920
- /bin/grep
  grep -q .ghl
  2⤵
  PID:925
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:924
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:923
- /bin/grep
  grep -q .ghl
  2⤵
  PID:928
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:927
- /bin/cat
  cat /proc/665/cmdline
  2⤵
  - Reads runtime system information
  PID:926
- /bin/grep
  grep -q .ghl
  2⤵
  PID:931
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:930
- /bin/cat
  cat /proc/674/cmdline
  2⤵
  - Reads runtime system information
  PID:929
- /bin/grep
  grep -q .ghl
  2⤵
  PID:934
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:933
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:932
- /bin/grep
  grep -q .ghl
  2⤵
  PID:937
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:936
- /bin/cat
  cat /proc/679/cmdline
  2⤵
  PID:935
- /bin/grep
  grep -q .ghl
  2⤵
  PID:940
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:939
- /bin/cat
  cat /proc/68/cmdline
  2⤵
  PID:938
- /bin/grep
  grep -q .ghl
  2⤵
  PID:943
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:942
- /bin/cat
  cat /proc/680/cmdline
  2⤵
  PID:941
- /bin/grep
  grep -q .ghl
  2⤵
  PID:946
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:945
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  PID:944
- /bin/grep
  grep -q .ghl
  2⤵
  PID:949
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:948
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:947
- /bin/grep
  grep -q .ghl
  2⤵
  PID:952
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:951
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  PID:950
- /bin/grep
  grep -q .ghl
  2⤵
  PID:955
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:954
- /bin/cat
  cat /proc/703/cmdline
  2⤵
  PID:953
- /bin/grep
  grep -q .ghl
  2⤵
  PID:958
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:957
- /bin/cat
  cat /proc/705/cmdline
  2⤵
  PID:956
- /bin/grep
  grep -q .ghl
  2⤵
  PID:961
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:960
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:959
- /bin/grep
  grep -q .ghl
  2⤵
  PID:964
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:963
- /bin/cat
  cat /proc/710/cmdline
  2⤵
  PID:962
- /bin/grep
  grep -q .ghl
  2⤵
  PID:968
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:967
- /bin/cat
  cat /proc/712/cmdline
  2⤵
  PID:966
- /bin/grep
  grep -q .ghl
  2⤵
  PID:972
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:971
- /bin/cat
  cat /proc/713/cmdline
  2⤵
  PID:970
- /bin/grep
  grep -q .ghl
  2⤵
  PID:975
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:974
- /bin/cat
  cat /proc/714/cmdline
  2⤵
  PID:973
- /bin/grep
  grep -q .ghl
  2⤵
  PID:978
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:977
- /bin/cat
  cat /proc/716/cmdline
  2⤵
  - Reads runtime system information
  PID:976
- /bin/grep
  grep -q .ghl
  2⤵
  PID:981
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:980
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  PID:979
- /bin/grep
  grep -q .ghl
  2⤵
  PID:985
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:984
- /bin/cat
  cat /proc/726/cmdline
  2⤵
  PID:983
- /bin/grep
  grep -q .ghl
  2⤵
  PID:989
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:988
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  PID:987
- /bin/grep
  grep -q .ghl
  2⤵
  PID:992
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:991
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  - Reads runtime system information
  PID:990
- /bin/grep
  grep -q .ghl
  2⤵
  PID:996
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:995
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:994
- /bin/grep
  grep -q .ghl
  2⤵
  PID:999
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:998
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  PID:997
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1003
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1002
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  - Reads runtime system information
  PID:1001
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1006
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1005
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  PID:1004
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1010
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1009
- /bin/cat
  cat /proc/83/cmdline
  2⤵
  PID:1008
- /bin/grep
  grep -q .ghl
  2⤵
  PID:1014
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1013
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  - Reads runtime system information
  PID:1012
- /bin/grep
  grep -q .g3
  2⤵
  PID:1017
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1016
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1015
- /bin/grep
  grep -q .g3
  2⤵
  PID:1020
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1019
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:1018
- /bin/grep
  grep -q .g3
  2⤵
  PID:1024
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1023
- /bin/cat
  cat /proc/1011/cmdline
  2⤵
  PID:1022
- /bin/grep
  grep -q .g3
  2⤵
  PID:1028
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1027
- /bin/cat
  cat /proc/109/cmdline
  2⤵
  PID:1026
- /bin/grep
  grep -q .g3
  2⤵
  PID:1031
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1030
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:1029
- /bin/grep
  grep -q .g3
  2⤵
  PID:1035
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1034
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:1033
- /bin/grep
  grep -q .g3
  2⤵
  PID:1038
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1037
- /bin/cat
  cat /proc/120/cmdline
  2⤵
  PID:1036
- /bin/grep
  grep -q .g3
  2⤵
  PID:1042
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1041
- /bin/cat
  cat /proc/121/cmdline
  2⤵
  PID:1040
- /bin/grep
  grep -q .g3
  2⤵
  PID:1045
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1044
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  - Reads runtime system information
