MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8
SHA3-384 hash: 97e90224eb9139d384ca62fdbd07e4960deb6cb41c8642fbd4952fe5a3f2374d104e544ac80b45a8a90122116d9204e2
SHA1 hash: d2bb2fdd4a12a1deaa28f89d1107197ab51e46ff
MD5 hash: 489cc8b6e89796bfa695402537227ecd
humanhash: eleven-south-tennessee-juliet
File name:install.sh
Download: download sample
Signature CoinMiner
Create hunting rule
File size:92'445 bytes
First seen:2026-08-10 14:27:39 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:6OY4c9t0v50fiAfQO96fKwtgiLgPjUbuK5puCLAqp1BDkcE4zvA4SNtrw1iTDDoN:9Yi0ffmcWpuK5puCLAqpPDkcE4racsEf
TLSH T15D93A7B6B560C1703978C16C678B41506A4A703B355C382474AFB91CBFEC758A1FABBE
TrID 41.1% (.SH) Linux/UNIX shell script (7000/1)
41.1% (.UCF) Xilinx User Constraints File (7000/1/3)
17.6% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:CoinMiner sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
15
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bash evasive lolbin
Link:
https://www.filescan.io/uploads/6a79e03669834dc68069551e/reports/5be77b1b-3ea6-4777-bca5-c1a2efeb2fe2/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b3652979-13c0-4f7f-9a02-173cfb625ae9
Behavior Graph:
Download SVG
%3 guuid=d0651fdc-1700-0000-634c-b4558b0d0000 pid=3467 /usr/bin/sudo guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474 /tmp/sample.bin write-config guuid=d0651fdc-1700-0000-634c-b4558b0d0000 pid=3467->guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474 execve guuid=aba2bdde-1700-0000-634c-b455950d0000 pid=3477 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=aba2bdde-1700-0000-634c-b455950d0000 pid=3477 clone guuid=94f644df-1700-0000-634c-b455980d0000 pid=3480 /usr/bin/basename guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=94f644df-1700-0000-634c-b455980d0000 pid=3480 execve guuid=cf9bacdf-1700-0000-634c-b4559b0d0000 pid=3483 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=cf9bacdf-1700-0000-634c-b4559b0d0000 pid=3483 execve guuid=d1155ee4-1700-0000-634c-b455a40d0000 pid=3492 /usr/bin/chattr guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d1155ee4-1700-0000-634c-b455a40d0000 pid=3492 execve guuid=315205e5-1700-0000-634c-b455a70d0000 pid=3495 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=315205e5-1700-0000-634c-b455a70d0000 pid=3495 clone guuid=b50ce1ea-1700-0000-634c-b455b80d0000 pid=3512 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=b50ce1ea-1700-0000-634c-b455b80d0000 pid=3512 clone guuid=29730bee-1700-0000-634c-b455c20d0000 pid=3522 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=29730bee-1700-0000-634c-b455c20d0000 pid=3522 clone guuid=caf58ef1-1700-0000-634c-b455c70d0000 pid=3527 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=caf58ef1-1700-0000-634c-b455c70d0000 pid=3527 clone guuid=1adcdefb-1700-0000-634c-b455e30d0000 pid=3555 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1adcdefb-1700-0000-634c-b455e30d0000 pid=3555 clone guuid=d3c3ba05-1800-0000-634c-b455e50d0000 pid=3557 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d3c3ba05-1800-0000-634c-b455e50d0000 pid=3557 clone guuid=09b1a70a-1800-0000-634c-b455ea0d0000 pid=3562 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=09b1a70a-1800-0000-634c-b455ea0d0000 pid=3562 clone guuid=3530c00d-1800-0000-634c-b455f30d0000 pid=3571 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=3530c00d-1800-0000-634c-b455f30d0000 pid=3571 clone guuid=806b8d15-1800-0000-634c-b455f70d0000 pid=3575 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=806b8d15-1800-0000-634c-b455f70d0000 pid=3575 clone guuid=48c45b1b-1800-0000-634c-b455070e0000 pid=3591 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=48c45b1b-1800-0000-634c-b455070e0000 pid=3591 clone guuid=952cfb20-1800-0000-634c-b455180e0000 pid=3608 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=952cfb20-1800-0000-634c-b455180e0000 pid=3608 clone guuid=1a440427-1800-0000-634c-b455300e0000 pid=3632 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1a440427-1800-0000-634c-b455300e0000 pid=3632 clone guuid=c11e462c-1800-0000-634c-b4553f0e0000 pid=3647 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c11e462c-1800-0000-634c-b4553f0e0000 pid=3647 clone guuid=bbeef430-1800-0000-634c-b4554c0e0000 pid=3660 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=bbeef430-1800-0000-634c-b4554c0e0000 pid=3660 clone guuid=9b34c035-1800-0000-634c-b455580e0000 pid=3672 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9b34c035-1800-0000-634c-b455580e0000 pid=3672 clone guuid=690b363a-1800-0000-634c-b455670e0000 pid=3687 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=690b363a-1800-0000-634c-b455670e0000 pid=3687 clone guuid=003a7c3e-1800-0000-634c-b455790e0000 pid=3705 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=003a7c3e-1800-0000-634c-b455790e0000 pid=3705 clone guuid=56731746-1800-0000-634c-b455990e0000 pid=3737 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=56731746-1800-0000-634c-b455990e0000 pid=3737 clone guuid=9b20144e-1800-0000-634c-b455a70e0000 pid=3751 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9b20144e-1800-0000-634c-b455a70e0000 pid=3751 clone guuid=61b71957-1800-0000-634c-b455c30e0000 pid=3779 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=61b71957-1800-0000-634c-b455c30e0000 pid=3779 clone guuid=99ddf45f-1800-0000-634c-b455dd0e0000 pid=3805 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=99ddf45f-1800-0000-634c-b455dd0e0000 pid=3805 clone guuid=b8d8b568-1800-0000-634c-b455f80e0000 pid=3832 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=b8d8b568-1800-0000-634c-b455f80e0000 pid=3832 clone guuid=1194016f-1800-0000-634c-b455040f0000 pid=3844 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1194016f-1800-0000-634c-b455040f0000 pid=3844 clone guuid=042cc372-1800-0000-634c-b455130f0000 pid=3859 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=042cc372-1800-0000-634c-b455130f0000 pid=3859 clone guuid=80c95f76-1800-0000-634c-b455240f0000 pid=3876 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=80c95f76-1800-0000-634c-b455240f0000 pid=3876 clone guuid=d550957d-1800-0000-634c-b4552c0f0000 pid=3884 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d550957d-1800-0000-634c-b4552c0f0000 pid=3884 clone guuid=c2f9c983-1800-0000-634c-b4553f0f0000 pid=3903 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c2f9c983-1800-0000-634c-b4553f0f0000 pid=3903 clone guuid=83b8d088-1800-0000-634c-b455500f0000 pid=3920 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=83b8d088-1800-0000-634c-b455500f0000 pid=3920 clone guuid=1d55c68d-1800-0000-634c-b455640f0000 pid=3940 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1d55c68d-1800-0000-634c-b455640f0000 pid=3940 clone guuid=58a57893-1800-0000-634c-b455770f0000 