  PID:1043
- /bin/grep
  grep -q .g3
  2⤵
  PID:1049
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1048
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1047
- /bin/grep
  grep -q .g3
  2⤵
  PID:1053
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1052
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1051
- /bin/grep
  grep -q .g3
  2⤵
  PID:1056
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1055
- /bin/cat
  cat /proc/152/cmdline
  2⤵
  PID:1054
- /bin/grep
  grep -q .g3
  2⤵
  PID:1059
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1058
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:1057
- /bin/grep
  grep -q .g3
  2⤵
  PID:1063
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1062
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  PID:1061
- /bin/grep
  grep -q .g3
  2⤵
  PID:1067
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1066
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:1065
- /bin/grep
  grep -q .g3
  2⤵
  PID:1071
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1070
- /bin/cat
  cat /proc/175/cmdline
  2⤵
  - Reads runtime system information
  PID:1069
- /bin/grep
  grep -q .g3
  2⤵
  PID:1075
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1074
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:1073
- /bin/grep
  grep -q .g3
  2⤵
  PID:1078
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1077
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  PID:1076
- /bin/grep
  grep -q .g3
  2⤵
  PID:1081
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1080
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1079
- /bin/grep
  grep -q .g3
  2⤵
  PID:1085
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1084
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:1083
- /bin/grep
  grep -q .g3
  2⤵
  PID:1089
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1088
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1087
- /bin/grep
  grep -q .g3
  2⤵
  PID:1092
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1091
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:1090
- /bin/grep
  grep -q .g3
  2⤵
  PID:1095
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1094
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1093
- /bin/grep
  grep -q .g3
  2⤵
  PID:1099
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1098
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  - Reads runtime system information
  PID:1097
- /bin/grep
  grep -q .g3
  2⤵
  PID:1103
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1102
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:1101
- /bin/grep
  grep -q .g3
  2⤵
  PID:1106
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1105
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1104
- /bin/grep
  grep -q .g3
  2⤵
  PID:1110
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1109
- /bin/cat
  cat /proc/324/cmdline
  2⤵
  PID:1108
- /bin/grep
  grep -q .g3
  2⤵
  PID:1114
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1113
- /bin/cat
  cat /proc/326/cmdline
  2⤵
  PID:1112
- /bin/grep
  grep -q .g3
  2⤵
  PID:1117
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1116
- /bin/cat
  cat /proc/327/cmdline
  2⤵
  PID:1115
- /bin/grep
  grep -q .g3
  2⤵
  PID:1120
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1119
- /bin/cat
  cat /proc/330/cmdline
  2⤵
  PID:1118
- /bin/grep
  grep -q .g3
  2⤵
  PID:1124
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1123
- /bin/cat
  cat /proc/331/cmdline
  2⤵
  PID:1122
- /bin/grep
  grep -q .g3
  2⤵
  PID:1128
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1127
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:1126
- /bin/grep
  grep -q .g3
  2⤵
  PID:1131
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1130
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  - Reads runtime system information
  PID:1129
- /bin/grep
  grep -q .g3
  2⤵
  PID:1134
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1133
- /bin/cat
  cat /proc/381/cmdline
  2⤵
  - Reads runtime system information
  PID:1132
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1138
- /bin/cat
  cat /proc/382/cmdline
  2⤵
  PID:1137
- /bin/grep
  grep -q .g3
  2⤵
  PID:1139
- /bin/grep
  grep -q .g3
  2⤵
  PID:1142
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1141
- /bin/cat
  cat /proc/385/cmdline
  2⤵
  PID:1140
- /bin/grep
  grep -q .g3
  2⤵
  PID:1145
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1144
- /bin/cat
  cat /proc/388/cmdline
  2⤵
  - Reads runtime system information
  PID:1143
- /bin/grep
  grep -q .g3
  2⤵
  PID:1149
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1148
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  - Reads runtime system information
  PID:1147
- /bin/grep
  grep -q .g3
  2⤵
  PID:1153
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1152
- /bin/cat
  cat /proc/441/cmdline
  2⤵
  PID:1151
- /bin/grep
  grep -q .g3
  2⤵
  PID:1157
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1156
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  - Reads runtime system information
  PID:1155
- /bin/grep
  grep -q .g3
  2⤵
  PID:1161
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1160
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:1159
- /bin/grep
  grep -q .g3
  2⤵
  PID:1164
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1163
- /bin/cat
  cat /proc/665/cmdline
  2⤵
  PID:1162
- /bin/grep
  grep -q .g3
  2⤵
  PID:1168
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1167
- /bin/cat
  cat /proc/674/cmdline
  2⤵
  PID:1166
- /bin/grep
  grep -q .g3
  2⤵
  PID:1172
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1171
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:1170
- /bin/grep
  grep -q .g3
  2⤵
  PID:1176
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1175
- /bin/cat
  cat /proc/679/cmdline
  2⤵
  PID:1174
- /bin/grep
  grep -q .g3
  2⤵
  PID:1180
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1179
- /bin/cat
  cat /proc/68/cmdline
  2⤵
  PID:1178
- /bin/grep
  grep -q .g3
  2⤵
  PID:1184
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1183
- /bin/cat
  cat /proc/680/cmdline
  2⤵
  PID:1182
- /bin/grep
  grep -q .g3
  2⤵
  PID:1188
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1187
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  PID:1186
- /bin/grep
  grep -q .g3
  2⤵
  PID:1191
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1190
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1189
- /bin/grep
  grep -q .g3
  2⤵
  PID:1195
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1194
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  PID:1193
- /bin/grep
  grep -q .g3
  2⤵
  PID:1199
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1198
- /bin/cat
  cat /proc/703/cmdline
  2⤵
  PID:1197
- /bin/grep
  grep -q .g3
  2⤵
  PID:1202
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1201
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:1200
- /bin/grep
  grep -q .g3
  2⤵
  PID:1206
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1205
- /bin/cat
  cat /proc/710/cmdline
  2⤵
  PID:1204
- /bin/grep
  grep -q .g3
  2⤵
  PID:1210
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1209
- /bin/cat
  cat /proc/712/cmdline
  2⤵
  PID:1208
- /bin/grep
  grep -q .g3
  2⤵
  PID:1214
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1213
- /bin/cat
  cat /proc/713/cmdline
  2⤵
  PID:1212
- /bin/grep
  grep -q .g3
  2⤵
  PID:1217
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1216
- /bin/cat
  cat /proc/714/cmdline
  2⤵
  PID:1215
- /bin/grep
  grep -q .g3
  2⤵
  PID:1220
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1219
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  - Reads runtime system information
  PID:1218
- /bin/grep
  grep -q .g3
  2⤵
  PID:1224
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1223
- /bin/cat
  cat /proc/726/cmdline
  2⤵
  - Reads runtime system information
  PID:1222
- /bin/grep
  grep -q .g3
  2⤵
  PID:1227
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1226
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  PID:1225
- /bin/grep
  grep -q .g3
  2⤵
  PID:1230
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1229
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  PID:1228
- /bin/grep
  grep -q .g3
  2⤵
  PID:1233
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1232
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:1231
- /bin/grep
  grep -q .g3
  2⤵
  PID:1236
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1235
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  - Reads runtime system information
  PID:1234
- /bin/grep
  grep -q .g3
  2⤵
  PID:1240
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1239
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  PID:1238
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1242
- /bin/grep
  grep -q .g3
  2⤵
  PID:1243
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  PID:1241
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1245
- /bin/cat
  cat /proc/83/cmdline
  2⤵
  PID:1244
- /bin/grep
  grep -q .g3
  2⤵
  PID:1246
- /bin/grep
  grep -q .g3
  2⤵
  PID:1249
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1248
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  PID:1247
- /bin/grep
  grep -q .g4
  2⤵
  PID:1252
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1251
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1250
- /bin/grep
  grep -q .g4
  2⤵
  PID:1255
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1254
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:1253
- /bin/grep
  grep -q .g4
  2⤵
  PID:1258
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1257
- /bin/cat
  cat /proc/109/cmdline
  2⤵
  PID:1256
- /bin/grep
  grep -q .g4
  2⤵
  PID:1261
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1260
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:1259
- /bin/grep
  grep -q .g4
  2⤵
  PID:1264
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1263
- /bin/cat
  cat /proc/1154/cmdline
  2⤵
  PID:1262
- /bin/grep
  grep -q .g4
  2⤵
  PID:1267
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1266
- /bin/cat
  cat /proc/1173/cmdline
  2⤵
  PID:1265
- /bin/grep
  grep -q .g4
  2⤵
  PID:1270
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1269
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:1268
- /bin/grep
  grep -q .g4
  2⤵
  PID:1273
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1272
- /bin/cat
  cat /proc/120/cmdline
  2⤵
  PID:1271
- /bin/grep
  grep -q .g4
  2⤵
  PID:1276
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1275
- /bin/cat
  cat /proc/121/cmdline
  2⤵
  PID:1274
- /bin/grep
  grep -q .g4
  2⤵
  PID:1279
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1278
- /bin/cat
  cat /proc/1211/cmdline
  2⤵
  PID:1277
- /bin/grep
  grep -q .g4
  2⤵
  PID:1282
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1281
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:1280
- /bin/grep
  grep -q .g4
  2⤵
  PID:1285
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1284
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1283
- /bin/grep
  grep -q .g4
  2⤵
  PID:1288
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1287
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1286
- /bin/grep
  grep -q .g4
  2⤵
  PID:1291
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1290
- /bin/cat
  cat /proc/152/cmdline
  2⤵
  PID:1289
- /bin/grep
  grep -q .g4
  2⤵
  PID:1294
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1293
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:1292
- /bin/grep
  grep -q .g4
  2⤵
  PID:1297
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1296
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  PID:1295
- /bin/grep
  grep -q .g4
  2⤵
  PID:1300
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1299
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:1298
- /bin/grep
  grep -q .g4
  2⤵
  PID:1303