pid=3959 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=58a57893-1800-0000-634c-b455770f0000 pid=3959 clone guuid=a2741999-1800-0000-634c-b4558d0f0000 pid=3981 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a2741999-1800-0000-634c-b4558d0f0000 pid=3981 clone guuid=4446759d-1800-0000-634c-b4559a0f0000 pid=3994 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=4446759d-1800-0000-634c-b4559a0f0000 pid=3994 clone guuid=42f941a0-1800-0000-634c-b455a60f0000 pid=4006 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=42f941a0-1800-0000-634c-b455a60f0000 pid=4006 clone guuid=d9d7f2a3-1800-0000-634c-b455b30f0000 pid=4019 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d9d7f2a3-1800-0000-634c-b455b30f0000 pid=4019 clone guuid=54a351aa-1800-0000-634c-b455bd0f0000 pid=4029 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=54a351aa-1800-0000-634c-b455bd0f0000 pid=4029 clone guuid=2d8152b1-1800-0000-634c-b455c80f0000 pid=4040 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2d8152b1-1800-0000-634c-b455c80f0000 pid=4040 clone guuid=15e3f2b6-1800-0000-634c-b455dc0f0000 pid=4060 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=15e3f2b6-1800-0000-634c-b455dc0f0000 pid=4060 clone guuid=d859d7bc-1800-0000-634c-b455f50f0000 pid=4085 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d859d7bc-1800-0000-634c-b455f50f0000 pid=4085 clone guuid=f399edc1-1800-0000-634c-b45508100000 pid=4104 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f399edc1-1800-0000-634c-b45508100000 pid=4104 clone guuid=cd300cc6-1800-0000-634c-b45515100000 pid=4117 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=cd300cc6-1800-0000-634c-b45515100000 pid=4117 clone guuid=2c8a5ecc-1800-0000-634c-b4551c100000 pid=4124 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2c8a5ecc-1800-0000-634c-b4551c100000 pid=4124 clone guuid=5fd1a0d3-1800-0000-634c-b4552c100000 pid=4140 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=5fd1a0d3-1800-0000-634c-b4552c100000 pid=4140 clone guuid=c8f966d9-1800-0000-634c-b45540100000 pid=4160 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c8f966d9-1800-0000-634c-b45540100000 pid=4160 clone guuid=0d6ec3de-1800-0000-634c-b45555100000 pid=4181 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0d6ec3de-1800-0000-634c-b45555100000 pid=4181 clone guuid=992d08e3-1800-0000-634c-b45564100000 pid=4196 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=992d08e3-1800-0000-634c-b45564100000 pid=4196 clone guuid=1c3d09e7-1800-0000-634c-b45574100000 pid=4212 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1c3d09e7-1800-0000-634c-b45574100000 pid=4212 clone guuid=fa52a4eb-1800-0000-634c-b45586100000 pid=4230 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fa52a4eb-1800-0000-634c-b45586100000 pid=4230 clone guuid=2f013af1-1800-0000-634c-b4559c100000 pid=4252 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2f013af1-1800-0000-634c-b4559c100000 pid=4252 clone guuid=34427af6-1800-0000-634c-b455ab100000 pid=4267 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=34427af6-1800-0000-634c-b455ab100000 pid=4267 clone guuid=63235cfc-1800-0000-634c-b455ba100000 pid=4282 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=63235cfc-1800-0000-634c-b455ba100000 pid=4282 clone guuid=736c8c00-1900-0000-634c-b455c7100000 pid=4295 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=736c8c00-1900-0000-634c-b455c7100000 pid=4295 clone guuid=356ea705-1900-0000-634c-b455d6100000 pid=4310 /usr/bin/rm guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=356ea705-1900-0000-634c-b455d6100000 pid=4310 execve guuid=1dbe2706-1900-0000-634c-b455d7100000 pid=4311 /usr/bin/chattr guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1dbe2706-1900-0000-634c-b455d7100000 pid=4311 execve guuid=a9f2c106-1900-0000-634c-b455db100000 pid=4315 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a9f2c106-1900-0000-634c-b455db100000 pid=4315 execve guuid=86428507-1900-0000-634c-b455df100000 pid=4319 /usr/bin/chattr guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=86428507-1900-0000-634c-b455df100000 pid=4319 execve guuid=137b3208-1900-0000-634c-b455e3100000 pid=4323 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=137b3208-1900-0000-634c-b455e3100000 pid=4323 execve guuid=00cec308-1900-0000-634c-b455e7100000 pid=4327 /usr/bin/chattr guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=00cec308-1900-0000-634c-b455e7100000 pid=4327 execve guuid=87753509-1900-0000-634c-b455e9100000 pid=4329 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=87753509-1900-0000-634c-b455e9100000 pid=4329 execve guuid=ca21bf09-1900-0000-634c-b455eb100000 pid=4331 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=ca21bf09-1900-0000-634c-b455eb100000 pid=4331 execve guuid=2648550a-1900-0000-634c-b455ef100000 pid=4335 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2648550a-1900-0000-634c-b455ef100000 pid=4335 execve guuid=a304ef0a-1900-0000-634c-b455f3100000 pid=4339 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a304ef0a-1900-0000-634c-b455f3100000 pid=4339 execve guuid=55a07e0b-1900-0000-634c-b455f5100000 pid=4341 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=55a07e0b-1900-0000-634c-b455f5100000 pid=4341 execve guuid=9d330c0c-1900-0000-634c-b455f8100000 pid=4344 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9d330c0c-1900-0000-634c-b455f8100000 pid=4344 execve guuid=31179a0c-1900-0000-634c-b455fa100000 pid=4346 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=31179a0c-1900-0000-634c-b455fa100000 pid=4346 execve guuid=2ac0300d-1900-0000-634c-b455fc100000 pid=4348 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2ac0300d-1900-0000-634c-b455fc100000 pid=4348 clone guuid=fdc5f711-1900-0000-634c-b4550c110000 pid=4364 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fdc5f711-1900-0000-634c-b4550c110000 pid=4364 clone guuid=fd41d315-1900-0000-634c-b4551f110000 pid=4383 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fd41d315-1900-0000-634c-b4551f110000 pid=4383 clone guuid=2f847d1a-1900-0000-634c-b4552d110000 pid=4397 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2f847d1a-1900-0000-634c-b4552d110000 pid=4397 execve guuid=20a0171b-1900-0000-634c-b4552e110000 pid=4398 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=20a0171b-1900-0000-634c-b4552e110000 pid=4398 execve guuid=4636b61b-1900-0000-634c-b45530110000 pid=4400 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=4636b61b-1900-0000-634c-b45530110000 pid=4400 execve guuid=28d77a1e-1900-0000-634c-b4553c110000 pid=4412 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=28d77a1e-1900-0000-634c-b4553c110000 pid=4412 clone guuid=f2b43a28-1900-0000-634c-b45550110000 pid=4432 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f2b43a28-1900-0000-634c-b45550110000 