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1302
- /bin/cat
  cat /proc/175/cmdline
  2⤵
  PID:1301
- /bin/grep
  grep -q .g4
  2⤵
  PID:1306
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1305
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:1304
- /bin/grep
  grep -q .g4
  2⤵
  PID:1309
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1308
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  - Reads runtime system information
  PID:1307
- /bin/grep
  grep -q .g4
  2⤵
  PID:1312
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1311
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1310
- /bin/grep
  grep -q .g4
  2⤵
  PID:1315
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1314
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:1313
- /bin/grep
  grep -q .g4
  2⤵
  PID:1318
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1317
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1316
- /bin/grep
  grep -q .g4
  2⤵
  PID:1321
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1320
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  - Reads runtime system information
  PID:1319
- /bin/grep
  grep -q .g4
  2⤵
  PID:1324
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1323
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1322
- /bin/grep
  grep -q .g4
  2⤵
  PID:1327
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1326
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:1325
- /bin/grep
  grep -q .g4
  2⤵
  PID:1330
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1329
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:1328
- /bin/grep
  grep -q .g4
  2⤵
  PID:1333
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1332
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1331
- /bin/grep
  grep -q .g4
  2⤵
  PID:1336
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1335
- /bin/cat
  cat /proc/324/cmdline
  2⤵
  PID:1334
- /bin/grep
  grep -q .g4
  2⤵
  PID:1339
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1338
- /bin/cat
  cat /proc/326/cmdline
  2⤵
  PID:1337
- /bin/grep
  grep -q .g4
  2⤵
  PID:1342
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1341
- /bin/cat
  cat /proc/327/cmdline
  2⤵
  PID:1340
- /bin/grep
  grep -q .g4
  2⤵
  PID:1345
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1344
- /bin/cat
  cat /proc/330/cmdline
  2⤵
  PID:1343
- /bin/grep
  grep -q .g4
  2⤵
  PID:1348
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1347
- /bin/cat
  cat /proc/331/cmdline
  2⤵
  PID:1346
- /bin/grep
  grep -q .g4
  2⤵
  PID:1351
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1350
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:1349
- /bin/grep
  grep -q .g4
  2⤵
  PID:1354
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1353
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  PID:1352
- /bin/grep
  grep -q .g4
  2⤵
  PID:1357
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1356
- /bin/cat
  cat /proc/381/cmdline
  2⤵
  PID:1355
- /bin/grep
  grep -q .g4
  2⤵
  PID:1360
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1359
- /bin/cat
  cat /proc/382/cmdline
  2⤵
  PID:1358
- /bin/grep
  grep -q .g4
  2⤵
  PID:1363
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1362
- /bin/cat
  cat /proc/385/cmdline
  2⤵
  PID:1361
- /bin/grep
  grep -q .g4
  2⤵
  PID:1366
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1365
- /bin/cat
  cat /proc/388/cmdline
  2⤵
  PID:1364
- /bin/grep
  grep -q .g4
  2⤵
  PID:1369
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1368
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:1367
- /bin/grep
  grep -q .g4
  2⤵
  PID:1372
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1371
- /bin/cat
  cat /proc/441/cmdline
  2⤵
  - Reads runtime system information
  PID:1370
- /bin/grep
  grep -q .g4
  2⤵
  PID:1375
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1374
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  - Reads runtime system information
  PID:1373
- /bin/grep
  grep -q .g4
  2⤵
  PID:1378
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1377
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  - Reads runtime system information
  PID:1376
- /bin/grep
  grep -q .g4
  2⤵
  PID:1381
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1380
- /bin/cat
  cat /proc/665/cmdline
  2⤵
  - Reads runtime system information
  PID:1379
- /bin/grep
  grep -q .g4
  2⤵
  PID:1384
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1383
- /bin/cat
  cat /proc/674/cmdline
  2⤵
  - Reads runtime system information
  PID:1382
- /bin/grep
  grep -q .g4
  2⤵
  PID:1387
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1386
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:1385
- /bin/grep
  grep -q .g4
  2⤵
  PID:1390
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1389
- /bin/cat
  cat /proc/679/cmdline
  2⤵
  PID:1388
- /bin/grep
  grep -q .g4
  2⤵
  PID:1393
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1392
- /bin/cat
  cat /proc/68/cmdline
  2⤵
  PID:1391
- /bin/grep
  grep -q .g4
  2⤵
  PID:1396
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1395
- /bin/cat
  cat /proc/680/cmdline
  2⤵
  PID:1394
- /bin/grep
  grep -q .g4
  2⤵
  PID:1399
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1398
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  PID:1397
- /bin/grep
  grep -q .g4
  2⤵
  PID:1402
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1401
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1400
- /bin/grep
  grep -q .g4
  2⤵
  PID:1405
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1404
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  PID:1403
- /bin/grep
  grep -q .g4
  2⤵
  PID:1408
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1407
- /bin/cat
  cat /proc/703/cmdline
  2⤵
  PID:1406
- /bin/grep
  grep -q .g4
  2⤵
  PID:1411
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1410
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:1409
- /bin/grep
  grep -q .g4
  2⤵
  PID:1414