pid=4432 clone guuid=c4ac772d-1900-0000-634c-b4555f110000 pid=4447 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c4ac772d-1900-0000-634c-b4555f110000 pid=4447 clone guuid=e6efe630-1900-0000-634c-b45570110000 pid=4464 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=e6efe630-1900-0000-634c-b45570110000 pid=4464 clone guuid=b0cece33-1900-0000-634c-b4557c110000 pid=4476 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=b0cece33-1900-0000-634c-b4557c110000 pid=4476 clone guuid=153e3d38-1900-0000-634c-b4558e110000 pid=4494 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=153e3d38-1900-0000-634c-b4558e110000 pid=4494 clone guuid=535f0f3d-1900-0000-634c-b4559d110000 pid=4509 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=535f0f3d-1900-0000-634c-b4559d110000 pid=4509 clone guuid=d89ddc41-1900-0000-634c-b455a8110000 pid=4520 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d89ddc41-1900-0000-634c-b455a8110000 pid=4520 clone guuid=122b7746-1900-0000-634c-b455b4110000 pid=4532 /usr/bin/chattr guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=122b7746-1900-0000-634c-b455b4110000 pid=4532 execve guuid=f7d3d746-1900-0000-634c-b455b5110000 pid=4533 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f7d3d746-1900-0000-634c-b455b5110000 pid=4533 execve guuid=237a4647-1900-0000-634c-b455b9110000 pid=4537 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=237a4647-1900-0000-634c-b455b9110000 pid=4537 execve guuid=748faa47-1900-0000-634c-b455bb110000 pid=4539 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=748faa47-1900-0000-634c-b455bb110000 pid=4539 execve guuid=0f750448-1900-0000-634c-b455be110000 pid=4542 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0f750448-1900-0000-634c-b455be110000 pid=4542 execve guuid=0d076248-1900-0000-634c-b455c2110000 pid=4546 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0d076248-1900-0000-634c-b455c2110000 pid=4546 execve guuid=1309ba48-1900-0000-634c-b455c3110000 pid=4547 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1309ba48-1900-0000-634c-b455c3110000 pid=4547 execve guuid=95c03249-1900-0000-634c-b455c7110000 pid=4551 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=95c03249-1900-0000-634c-b455c7110000 pid=4551 execve guuid=b1deb749-1900-0000-634c-b455cb110000 pid=4555 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=b1deb749-1900-0000-634c-b455cb110000 pid=4555 execve guuid=6d712a4a-1900-0000-634c-b455cd110000 pid=4557 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=6d712a4a-1900-0000-634c-b455cd110000 pid=4557 execve guuid=921a904a-1900-0000-634c-b455cf110000 pid=4559 /usr/bin/lsattr guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=921a904a-1900-0000-634c-b455cf110000 pid=4559 execve guuid=f983994a-1900-0000-634c-b455d0110000 pid=4560 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f983994a-1900-0000-634c-b455d0110000 pid=4560 execve guuid=3eef2d4b-1900-0000-634c-b455d4110000 pid=4564 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=3eef2d4b-1900-0000-634c-b455d4110000 pid=4564 clone guuid=dc913b4b-1900-0000-634c-b455d5110000 pid=4565 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=dc913b4b-1900-0000-634c-b455d5110000 pid=4565 execve guuid=1cd6d94b-1900-0000-634c-b455d9110000 pid=4569 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1cd6d94b-1900-0000-634c-b455d9110000 pid=4569 clone guuid=85a3e24b-1900-0000-634c-b455da110000 pid=4570 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=85a3e24b-1900-0000-634c-b455da110000 pid=4570 execve guuid=1fb07f4c-1900-0000-634c-b455dc110000 pid=4572 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1fb07f4c-1900-0000-634c-b455dc110000 pid=4572 clone guuid=ffc68c4c-1900-0000-634c-b455dd110000 pid=4573 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=ffc68c4c-1900-0000-634c-b455dd110000 pid=4573 execve guuid=c60d2f4d-1900-0000-634c-b455df110000 pid=4575 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c60d2f4d-1900-0000-634c-b455df110000 pid=4575 clone guuid=5691374d-1900-0000-634c-b455e0110000 pid=4576 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=5691374d-1900-0000-634c-b455e0110000 pid=4576 execve guuid=0af6c14d-1900-0000-634c-b455e2110000 pid=4578 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0af6c14d-1900-0000-634c-b455e2110000 pid=4578 clone guuid=a406cc4d-1900-0000-634c-b455e4110000 pid=4580 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a406cc4d-1900-0000-634c-b455e4110000 pid=4580 execve guuid=896e6e4e-1900-0000-634c-b455e6110000 pid=4582 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=896e6e4e-1900-0000-634c-b455e6110000 pid=4582 clone guuid=5328784e-1900-0000-634c-b455e7110000 pid=4583 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=5328784e-1900-0000-634c-b455e7110000 pid=4583 execve guuid=fe32064f-1900-0000-634c-b455eb110000 pid=4587 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fe32064f-1900-0000-634c-b455eb110000 pid=4587 clone guuid=0658164f-1900-0000-634c-b455ec110000 pid=4588 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0658164f-1900-0000-634c-b455ec110000 pid=4588 execve guuid=16b1fa4f-1900-0000-634c-b455ef110000 pid=4591 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=16b1fa4f-1900-0000-634c-b455ef110000 pid=4591 clone guuid=ab630850-1900-0000-634c-b455f0110000 pid=4592 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=ab630850-1900-0000-634c-b455f0110000 pid=4592 execve guuid=4d399450-1900-0000-634c-b455f4110000 pid=4596 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=4d399450-1900-0000-634c-b455f4110000 pid=4596 clone guuid=0de79a50-1900-0000-634c-b455f5110000 pid=4597 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0de79a50-1900-0000-634c-b455f5110000 pid=4597 execve guuid=f8b34151-1900-0000-634c-b455f9110000 pid=4601 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f8b34151-1900-0000-634c-b455f9110000 pid=4601 clone guuid=a9d94b51-1900-0000-634c-b455fa110000 pid=4602 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a9d94b51-1900-0000-634c-b455fa110000 pid=4602 execve guuid=d527e951-1900-0000-634c-b455fd110000 pid=4605 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d527e951-1900-0000-634c-b455fd110000 pid=4605 clone guuid=a325f351-1900-0000-634c-b455fe110000 pid=4606 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a325f351-1900-0000-634c-b455fe110000 pid=4606 execve guuid=c435ad52-1900-0000-634c-b45502120000 pid=4610 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c435ad52-1900-0000-634c-b45502120000 pid=4610 clone guuid=f8eab652-1900-0000-634c-b45503120000 pid=4611 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f8eab652-1900-0000-634c-b45503120000 pid=4611 execve guuid=ee6e5f53-1900-0000-634c-b45507120000 pid=4615 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=ee6e5f53-1900-0000-634c-b45507120000 pid=4615 clone guuid=c1036853-1900-0000-634c-b45508120000 pid=4616 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c1036853-1900-0000-634c-b45508120000 pid=4616 execve guuid=daff1a54-1900-0000-634c-b4550b120000 pid=4619 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=daff1a54-1900-0000-634c-b4550b120000 pid=4619 clone guuid=e4012554-1900-0000-634c-b4550c120000 pid=4620 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=e4012554-1900-0000-634c-b4550c120000 pid=4620 execve guuid=5cb1d054-1900-0000-634c-b45510120000 pid=4624 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=5cb1d054-1900-0000-634c-b45510120000 pid=4624 clone guuid=16c4d954-1900-0000-634c-b45511120000 pid=4625 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=16c4d954-1900-0000-634c-b45511120000 pid=4625 execve guuid=7bbf8d55-1900-0000-634c-b45515120000 pid=4629 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=7bbf8d55-1900-0000-634c-b45515120000 pid=4629 clone guuid=5e7d9755-1900-0000-634c-b45516120000 pid=4630 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=5e7d9755-1900-0000-634c-b45516120000 pid=4630 execve guuid=c0a54756-1900-0000-634c-b45519120000 pid=4633 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c0a54756-1900-0000-634c-b45519120000 pid=4633 clone guuid=a4de5056-1900-0000-634c-b4551a120000 pid=4634 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a4de5056-1900-0000-634c-b4551a120000 pid=4634 execve guuid=7f560457-1900-0000-634c-b4551e120000 pid=4638 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=7f560457-1900-0000-634c-b4551e120000 pid=4638 clone guuid=35060b57-1900-0000-634c-b45520120000 pid=4640 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=35060b57-1900-0000-634c-b45520120000 pid=4640 execve guuid=715a7d57-1900-0000-634c-b45524120000 pid=4644 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=715a7d57-1900-0000-634c-b45524120000 pid=4644 clone guuid=f4d08757-1900-0000-634c-b45525120000 pid=4645 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f4d08757-1900-0000-634c-b45525120000 pid=4645 execve guuid=81ca2458-1900-0000-634c-b45527120000 pid=4647 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=81ca2458-1900-0000-634c-b45527120000 pid=4647 clone guuid=71882e58-1900-0000-634c-b45528120000 pid=4648 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=71882e58-1900-0000-634c-b45528120000 pid=4648 execve guuid=236bb258-1900-0000-634c-b4552c120000 pid=4652 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=236bb258-1900-0000-634c-b4552c120000 pid=4652 clone guuid=6289be58-1900-0000-634c-b4552d120000 pid=4653 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=6289be58-1900-0000-634c-b4552d120000 pid=4653 execve guuid=e1dc8b59-1900-0000-634c-b45531120000 pid=4657 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=e1dc8b59-1900-0000-634c-b45531120000 pid=4657 clone guuid=dda99a59-1900-0000-634c-b45532120000 pid=4658 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=dda99a59-1900-0000-634c-b45532120000 pid=4658 execve guuid=95f89e5a-1900-0000-634c-b45538120000 pid=4664 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=95f89e5a-1900-0000-634c-b45538120000 pid=4664 clone guuid=d32fab5a-1900-0000-634c-b45539120000 pid=4665 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d32fab5a-1900-0000-634c-b45539120000 pid=4665 execve guuid=7459ae5b-1900-0000-634c-b4553d120000 pid=4669 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=7459ae5b-1900-0000-634c-b4553d120000 pid=4669 clone guuid=2e74ba5b-1900-0000-634c-b4553e120000 pid=4670 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2e74ba5b-1900-0000-634c-b4553e120000 pid=4670 execve guuid=3bb2a85c-1900-0000-634c-b45541120000 pid=4673 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=3bb2a85c-1900-0000-634c-b45541120000 pid=4673 clone guuid=ebd1b65c-1900-0000-634c-b45542120000 pid=4674 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=ebd1b65c-1900-0000-634c-b45542120000 pid=4674 execve guuid=8e1fb35d-1900-0000-634c-b45549120000 pid=4681 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=8e1fb35d-1900-0000-634c-b45549120000 pid=4681 clone guuid=fb74c55d-1900-0000-634c-b4554a120000 pid=4682 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fb74c55d-1900-0000-634c-b4554a120000 pid=4682 execve guuid=b892a65f-1900-0000-634c-b45550120000 pid=4688 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=b892a65f-1900-0000-634c-b45550120000 pid=4688 clone guuid=05e8af5f-1900-0000-634c-b45551120000 pid=4689 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=05e8af5f-1900-0000-634c-b45551120000 pid=4689 execve guuid=c3531d61-1900-0000-634c-b45557120000 pid=4695 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c3531d61-1900-0000-634c-b45557120000 pid=4695 clone guuid=688e2f61-1900-0000-634c-b45558120000 pid=4696 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=688e2f61-1900-0000-634c-b45558120000 pid=4696 execve guuid=2bddea62-1900-0000-634c-b4555d120000 pid=4701 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2bddea62-1900-0000-634c-b4555d120000 pid=4701 clone guuid=d075ff62-1900-0000-634c-b4555f120000 pid=4703 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d075ff62-1900-0000-634c-b4555f120000 pid=4703 execve guuid=40da9b63-1900-0000-634c-b45561120000 pid=4705 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=40da9b63-1900-0000-634c-b45561120000 pid=4705 clone guuid=e959a563-1900-0000-634c-b45562120000 pid=4706 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=e959a563-1900-0000-634c-b45562120000 pid=4706 execve guuid=4c1e1764-1900-0000-634c-b45564120000 pid=4708 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=4c1e1764-1900-0000-634c-b45564120000 pid=4708 clone guuid=dda22264-1900-0000-634c-b45565120000 pid=4709 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=dda22264-1900-0000-634c-b45565120000 pid=4709 execve guuid=65d3cf64-1900-0000-634c-b45568120000 pid=4712 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=65d3cf64-1900-0000-634c-b45568120000 pid=4712 clone guuid=746edb64-1900-0000-634c-b45569120000 pid=4713 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=746edb64-1900-0000-634c-b45569120000 pid=4713 execve guuid=9ea07965-1900-0000-634c-b4556b120000 pid=4715 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9ea07965-1900-0000-634c-b4556b120000 pid=4715 clone guuid=cd048565-1900-0000-634c-b4556c120000 pid=4716 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=cd048565-1900-0000-634c-b4556c120000 pid=4716 execve guuid=9799f765-1900-0000-634c-b4556d120000 pid=4717 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9799f765-1900-0000-634c-b4556d120000 pid=4717 clone