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1413
- /bin/cat
  cat /proc/710/cmdline
  2⤵
  PID:1412
- /bin/grep
  grep -q .g4
  2⤵
  PID:1417
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1416
- /bin/cat
  cat /proc/712/cmdline
  2⤵
  PID:1415
- /bin/grep
  grep -q .g4
  2⤵
  PID:1420
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1419
- /bin/cat
  cat /proc/713/cmdline
  2⤵
  PID:1418
- /bin/grep
  grep -q .g4
  2⤵
  PID:1423
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1422
- /bin/cat
  cat /proc/714/cmdline
  2⤵
  PID:1421
- /bin/grep
  grep -q .g4
  2⤵
  PID:1426
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1425
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  PID:1424
- /bin/grep
  grep -q .g4
  2⤵
  PID:1429
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1428
- /bin/cat
  cat /proc/726/cmdline
  2⤵
  - Reads runtime system information
  PID:1427
- /bin/grep
  grep -q .g4
  2⤵
  PID:1432
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1431
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  PID:1430
- /bin/grep
  grep -q .g4
  2⤵
  PID:1435
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1434
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  PID:1433
- /bin/grep
  grep -q .g4
  2⤵
  PID:1438
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1437
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:1436
- /bin/grep
  grep -q .g4
  2⤵
  PID:1441
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1440
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  PID:1439
- /bin/grep
  grep -q .g4
  2⤵
  PID:1445
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1444
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  PID:1443
- /bin/grep
  grep -q .g4
  2⤵
  PID:1449
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1448
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  PID:1447
- /bin/grep
  grep -q .g4
  2⤵
  PID:1452
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1451
- /bin/cat
  cat /proc/83/cmdline
  2⤵
  PID:1450
- /bin/grep
  grep -q .g4
  2⤵
  PID:1455
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1454
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  PID:1453
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1461
- /bin/grep
  grep -q .r1
  2⤵
  PID:1462
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1460
- /bin/grep
  grep -q .r1
  2⤵
  PID:1466
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1465
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:1464
- /bin/grep
  grep -q .r1
  2⤵
  PID:1469
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1468
- /bin/cat
  cat /proc/109/cmdline
  2⤵
  PID:1467
- /bin/grep
  grep -q .r1
  2⤵
  PID:1473
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1472
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:1471
- /bin/grep
  grep -q .r1
  2⤵
  PID:1477
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1476
- /bin/cat
  cat /proc/1154/cmdline
  2⤵
  PID:1475
- /bin/grep
  grep -q .r1
  2⤵
  PID:1480
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1479
- /bin/cat
  cat /proc/1173/cmdline
  2⤵
  PID:1478
- /bin/grep
  grep -q .r1
  2⤵
  PID:1484
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1483
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:1482
- /bin/grep
  grep -q .r1
  2⤵
  PID:1488
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1487
- /bin/cat
  cat /proc/120/cmdline
  2⤵
  PID:1486
- /bin/grep
  grep -q .r1
  2⤵
  PID:1491
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1490
- /bin/cat
  cat /proc/121/cmdline
  2⤵
  PID:1489
- /bin/grep
  grep -q .r1
  2⤵
  PID:1495
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1494
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:1493
- /bin/grep
  grep -q .r1
  2⤵
  PID:1498
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1497
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1496
- /bin/grep
  grep -q .r1
  2⤵
  PID:1502
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1501
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1500
- /bin/grep
  grep -q .r1
  2⤵
  PID:1505
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1504
- /bin/cat
  cat /proc/152/cmdline
  2⤵
  PID:1503
- /bin/grep
  grep -q .r1
  2⤵
  PID:1509
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1508
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  - Reads runtime system information
  PID:1507
- /bin/grep
  grep -q .r1
  2⤵
  PID:1513
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1512
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  PID:1511
- /bin/grep
  grep -q .r1
  2⤵
  PID:1516
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1515
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:1514
- /bin/grep
  grep -q .r1
  2⤵
  PID:1520
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1519
- /bin/cat
  cat /proc/175/cmdline
  2⤵
  PID:1518
- /bin/grep
  grep -q .r1
  2⤵
  PID:1523
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1522
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:1521
- /bin/grep
  grep -q .r1
  2⤵
  PID:1527
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1526
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  PID:1525
- /bin/grep
  grep -q .r1
  2⤵
  PID:1530
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1529
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1528
- /bin/grep
  grep -q .r1
  2⤵
  PID:1534
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1533
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  PID:1532
- /bin/grep
  grep -q .r1
  2⤵
  PID:1538
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1537
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1536
- /bin/grep
  grep -q .r1
  2⤵
  PID:1541
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1540
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:1539
- /bin/grep
  grep -q .r1
  2⤵
  PID:1544
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1543
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1542
- /bin/grep