guuid=24880366-1900-0000-634c-b4556f120000 pid=4719 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=24880366-1900-0000-634c-b4556f120000 pid=4719 execve guuid=c88acd66-1900-0000-634c-b45571120000 pid=4721 /usr/bin/cat write-config guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c88acd66-1900-0000-634c-b45571120000 pid=4721 execve guuid=81327d67-1900-0000-634c-b45573120000 pid=4723 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=81327d67-1900-0000-634c-b45573120000 pid=4723 clone guuid=670a9168-1900-0000-634c-b45576120000 pid=4726 /usr/bin/cp guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=670a9168-1900-0000-634c-b45576120000 pid=4726 execve guuid=d0611a69-1900-0000-634c-b45578120000 pid=4728 /usr/bin/chmod guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d0611a69-1900-0000-634c-b45578120000 pid=4728 execve guuid=375f8a69-1900-0000-634c-b4557a120000 pid=4730 /usr/bin/rm delete-file guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=375f8a69-1900-0000-634c-b4557a120000 pid=4730 execve guuid=fe7bfc69-1900-0000-634c-b4557c120000 pid=4732 /usr/bin/grep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fe7bfc69-1900-0000-634c-b4557c120000 pid=4732 execve guuid=63ca816a-1900-0000-634c-b4557d120000 pid=4733 /usr/bin/timeout guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=63ca816a-1900-0000-634c-b4557d120000 pid=4733 execve guuid=9a3e096f-1900-0000-634c-b45586120000 pid=4742 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9a3e096f-1900-0000-634c-b45586120000 pid=4742 execve guuid=7cc88a6f-1900-0000-634c-b4558a120000 pid=4746 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=7cc88a6f-1900-0000-634c-b4558a120000 pid=4746 execve guuid=7bc22570-1900-0000-634c-b4558b120000 pid=4747 /usr/bin/kmod load-kernel-module guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=7bc22570-1900-0000-634c-b4558b120000 pid=4747 execve guuid=f921d372-1900-0000-634c-b45595120000 pid=4757 /usr/bin/apt-cache write-file guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f921d372-1900-0000-634c-b45595120000 pid=4757 execve guuid=d53969b5-1a00-0000-634c-b455cd140000 pid=5325 /usr/bin/apt-cache guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d53969b5-1a00-0000-634c-b455cd140000 pid=5325 execve guuid=88f615bf-1a00-0000-634c-b455e3140000 pid=5347 /usr/bin/timeout guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=88f615bf-1a00-0000-634c-b455e3140000 pid=5347 execve guuid=abdda0c2-1a00-0000-634c-b455e6140000 pid=5350 /usr/bin/mkdir guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=abdda0c2-1a00-0000-634c-b455e6140000 pid=5350 execve guuid=a7909dc3-1a00-0000-634c-b455e7140000 pid=5351 /usr/bin/curl net send-data guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a7909dc3-1a00-0000-634c-b455e7140000 pid=5351 execve guuid=593fb7ea-1a00-0000-634c-b455f4140000 pid=5364 /usr/bin/rm guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=593fb7ea-1a00-0000-634c-b455f4140000 pid=5364 execve guuid=abd8afeb-1a00-0000-634c-b455f5140000 pid=5365 /usr/bin/curl net send-data write-file guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=abd8afeb-1a00-0000-634c-b455f5140000 pid=5365 execve guuid=39a891f7-2300-0000-634c-b4551e150000 pid=5406 /usr/bin/mv guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=39a891f7-2300-0000-634c-b4551e150000 pid=5406 execve guuid=06430ef8-2300-0000-634c-b4551f150000 pid=5407 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=06430ef8-2300-0000-634c-b4551f150000 pid=5407 clone guuid=433031f8-2300-0000-634c-b45520150000 pid=5408 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=433031f8-2300-0000-634c-b45520150000 pid=5408 clone guuid=501a18f9-2300-0000-634c-b45523150000 pid=5411 /usr/bin/rm guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=501a18f9-2300-0000-634c-b45523150000 pid=5411 execve guuid=d76b85f9-2300-0000-634c-b45524150000 pid=5412 /usr/bin/curl net send-data write-file guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d76b85f9-2300-0000-634c-b45524150000 pid=5412 execve guuid=75af4048-2400-0000-634c-b45526150000 pid=5414 /usr/bin/mv guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=75af4048-2400-0000-634c-b45526150000 pid=5414 execve guuid=6bedc548-2400-0000-634c-b45527150000 pid=5415 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=6bedc548-2400-0000-634c-b45527150000 pid=5415 clone guuid=9bcce848-2400-0000-634c-b45528150000 pid=5416 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9bcce848-2400-0000-634c-b45528150000 pid=5416 clone guuid=a7c77449-2400-0000-634c-b4552b150000 pid=5419 /usr/bin/rm guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=a7c77449-2400-0000-634c-b4552b150000 pid=5419 execve guuid=1cd4e049-2400-0000-634c-b4552c150000 pid=5420 /usr/bin/curl net send-data write-file guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1cd4e049-2400-0000-634c-b4552c150000 pid=5420 execve guuid=1ec16c6b-2400-0000-634c-b4552e150000 pid=5422 /usr/bin/mv guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1ec16c6b-2400-0000-634c-b4552e150000 pid=5422 execve guuid=1b4bf86b-2400-0000-634c-b4552f150000 pid=5423 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=1b4bf86b-2400-0000-634c-b4552f150000 pid=5423 clone guuid=d2791e6c-2400-0000-634c-b45530150000 pid=5424 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d2791e6c-2400-0000-634c-b45530150000 pid=5424 clone guuid=0f68b26c-2400-0000-634c-b45533150000 pid=5427 /usr/bin/rm guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0f68b26c-2400-0000-634c-b45533150000 pid=5427 execve guuid=f6270b6d-2400-0000-634c-b45534150000 pid=5428 /usr/bin/curl net send-data write-file guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=f6270b6d-2400-0000-634c-b45534150000 pid=5428 execve guuid=eaf58fd7-2400-0000-634c-b45536150000 pid=5430 /usr/bin/mv guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=eaf58fd7-2400-0000-634c-b45536150000 pid=5430 execve guuid=c08b38d8-2400-0000-634c-b45537150000 pid=5431 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=c08b38d8-2400-0000-634c-b45537150000 pid=5431 clone guuid=98f86bd8-2400-0000-634c-b45538150000 pid=5432 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=98f86bd8-2400-0000-634c-b45538150000 pid=5432 clone guuid=24a41bd9-2400-0000-634c-b4553b150000 pid=5435 /usr/bin/rm guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=24a41bd9-2400-0000-634c-b4553b150000 pid=5435 execve guuid=78a67bd9-2400-0000-634c-b4553c150000 pid=5436 /usr/bin/curl net send-data write-file guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=78a67bd9-2400-0000-634c-b4553c150000 pid=5436 execve guuid=2968c6fb-2400-0000-634c-b4553e150000 pid=5438 /usr/bin/mv guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2968c6fb-2400-0000-634c-b4553e150000 