  grep -q .r1
  2⤵
  PID:1548
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1547
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:1546
- /bin/grep
  grep -q .r1
  2⤵
  PID:1552
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1551
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  PID:1550
- /bin/grep
  grep -q .r1
  2⤵
  PID:1555
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1554
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1553
- /bin/grep
  grep -q .r1
  2⤵
  PID:1559
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1558
- /bin/cat
  cat /proc/324/cmdline
  2⤵
  PID:1557
- /bin/grep
  grep -q .r1
  2⤵
  PID:1562
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1561
- /bin/cat
  cat /proc/326/cmdline
  2⤵
  PID:1560
- /bin/grep
  grep -q .r1
  2⤵
  PID:1566
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1565
- /bin/cat
  cat /proc/327/cmdline
  2⤵
  PID:1564
- /bin/grep
  grep -q .r1
  2⤵
  PID:1569
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1568
- /bin/cat
  cat /proc/330/cmdline
  2⤵
  PID:1567
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1572
- /bin/cat
  cat /proc/331/cmdline
  2⤵
  PID:1571
- /bin/grep
  grep -q .r1
  2⤵
  PID:1573
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1575
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:1574
- /bin/grep
  grep -q .r1
  2⤵
  PID:1576
- /bin/grep
  grep -q .r1
  2⤵
  PID:1580
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1579
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  - Reads runtime system information
  PID:1578
- /bin/grep
  grep -q .r1
  2⤵
  PID:1583
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1582
- /bin/cat
  cat /proc/381/cmdline
  2⤵
  PID:1581
- /bin/grep
  grep -q .r1
  2⤵
  PID:1586
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1585
- /bin/cat
  cat /proc/382/cmdline
  2⤵
  PID:1584
- /bin/grep
  grep -q .r1
  2⤵
  PID:1590
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1589
- /bin/cat
  cat /proc/385/cmdline
  2⤵
  PID:1588
- /bin/grep
  grep -q .r1
  2⤵
  PID:1594
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1593
- /bin/cat
  cat /proc/388/cmdline
  2⤵
  - Reads runtime system information
  PID:1592
- /bin/grep
  grep -q .r1
  2⤵
  PID:1597
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1596
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:1595
- /bin/grep
  grep -q .r1
  2⤵
  PID:1601
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1600
- /bin/cat
  cat /proc/441/cmdline
  2⤵
  PID:1599
- /bin/grep
  grep -q .r1
  2⤵
  PID:1605
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1604
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  PID:1603
- /bin/grep
  grep -q .r1
  2⤵
  PID:1608
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1607
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:1606
- /bin/grep
  grep -q .r1
  2⤵
  PID:1611
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1610
- /bin/cat
  cat /proc/665/cmdline
  2⤵
  PID:1609
- /bin/grep
  grep -q .r1
  2⤵
  PID:1615
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1614
- /bin/cat
  cat /proc/674/cmdline
  2⤵
  PID:1613
- /bin/grep
  grep -q .r1
  2⤵
  PID:1619
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1618
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  - Reads runtime system information
  PID:1617
- /bin/grep
  grep -q .r1
  2⤵
  PID:1622
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1621
- /bin/cat
  cat /proc/679/cmdline
  2⤵
  PID:1620
- /bin/grep
  grep -q .r1
  2⤵
  PID:1626
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1625
- /bin/cat
  cat /proc/68/cmdline
  2⤵
  PID:1624
- /bin/grep
  grep -q .r1
  2⤵
  PID:1629
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1628
- /bin/cat
  cat /proc/680/cmdline
  2⤵
  PID:1627
- /bin/grep
  grep -q .r1
  2⤵
  PID:1633
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1632
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  PID:1631
- /bin/grep
  grep -q .r1
  2⤵
  PID:1636
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1635
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1634
- /bin/grep
  grep -q .r1
  2⤵
  PID:1639
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1638
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  PID:1637
- /bin/grep
  grep -q .r1
  2⤵
  PID:1642
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1641
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  PID:1640
- /bin/grep
  grep -q .r1
  2⤵
  PID:1645
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1644
- /bin/cat
  cat /proc/710/cmdline
  2⤵
  PID:1643
- /bin/grep
  grep -q .r1
  2⤵
  PID:1648
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1647
- /bin/cat
  cat /proc/712/cmdline
  2⤵
  PID:1646
- /bin/grep
  grep -q .r1
  2⤵
  PID:1651
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1650
- /bin/cat
  cat /proc/713/cmdline
  2⤵
  PID:1649
- /bin/grep
  grep -q .r1
  2⤵
  PID:1654
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1653
- /bin/cat
  cat /proc/714/cmdline
  2⤵
  PID:1652
- /bin/grep
  grep -q .r1
  2⤵
  PID:1657
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1656
- /bin/cat
  cat /proc/72/cmdline
  2⤵
  PID:1655
- /bin/grep
  grep -q .r1
  2⤵
  PID:1660
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1659
- /bin/cat
  cat /proc/726/cmdline
  2⤵
  PID:1658
- /bin/grep
  grep -q .r1
  2⤵
  PID:1663
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1662
- /bin/cat
  cat /proc/73/cmdline
  2⤵
  PID:1661
- /bin/grep
  grep -q .r1
  2⤵
  PID:1666
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1665
- /bin/cat
  cat /proc/76/cmdline
  2⤵
  PID:1664
- /bin/grep
  grep -q .r1
  2⤵
  PID:1669
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1668
- /bin/cat
  cat /proc/77/cmdline
  2⤵
  PID:1667
- /bin/grep
  grep -q .r1
  2⤵
  PID:1672
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1671
- /bin/cat
  cat /proc/79/cmdline
  2⤵
  PID:1670
- /bin/grep
  grep -q .r1
  2⤵
  PID:1675