pid=5438 execve guuid=d7f5c7fc-2400-0000-634c-b4553f150000 pid=5439 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=d7f5c7fc-2400-0000-634c-b4553f150000 pid=5439 clone guuid=160514fd-2400-0000-634c-b45540150000 pid=5440 /usr/bin/bash guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=160514fd-2400-0000-634c-b45540150000 pid=5440 clone guuid=4759aafd-2400-0000-634c-b45543150000 pid=5443 /usr/bin/chmod guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=4759aafd-2400-0000-634c-b45543150000 pid=5443 execve guuid=388514fe-2400-0000-634c-b45544150000 pid=5444 /usr/bin/chmod guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=388514fe-2400-0000-634c-b45544150000 pid=5444 execve guuid=146768fe-2400-0000-634c-b45545150000 pid=5445 /usr/bin/chmod guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=146768fe-2400-0000-634c-b45545150000 pid=5445 execve guuid=9413cdfe-2400-0000-634c-b45546150000 pid=5446 /usr/bin/chmod guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=9413cdfe-2400-0000-634c-b45546150000 pid=5446 execve guuid=961426ff-2400-0000-634c-b45547150000 pid=5447 /usr/bin/touch guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=961426ff-2400-0000-634c-b45547150000 pid=5447 execve guuid=3be589ff-2400-0000-634c-b45548150000 pid=5448 /usr/bin/touch guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=3be589ff-2400-0000-634c-b45548150000 pid=5448 execve guuid=6de6daff-2400-0000-634c-b45549150000 pid=5449 /usr/bin/touch guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=6de6daff-2400-0000-634c-b45549150000 pid=5449 execve guuid=fb0c6400-2500-0000-634c-b4554a150000 pid=5450 /usr/bin/touch guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fb0c6400-2500-0000-634c-b4554a150000 pid=5450 execve guuid=51a7c900-2500-0000-634c-b4554b150000 pid=5451 /usr/bin/touch guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=51a7c900-2500-0000-634c-b4554b150000 pid=5451 execve guuid=0ae91901-2500-0000-634c-b4554c150000 pid=5452 /usr/bin/touch guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0ae91901-2500-0000-634c-b4554c150000 pid=5452 execve guuid=57427e01-2500-0000-634c-b4554d150000 pid=5453 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=57427e01-2500-0000-634c-b4554d150000 pid=5453 execve guuid=2d9a1702-2500-0000-634c-b4554e150000 pid=5454 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=2d9a1702-2500-0000-634c-b4554e150000 pid=5454 execve guuid=975d9b02-2500-0000-634c-b4554f150000 pid=5455 /usr/bin/id guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=975d9b02-2500-0000-634c-b4554f150000 pid=5455 execve guuid=fbea2203-2500-0000-634c-b45550150000 pid=5456 /usr/bin/cat write-config guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=fbea2203-2500-0000-634c-b45550150000 pid=5456 execve guuid=26a2ea03-2500-0000-634c-b45551150000 pid=5457 /usr/bin/timeout guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=26a2ea03-2500-0000-634c-b45551150000 pid=5457 execve guuid=10fffc31-2500-0000-634c-b45567150000 pid=5479 /usr/bin/timeout guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=10fffc31-2500-0000-634c-b45567150000 pid=5479 execve guuid=0eaf9561-2500-0000-634c-b4557d150000 pid=5501 /usr/bin/timeout guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=0eaf9561-2500-0000-634c-b4557d150000 pid=5501 execve guuid=18291f68-2500-0000-634c-b45580150000 pid=5504 /usr/bin/sleep guuid=80fee3dd-1700-0000-634c-b455920d0000 pid=3474->guuid=18291f68-2500-0000-634c-b45580150000 pid=5504 execve guuid=e254d3de-1700-0000-634c-b455960d0000 pid=3478 /usr/bin/dirname guuid=aba2bdde-1700-0000-634c-b455950d0000 pid=3477->guuid=e254d3de-1700-0000-634c-b455960d0000 pid=3478 execve guuid=b10066e5-1700-0000-634c-b455a90d0000 pid=3497 /usr/bin/pgrep guuid=315205e5-1700-0000-634c-b455a70d0000 pid=3495->guuid=b10066e5-1700-0000-634c-b455a90d0000 pid=3497 execve guuid=c571f0ea-1700-0000-634c-b455b90d0000 pid=3513 /usr/bin/pgrep guuid=b50ce1ea-1700-0000-634c-b455b80d0000 pid=3512->guuid=c571f0ea-1700-0000-634c-b455b90d0000 pid=3513 execve guuid=9b1219ee-1700-0000-634c-b455c30d0000 pid=3523 /usr/bin/pgrep guuid=29730bee-1700-0000-634c-b455c20d0000 pid=3522->guuid=9b1219ee-1700-0000-634c-b455c30d0000 pid=3523 execve guuid=2feb9cf1-1700-0000-634c-b455ca0d0000 pid=3530 /usr/bin/pgrep guuid=caf58ef1-1700-0000-634c-b455c70d0000 pid=3527->guuid=2feb9cf1-1700-0000-634c-b455ca0d0000 pid=3530 execve guuid=cedd10fc-1700-0000-634c-b455e40d0000 pid=3556 /usr/bin/pgrep guuid=1adcdefb-1700-0000-634c-b455e30d0000 pid=3555->guuid=cedd10fc-1700-0000-634c-b455e40d0000 pid=3556 execve guuid=df11f005-1800-0000-634c-b455e60d0000 pid=3558 /usr/bin/pgrep guuid=d3c3ba05-1800-0000-634c-b455e50d0000 pid=3557->guuid=df11f005-1800-0000-634c-b455e60d0000 pid=3558 execve guuid=71c2b40a-1800-0000-634c-b455eb0d0000 pid=3563 /usr/bin/pgrep guuid=09b1a70a-1800-0000-634c-b455ea0d0000 pid=3562->guuid=71c2b40a-1800-0000-634c-b455eb0d0000 pid=3563 execve guuid=e53aff0d-1800-0000-634c-b455f40d0000 pid=3572 /usr/bin/pgrep guuid=3530c00d-1800-0000-634c-b455f30d0000 pid=3571->guuid=e53aff0d-1800-0000-634c-b455f40d0000 pid=3572 execve guuid=15b6a815-1800-0000-634c-b455f80d0000 pid=3576 /usr/bin/pgrep guuid=806b8d15-1800-0000-634c-b455f70d0000 pid=3575->guuid=15b6a815-1800-0000-634c-b455f80d0000 pid=3576 execve guuid=687a7f1b-1800-0000-634c-b455080e0000 pid=3592 /usr/bin/pgrep guuid=48c45b1b-1800-0000-634c-b455070e0000 pid=3591->guuid=687a7f1b-1800-0000-634c-b455080e0000 pid=3592 execve guuid=139d1621-1800-0000-634c-b4551a0e0000 pid=3610 /usr/bin/pgrep guuid=952cfb20-1800-0000-634c-b455180e0000 pid=3608->guuid=139d1621-1800-0000-634c-b4551a0e0000 pid=3610 execve guuid=38f52127-1800-0000-634c-b455310e0000 pid=3633 /usr/bin/pgrep guuid=1a440427-1800-0000-634c-b455300e0000 pid=3632->guuid=38f52127-1800-0000-634c-b455310e0000 pid=3633 execve guuid=6eeb5a2c-1800-0000-634c-b455400e0000 pid=3648 /usr/bin/pgrep guuid=c11e462c-1800-0000-634c-b4553f0e0000 pid=3647->guuid=6eeb5a2c-1800-0000-634c-b455400e0000 pid=3648 execve guuid=7c570931-1800-0000-634c-b4554d0e0000 pid=3661 /usr/bin/pgrep guuid=bbeef430-1800-0000-634c-b4554c0e0000 pid=3660->guuid=7c570931-1800-0000-634c-b4554d0e0000 pid=3661 execve guuid=bc7dd435-1800-0000-634c-b455590e0000 pid=3673 /usr/bin/pgrep guuid=9b34c035-1800-0000-634c-b455580e0000 pid=3672->guuid=bc7dd435-1800-0000-634c-b455590e0000 pid=3673 execve guuid=446b4c3a-1800-0000-634c-b455680e0000 pid=3688 /usr/bin/pgrep guuid=690b363a-1800-0000-634c-b455670e0000 pid=3687->guuid=446b4c3a-1800-0000-634c-b455680e0000 pid=3688 execve guuid=a484be3e-1800-0000-634c-b4557a0e0000 pid=3706 /usr/bin/pgrep guuid=003a7c3e-1800-0000-634c-b455790e0000 pid=3705->guuid=a484be3e-1800-0000-634c-b4557a0e0000 pid=3706 execve guuid=dfb34e46-1800-0000-634c-b4559a0e0000 pid=3738 /usr/bin/pgrep guuid=56731746-1800-0000-634c-b455990e0000 pid=3737->guuid=dfb34e46-1800-0000-634c-b4559a0e0000 pid=3738 execve guuid=edb1364e-1800-0000-634c-b455a80e0000 pid=3752 /usr/bin/pgrep guuid=9b20144e-1800-0000-634c-b455a70e0000 pid=3751->guuid=edb1364e-1800-0000-634c-b455a80e0000 pid=3752 execve guuid=a3b82d57-1800-0000-634c-b455c40e0000 pid=3780 /usr/bin/pgrep guuid=61b71957-1800-0000-634c-b455c30e0000 pid=3779->guuid=a3b82d57-1800-0000-634c-b455c40e0000 pid=3780 execve guuid=888e4560-1800-0000-634c-b455df0e0000 pid=3807 /usr/bin/pgrep guuid=99ddf45f-1800-0000-634c-b455dd0e0000 pid=3805->guuid=888e4560-1800-0000-634c-b455df0e0000 pid=3807 execve guuid=f7e9cf68-1800-0000-634c-b455f90e0000 pid=3833 /usr/bin/pgrep guuid=b8d8b568-1800-0000-634c-b455f80e0000 pid=3832->guuid=f7e9cf68-1800-0000-634c-b455f90e0000 pid=3833 execve guuid=fe34236f-1800-0000-634c-b455050f0000 pid=3845 /usr/bin/pgrep guuid=1194016f-1800-0000-634c-b455040f0000 pid=3844->guuid=fe34236f-1800-0000-634c-b455050f0000 pid=3845 execve guuid=4509d472-1800-0000-634c-b455140f0000 pid=3860 /usr/bin/pgrep guuid=042cc372-1800-0000-634c-b455130f0000 pid=3859->guuid=4509d472-1800-0000-634c-b455140f0000 pid=3860 execve guuid=93697076-1800-0000-634c-b455250f0000 pid=3877 /usr/bin/pgrep guuid=80c95f76-1800-0000-634c-b455240f0000 pid=3876->guuid=93697076-1800-0000-634c-b455250f0000 pid=3877 execve guuid=62bda97d-1800-0000-634c-b4552d0f0000 pid=3885 /usr/bin/pgrep guuid=d550957d-1800-0000-634c-b4552c0f0000 pid=3884->guuid=62bda97d-1800-0000-634c-b4552d0f0000 pid=3885 execve guuid=dfd6e283-1800-0000-634c-b455400f0000 pid=3904 /usr/bin/pgrep guuid=c2f9c983-1800-0000-634c-b4553f0f0000 pid=3903->guuid=dfd6e283-1800-0000-634c-b455400f0000 pid=3904 execve guuid=e19fe388-1800-0000-634c-b455510f0000 pid=3921 /usr/bin/pgrep guuid=83b8d088-1800-0000-634c-b455500f0000 pid=3920->guuid=e19fe388-1800-0000-634c-b455510f0000 pid=3921 execve guuid=402ce08d-1800-0000-634c-b455650f0000 pid=3941 /usr/bin/pgrep guuid=1d55c68d-1800-0000-634c-b455640f0000 pid=3940->guuid=402ce08d-1800-0000-634c-b455650f0000 pid=3941 execve guuid=ab0d8e93-1800-0000-634c-b455790f0000 pid=3961 /usr/bin/pgrep guuid=58a57893-1800-0000-634c-b455770f0000 pid=3959->guuid=ab0d8e93-1800-0000-634c-b455790f0000 pid=3961 execve guuid=f3574399-1800-0000-634c-b4558f0f0000 pid=3983 /usr/bin/pgrep guuid=a2741999-1800-0000-634c-b4558d0f0000 pid=3981->guuid=f3574399-1800-0000-634c-b4558f0f0000 pid=3983 execve guuid=bafe859d-1800-0000-634c-b4559c0f0000 pid=3996 /usr/bin/pgrep guuid=4446759d-1800-0000-634c-b4559a0f0000 pid=3994->guuid=bafe859d-1800-0000-634c-b4559c0f0000 pid=3996 execve guuid=c4a475a0-1800-0000-634c-b455a70f0000 pid=4007 /usr/bin/pgrep guuid=42f941a0-1800-0000-634c-b455a60f0000 pid=4006->guuid=c4a475a0-1800-0000-634c-b455a70f0000 pid=4007 execve guuid=4f0909a4-1800-0000-634c-b455b40f0000 pid=4020 /usr/bin/pgrep guuid=d9d7f2a3-1800-0000-634c-b455b30f0000 pid=4019->guuid=4f0909a4-1800-0000-634c-b455b40f0000 pid=4020 execve guuid=c80f67aa-1800-0000-634c-b455be0f0000 pid=4030 /usr/bin/pgrep guuid=54a351aa-1800-0000-634c-b455bd0f0000 pid=4029->guuid=c80f67aa-1800-0000-634c-b455be0f0000 pid=4030 execve guuid=c4106ab1-1800-0000-634c-b455c90f0000 pid=4041 /usr/bin/pgrep guuid=2d8152b1-1800-0000-634c-b455c80f0000 pid=4040->guuid=c4106ab1-1800-0000-634c-b455c90f0000 pid=4041 execve guuid=c60b0fb7-1800-0000-634c-b455dd0f0000 pid=4061 /usr/bin/pgrep guuid=15e3f2b6-1800-0000-634c-b455dc0f0000 pid=4060->guuid=c60b0fb7-1800-0000-634c-b455dd0f0000 pid=4061 execve guuid=1fbffcbc-1800-0000-634c-b455f60f0000 pid=4086 /usr/bin/pgrep guuid=d859d7bc-1800-0000-634c-b455f50f0000 pid=4085->guuid=1fbffcbc-1800-0000-634c-b455f60f0000 pid=4086 execve guuid=e94bfdc1-1800-0000-634c-b45509100000 pid=4105 /usr/bin/pgrep guuid=f399edc1-1800-0000-634c-b45508100000 pid=4104->guuid=e94bfdc1-1800-0000-634c-b45509100000 pid=4105 execve guuid=301122c6-1800-0000-634c-b45516100000 pid=4118 /usr/bin/pgrep guuid=cd300cc6-1800-0000-634c-b45515100000 pid=4117->guuid=301122c6-1800-0000-634c-b45516100000 pid=4118 execve guuid=25dc7dcc-1800-0000-634c-b4551d100000 pid=4125 /usr/bin/pgrep guuid=2c8a5ecc-1800-0000-634c-b4551c100000 pid=4124->guuid=25dc7dcc-1800-0000-634c-b4551d100000 pid=4125 execve guuid=c511bbd3-1800-0000-634c-b4552e100000 pid=4142 /usr/bin/pgrep guuid=5fd1a0d3-1800-0000-634c-b4552c100000 pid=4140->guuid=c511bbd3-1800-0000-634c-b4552e100000 pid=4142 execve guuid=8e6585d9-1800-0000-634c-b45542100000 pid=4162 /usr/bin/pgrep guuid=c8f966d9-1800-0000-634c-b45540100000 pid=4160->guuid=8e6585d9-1800-0000-634c-b45542100000 pid=4162 execve guuid=fa96d4de-1800-0000-634c-b45556100000 pid=4182 /usr/bin/pgrep guuid=0d6ec3de-1800-0000-634c-b45555100000 pid=4181->guuid=fa96d4de-1800-0000-634c-b45556100000 pid=4182 execve guuid=694e1ce3-1800-0000-634c-b45565100000 pid=4197 /usr/bin/pgrep guuid=992d08e3-1800-0000-634c-b45564100000 pid=4196->guuid=694e1ce3-1800-0000-634c-b45565100000 pid=4197 execve guuid=3bc01ae7-1800-0000-634c-b45575100000 pid=4213 /usr/bin/pgrep guuid=1c3d09e7-1800-0000-634c-b45574100000 pid=4212->guuid=3bc01ae7-1800-0000-634c-b45575100000 pid=4213 execve guuid=c403bbeb-1800-0000-634c-b45587100000 pid=4231 /usr/bin/pgrep guuid=fa52a4eb-1800-0000-634c-b45586100000 pid=4230->guuid=c403bbeb-1800-0000-634c-b45587100000 pid=4231 execve guuid=6e4d4ef1-1800-0000-634c-b4559d100000 pid=4253 /usr/bin/pgrep guuid=2f013af1-1800-0000-634c-b4559c100000 pid=4252->guuid=6e4d4ef1-1800-0000-634c-b4559d100000 pid=4253 execve guuid=dbe496f6-1800-0000-634c-b455ac100000 pid=4268 /usr/bin/pgrep guuid=34427af6-1800-0000-634c-b455ab100000 pid=4267->guuid=dbe496f6-1800-0000-634c-b455ac100000 pid=4268 execve guuid=cc9272fc-1800-0000-634c-b455bb100000 pid=4283 /usr/bin/pgrep guuid=63235cfc-1800-0000-634c-b455ba100000 pid=4282->guuid=cc9272fc-1800-0000-634c-b455bb100000 pid=4283 execve guuid=4f0cb200-1900-0000-634c-b455c8100000 pid=4296 /usr/bin/pgrep guuid=736c8c00-1900-0000-634c-b455c7100000 pid=4295->guuid=4f0cb200-1900-0000-634c-b455c8100000 pid=4296 execve guuid=037a4f0d-1900-0000-634c-b455fe100000 pid=4350 /usr/bin/pgrep guuid=2ac0300d-1900-0000-634c-b455fc100000 pid=4348->guuid=037a4f0d-1900-0000-634c-b455fe100000 pid=4350 execve guuid=737d1212-1900-0000-634c-b4550d110000 pid=4365 /usr/bin/pgrep guuid=fdc5f711-1900-0000-634c-b4550c110000 pid=4364->guuid=737d1212-1900-0000-634c-b4550d110000 pid=4365 execve guuid=a163e115-1900-0000-634c-b45522110000 pid=4386 /usr/bin/pgrep guuid=fd41d315-1900-0000-634c-b4551f110000 pid=4383->guuid=a163e115-1900-0000-634c-b45522110000 pid=4386 execve guuid=b516001f-1900-0000-634c-b4553e110000 pid=4414 /usr/bin/pgrep guuid=28d77a1e-1900-0000-634c-b4553c110000 pid=4412->guuid=b516001f-1900-0000-634c-b4553e110000 pid=4414 execve guuid=247c5028-1900-0000-634c-b45551110000 pid=4433 /usr/bin/pgrep guuid=f2b43a28-1900-0000-634c-b45550110000 pid=4432->guuid=247c5028-1900-0000-634c-b45551110000 pid=4433 execve guuid=22fc8c2d-1900-0000-634c-b45560110000 pid=4448 /usr/bin/pgrep guuid=c4ac772d-1900-0000-634c-b4555f110000 pid=4447->guuid=22fc8c2d-1900-0000-634c-b45560110000 pid=4448 execve guuid=560ffb30-1900-0000-634c-b45571110000 pid=4465 /usr/bin/pgrep guuid=e6efe630-1900-0000-634c-b45570110000 pid=4464->guuid=560ffb30-1900-0000-634c-b45571110000 pid=4465 execve guuid=82ede733-1900-0000-634c-b4557d110000 pid=4477 /usr/bin/pgrep guuid=b0cece33-1900-0000-634c-b4557c110000 pid=4476->guuid=82ede733-1900-0000-634c-b4557d110000 pid=4477 execve guuid=9d855438-1900-0000-634c-b4558f110000 pid=4495 /usr/bin/pgrep guuid=153e3d38-1900-0000-634c-b4558e110000 pid=4494->guuid=9d855438-1900-0000-634c-b4558f110000 pid=4495 execve guuid=5a16253d-1900-0000-634c-b4559e110000 pid=4510 /usr/bin/pgrep guuid=535f0f3d-1900-0000-634c-b4559d110000 pid=4509->guuid=5a16253d-1900-0000-634c-b4559e110000 pid=4510 execve guuid=281df941-1900-0000-634c-b455a9110000 pid=4521 /usr/bin/pgrep guuid=d89ddc41-1900-0000-634c-b455a8110000 pid=4520->guuid=281df941-1900-0000-634c-b455a9110000 pid=4521 execve guuid=98c79367-1900-0000-634c-b45574120000 pid=4724 /usr/bin/stat guuid=81327d67-1900-0000-634c-b45573120000 pid=4723->guuid=98c79367-1900-0000-634c-b45574120000 pid=4724 execve guuid=a84f806b-1900-0000-634c-b45580120000 pid=4736 /usr/bin/systemctl guuid=63ca816a-1900-0000-634c-b4557d120000 pid=4733->guuid=a84f806b-1900-0000-634c-b45580120000 pid=4736 execve guuid=1d471777-1900-0000-634c-b455a4120000 pid=4772 /usr/bin/dpkg guuid=f921d372-1900-0000-634c-b45595120000 pid=4757->guuid=1d471777-1900-0000-634c-b455a4120000 pid=4772 execve guuid=717fc27c-1900-0000-634c-b455af120000 pid=4783 /usr/bin/dpkg guuid=f921d372-1900-0000-634c-b45595120000 pid=4757->guuid=717fc27c-1900-0000-634c-b455af120000 pid=4783 execve guuid=95b16d84-1900-0000-634c-b455cc120000 pid=4812 /usr/bin/dpkg guuid=f921d372-1900-0000-634c-b45595120000 pid=4757->guuid=95b16d84-1900-0000-634c-b455cc120000 pid=4812 execve guuid=e6d0230c-1a00-0000-634c-b4558f130000 pid=5007 /usr/bin/dpkg guuid=f921d372-1900-0000-634c-b45595120000 pid=4757->guuid=e6d0230c-1a00-0000-634c-b4558f130000 pid=5007 execve guuid=85ff60b1-1a00-0000-634c-b455be140000 pid=5310 /usr/bin/dpkg guuid=f921d372-1900-0000-634c-b45595120000 pid=4757->guuid=85ff60b1-1a00-0000-634c-b455be140000 pid=5310 execve guuid=7514edb6-1a00-0000-634c-b455d5140000 pid=5333 /usr/bin/dpkg guuid=d53969b5-1a00-0000-634c-b455cd140000 pid=5325->guuid=7514edb6-1a00-0000-634c-b455d5140000 pid=5333 execve guuid=d25fa6bc-1a00-0000-634c-b455e2140000 pid=5346 /usr/bin/dpkg guuid=d53969b5-1a00-0000-634c-b455cd140000 pid=5325->guuid=d25fa6bc-1a00-0000-634c-b455e2140000 pid=5346 execve guuid=174a7fbf-1a00-0000-634c-b455e4140000 pid=5348 /usr/bin/apt-get guuid=88f615bf-1a00-0000-634c-b455e3140000 pid=5347->guuid=174a7fbf-1a00-0000-634c-b455e4140000 pid=5348 execve guuid=302263c1-1a00-0000-634c-b455e5140000 pid=5349 /usr/bin/dpkg guuid=174a7fbf-1a00-0000-634c-b455e4140000 pid=5348->guuid=302263c1-1a00-0000-634c-b455e5140000 pid=5349 execve 954a60b5-8e85-5b88-b7db-4a00db4c2111 fix.unknower.win:80 guuid=a7909dc3-1a00-0000-634c-b455e7140000 pid=5351->954a60b5-8e85-5b88-b7db-4a00db4c2111 send: 81B guuid=a7909dc3-1a00-0000-634c-b455e7140000 pid=5352 /usr/bin/curl dns net send-data guuid=a7909dc3-1a00-0000-634c-b455e7140000 pid=5351->guuid=a7909dc3-1a00-0000-634c-b455e7140000 pid=5352 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=a7909dc3-1a00-0000-634c-b455e7140000 pid=5352->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B guuid=abd8afeb-1a00-0000-634c-b455f5140000 pid=5365->954a60b5-8e85-5b88-b7db-4a00db4c2111 send: 90B guuid=abd8afeb-1a00-0000-634c-b455f5140000 pid=5366 /usr/bin/curl dns net send-data guuid=abd8afeb-1a00-0000-634c-b455f5140000 pid=5365->guuid=abd8afeb-1a00-0000-634c-b455f5140000 pid=5366 clone guuid=abd8afeb-1a00-0000-634c-b455f5140000 pid=5366->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B guuid=fb1d44f8-2300-0000-634c-b45521150000 pid=5409 /usr/bin/wc guuid=433031f8-2300-0000-634c-b45520150000 pid=5408->guuid=fb1d44f8-2300-0000-634c-b45521150000 pid=5409 execve guuid=095b50f8-2300-0000-634c-b45522150000 pid=5410 /usr/bin/tr guuid=433031f8-2300-0000-634c-b45520150000 pid=5408->guuid=095b50f8-2300-0000-634c-b45522150000 pid=5410 execve guuid=d76b85f9-2300-0000-634c-b45524150000 pid=5412->954a60b5-8e85-5b88-b7db-4a00db4c2111 send: 92B guuid=d76b85f9-2300-0000-634c-b45524150000 pid=5413 /usr/bin/curl dns net send-data guuid=d76b85f9-2300-0000-634c-b45524150000 pid=5412->guuid=d76b85f9-2300-0000-634c-b45524150000 pid=5413 clone guuid=d76b85f9-2300-0000-634c-b45524150000 pid=5413->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B guuid=65fcf748-2400-0000-634c-b45529150000 pid=5417 /usr/bin/wc guuid=9bcce848-2400-0000-634c-b45528150000 pid=5416->guuid=65fcf748-2400-0000-634c-b45529150000 pid=5417 execve guuid=16deff48-2400-0000-634c-b4552a150000 pid=5418 /usr/bin/tr guuid=9bcce848-2400-0000-634c-b45528150000 pid=5416->guuid=16deff48-2400-0000-634c-b4552a150000 pid=5418 execve guuid=1cd4e049-2400-0000-634c-b4552c150000 pid=5420->954a60b5-8e85-5b88-b7db-4a00db4c2111 send: 91B guuid=1cd4e049-2400-0000-634c-b4552c150000 pid=5421 /usr/bin/curl dns net send-data guuid=1cd4e049-2400-0000-634c-b4552c150000 pid=5420->guuid=1cd4e049-2400-0000-634c-b4552c150000 pid=5421 clone guuid=1cd4e049-2400-0000-634c-b4552c150000 pid=5421->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B guuid=d3f52e6c-2400-0000-634c-b45531150000 pid=5425 /usr/bin/wc guuid=d2791e6c-2400-0000-634c-b45530150000 pid=5424->guuid=d3f52e6c-2400-0000-634c-b45531150000 pid=5425 execve guuid=9a24366c-2400-0000-634c-b45532150000 pid=5426 /usr/bin/tr guuid=d2791e6c-2400-0000-634c-b45530150000 pid=5424->guuid=9a24366c-2400-0000-634c-b45532150000 pid=5426 execve guuid=f6270b6d-2400-0000-634c-b45534150000 pid=5428->954a60b5-8e85-5b88-b7db-4a00db4c2111 send: 91B guuid=f6270b6d-2400-0000-634c-b45534150000 pid=5429 /usr/bin/curl dns net send-data guuid=f6270b6d-2400-0000-634c-b45534150000 pid=5428->guuid=f6270b6d-2400-0000-634c-b45534150000 pid=5429 clone guuid=f6270b6d-2400-0000-634c-b45534150000 pid=5429->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B guuid=b9027ed8-2400-0000-634c-b45539150000 pid=5433 /usr/bin/wc guuid=98f86bd8-2400-0000-634c-b45538150000 pid=5432->guuid=b9027ed8-2400-0000-634c-b45539150000 pid=5433 execve guuid=66fd87d8-2400-0000-634c-b4553a150000 pid=5434 /usr/bin/tr guuid=98f86bd8-2400-0000-634c-b45538150000 pid=5432->guuid=66fd87d8-2400-0000-634c-b4553a150000 pid=5434 execve guuid=78a67bd9-2400-0000-634c-b4553c150