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1674
- /bin/cat
  cat /proc/8/cmdline
  2⤵
  PID:1673
- /bin/grep
  grep -q .r1
  2⤵
  PID:1678
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1677
- /bin/cat
  cat /proc/81/cmdline
  2⤵
  - Reads runtime system information
  PID:1676
- /bin/grep
  grep -q .r1
  2⤵
  PID:1681
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1680
- /bin/cat
  cat /proc/83/cmdline
  2⤵
  PID:1679
- /bin/grep
  grep -q .r1
  2⤵
  PID:1684
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1683
- /bin/cat
  cat /proc/9/cmdline
  2⤵
  PID:1682
- /bin/grep
  grep -q .r2
  2⤵
  PID:1687
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1686
- /bin/cat
  cat /proc/1/cmdline
  2⤵
  PID:1685
- /bin/grep
  grep -q .r2
  2⤵
  PID:1690
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1689
- /bin/cat
  cat /proc/10/cmdline
  2⤵
  PID:1688
- /bin/grep
  grep -q .r2
  2⤵
  PID:1693
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1692
- /bin/cat
  cat /proc/109/cmdline
  2⤵
  PID:1691
- /bin/grep
  grep -q .r2
  2⤵
  PID:1696
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1695
- /bin/cat
  cat /proc/11/cmdline
  2⤵
  PID:1694
- /bin/grep
  grep -q .r2
  2⤵
  PID:1699
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1698
- /bin/cat
  cat /proc/12/cmdline
  2⤵
  PID:1697
- /bin/grep
  grep -q .r2
  2⤵
  PID:1702
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1701
- /bin/cat
  cat /proc/120/cmdline
  2⤵
  PID:1700
- /bin/grep
  grep -q .r2
  2⤵
  PID:1705
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1704
- /bin/cat
  cat /proc/121/cmdline
  2⤵
  PID:1703
- /bin/grep
  grep -q .r2
  2⤵
  PID:1708
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1707
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:1706
- /bin/grep
  grep -q .r2
  2⤵
  PID:1711
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1710
- /bin/cat
  cat /proc/14/cmdline
  2⤵
  PID:1709
- /bin/grep
  grep -q .r2
  2⤵
  PID:1714
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1713
- /bin/cat
  cat /proc/15/cmdline
  2⤵
  PID:1712
- /bin/grep
  grep -q .r2
  2⤵
  PID:1717
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1716
- /bin/cat
  cat /proc/152/cmdline
  2⤵
  - Reads runtime system information
  PID:1715
- /bin/grep
  grep -q .r2
  2⤵
  PID:1720
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1719
- /bin/cat
  cat /proc/16/cmdline
  2⤵
  PID:1718
- /bin/grep
  grep -q .r2
  2⤵
  PID:1723
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1722
- /bin/cat
  cat /proc/160/cmdline
  2⤵
  - Reads runtime system information
  PID:1721
- /bin/grep
  grep -q .r2
  2⤵
  PID:1726
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1725
- /bin/cat
  cat /proc/17/cmdline
  2⤵
  PID:1724
- /bin/grep
  grep -q .r2
  2⤵
  PID:1729
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1728
- /bin/cat
  cat /proc/175/cmdline
  2⤵
  PID:1727
- /bin/grep
  grep -q .r2
  2⤵
  PID:1732
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1731
- /bin/cat
  cat /proc/18/cmdline
  2⤵
  PID:1730
- /bin/grep
  grep -q .r2
  2⤵
  PID:1735
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1734
- /bin/cat
  cat /proc/19/cmdline
  2⤵
  PID:1733
- /bin/grep
  grep -q .r2
  2⤵
  PID:1738
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1737
- /bin/cat
  cat /proc/2/cmdline
  2⤵
  PID:1736
- /bin/grep
  grep -q .r2
  2⤵
  PID:1741
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1740
- /bin/cat
  cat /proc/20/cmdline
  2⤵
  - Reads runtime system information
  PID:1739
- /bin/grep
  grep -q .r2
  2⤵
  PID:1744
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1743
- /bin/cat
  cat /proc/21/cmdline
  2⤵
  PID:1742
- /bin/grep
  grep -q .r2
  2⤵
  PID:1747
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1746
- /bin/cat
  cat /proc/22/cmdline
  2⤵
  PID:1745
- /bin/grep
  grep -q .r2
  2⤵
  PID:1750
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1749
- /bin/cat
  cat /proc/23/cmdline
  2⤵
  PID:1748
- /bin/grep
  grep -q .r2
  2⤵
  PID:1753
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1752
- /bin/cat
  cat /proc/237/cmdline
  2⤵
  PID:1751
- /bin/grep
  grep -q .r2
  2⤵
  PID:1756
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1755
- /bin/cat
  cat /proc/24/cmdline
  2⤵
  - Reads runtime system information
  PID:1754
- /bin/grep
  grep -q .r2
  2⤵
  PID:1759
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1758
- /bin/cat
  cat /proc/3/cmdline
  2⤵
  PID:1757
- /bin/grep
  grep -q .r2
  2⤵
  PID:1762
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1761
- /bin/cat
  cat /proc/324/cmdline
  2⤵
  PID:1760
- /bin/grep
  grep -q .r2
  2⤵
  PID:1765
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1764
- /bin/cat
  cat /proc/326/cmdline
  2⤵
  PID:1763
- /bin/grep
  grep -q .r2
  2⤵
  PID:1768
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1767
- /bin/cat
  cat /proc/327/cmdline
  2⤵
  - Reads runtime system information
  PID:1766
- /bin/grep
  grep -q .r2
  2⤵
  PID:1771
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1770
- /bin/cat
  cat /proc/330/cmdline
  2⤵
  - Reads runtime system information
  PID:1769
- /bin/grep
  grep -q .r2
  2⤵
  PID:1774
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1773
- /bin/cat
  cat /proc/331/cmdline
  2⤵
  PID:1772
- /bin/grep
  grep -q .r2
  2⤵
  PID:1777
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1776
- /bin/cat
  cat /proc/36/cmdline
  2⤵
  PID:1775
- /bin/grep
  grep -q .r2
  2⤵
  PID:1780
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1779
- /bin/cat
  cat /proc/37/cmdline
  2⤵
  - Reads runtime system information
  PID:1778
- /bin/grep
  grep -q .r2
  2⤵
  PID:1783
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1782
- /bin/cat
  cat /proc/381/cmdline
  2⤵
  PID:1781
- /bin/grep
  grep -q .r2
  2⤵
  PID:1786
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1785
- /bin/cat
  cat /proc/382/cmdline
  2⤵
  PID:1784
- /bin/grep
  grep -q .r2
  2⤵
  PID:1789
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1788
- /bin/cat
  cat /proc/385/cmdline
  2⤵
  PID:1787
- /bin/grep
  grep -q .r2
  2⤵
  PID:1792
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1791
- /bin/cat
  cat /proc/388/cmdline
  2⤵
  - Reads runtime system information
  PID:1790
- /bin/grep
  grep -q .r2
  2⤵
  PID:1795
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1794
- /bin/cat
  cat /proc/4/cmdline
  2⤵
  PID:1793
- /bin/grep
  grep -q .r2
  2⤵
  PID:1798
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1797
- /bin/cat
  cat /proc/441/cmdline
  2⤵
  PID:1796
- /bin/grep
  grep -q .r2
  2⤵
  PID:1801
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1800
- /bin/cat
  cat /proc/5/cmdline
  2⤵
  - Reads runtime system information
  PID:1799
- /bin/grep
  grep -q .r2
  2⤵
  PID:1804
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1803
- /bin/cat
  cat /proc/6/cmdline
  2⤵
  PID:1802
- /bin/grep
  grep -q .r2
  2⤵
  PID:1807
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1806
- /bin/cat
  cat /proc/665/cmdline
  2⤵
  PID:1805
- /bin/grep
  grep -q .r2
  2⤵
  PID:1810
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1809
- /bin/cat
  cat /proc/674/cmdline
  2⤵
  PID:1808
- /bin/grep
  grep -q .r2
  2⤵
  PID:1813
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1812
- /bin/cat
  cat /proc/677/cmdline
  2⤵
  PID:1811
- /bin/grep
  grep -q .r2
  2⤵
  PID:1816
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1815
- /bin/cat
  cat /proc/679/cmdline
  2⤵
  PID:1814
- /bin/grep
  grep -q .r2
  2⤵
  PID:1819
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1818
- /bin/cat
  cat /proc/68/cmdline
  2⤵
  PID:1817
- /bin/grep
  grep -q .r2
  2⤵
  PID:1822
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1821
- /bin/cat
  cat /proc/680/cmdline
  2⤵
  PID:1820
- /bin/grep
  grep -q .r2
  2⤵
  PID:1825
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1824
- /bin/cat
  cat /proc/69/cmdline
  2⤵
  - Reads runtime system information
  PID:1823
- /bin/grep
  grep -q .r2
  2⤵
  PID:1828
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1827
- /bin/cat
  cat /proc/7/cmdline
  2⤵
  PID:1826
- /bin/grep
  grep -q .r2
  2⤵
  PID:1831
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1830
- /bin/cat
  cat /proc/70/cmdline
  2⤵
  - Reads runtime system information
  PID:1829
- /bin/grep
  grep -q .r2
  2⤵
  PID:1834
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1833
- /bin/cat
  cat /proc/71/cmdline
  2⤵
  - Reads runtime system information
  PID:1832
- /bin/grep
  grep -q .r2
  2⤵
  PID:1837
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1836
- /bin/cat
  cat /proc/710/cmdline
  2⤵
  PID:1835
- /bin/grep
  grep -q .r2
  2⤵
  PID:1840
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:1839
- /bin/cat
  cat /proc/712/cmdline
  2⤵
  - Reads runtime system information
  PID:1838

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.r1

Path /tmp/.r1
Size 129KB
SHA256 931006bf7a74a2f3a38acf54cbd26598c000e3206212633f0c7fe581bf7e91a2
MD5 20446661d9d1c01a1d961a5014d1edf0
SHA1 f2fa2f38892c9d6586d5268c2bfe91d4e6084e5d
SHA512 61ff384d5f8afa39d91d85d2f96bca0a30aac7d08f62d71e956e88dd4f5847428dbb816908afa8ca52c8cfa0bb783045ae8c4c8f0d72b2a27d49877f4966b2dc
SSDEEP 3072:K6mLO3ClOAvRCbLMETMWrneInEdF7o2l:TClJvRWLbMWrnZEz7o2l
TLSH
T15AD36C03DF940F9FC4AFCE70827E825719E68C8B83D1A66A517C8D8CB6BD25646D784C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.r2

Path /tmp/.r2
Size 129KB
SHA256 aeeed924d51367cac9d17fbcec0a557fee13d36de3e487fd2e94df3df5da767c
MD5 45fe3c58f38956655ac7bacd71e3557c
SHA1 789f0d23fd2f91d533f89a5d14c66932aaeda568
SHA512 5837a81a03e3c80660f8528c4101597246bc8f810c67d360fe18eb5c248b2a888d9746b98084505d3bba9da45b47ca9102195dc4a870a7b54a9a51c7121676d4
SSDEEP 1536:R3t/2DgnWwD4HhKtQnz7dH6EH9Btlk+rKoiJQwMqGq5hOSlFRMrrxxttttCVs:R3JccD4HhIQnzRBbN8QHDq5lFefxj
TLSH
T1D2D35D8377114FD0C319E37109F74A669EDA1A830AF29AC1537DDA207B31A69781BFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 8c797336892b80a4bc109f83acb4b13a42f20acae4fb25c9894df38be5c91483
MD5 ab6093a2206716f556e9030cabda321e
SHA1 7a92b70e37cf58df4dd38bbbf7ca4e73cbd6b922
SHA512 94334dbbf5c2cb8826e6fde897f1162bfa41075f8df48c196d825e25d4252437983516df15cae75289ba46fe092882bbb3f15a49580d86b0fea92a85781b2bc0
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 eb540e7a43635821ce78212964da221b7d5a521d90c6ee54b17b37acc93caf9a
MD5 e784aa7983286790702e243a4ace6e27
SHA1 39063f211fcee3275b0888aa9eab5cf0be1c8a96
SHA512 9b5ea9bf4930b10331b493332bc05922610f7cdd2506d01a37d6871133c66cd9a36e2300077e070010891ae536669d6fc2fdca575313c49523cc0350aed02aa4
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 49c3f590d9a08e5d6aa461c23d397b889a64af48107688b3c833b440a5c805e9
MD5 89806e84c8cd3da5aa53c15a8acc16f1
SHA1 95014f6c7212499e813f7349b09100408769617e
SHA512 3f1427961c37c5de5c3ce37aabc0753adb4ffeef910ef21ee0b95da0cc88f40fc5db5a391cc94ff8f8289aadafc65ad152b4a7ec0edb7ec84729f8a632115f2a
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 e7f334f7b34b6c97cf46d39e776bdeef4b4a5881cabc73c52704048fbcf7b0d5
MD5 c5bdf1ca7914ca9d96315b34a9693e9e
SHA1 d99c4c10a78c3216ec4bf6bdd91bdbada52d81c6
SHA512 45f4cbc351749ef0231f9fa622eb94655534278de338f9f254b358aa3640b2861ab2578e4b92f8ebf8a7ca97c1f70b2c1aaf983fc05319bf95993707381550cd
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 8ad709c84a72a1f3360c65acf7cc5e6646d6057b7e22af05c93388e4448b2e9d
MD5 bff4ecf5af43d4978e81b34b562f128c
SHA1 42c0ceaf0b568a5d14bd2677f532cfcb7dc3d660
SHA512 032d81056c6f240301cb5f9d7630652ca0a2af413caed49cc9e1522df517c8c77f517766b1f8cb6b3834fe93c566f097d8b6a7d89cd825f72be05beff9ff0dd1
MD5 SHA1 SHA512

Submit Download

.r8xp

Path /tmp/.r8xp
Size 5B
SHA256 742671d8850c1ba717583918e60f661214570c53b5015e1d850302bb9c129af2
MD5 925d65f6b0af97a248b1f82705a1eab9
SHA1 aabba0769b185df0ea5e210c92c8b8a6719f0959
SHA512 d37a3de0c64db1d0a7e96727d2244f1c389c5091d8578a9c4e51d6cec9dc848b09d181e4c5f5032c876b36069d35f0c092efe63659694e14b2ec2c45ec8102dd
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads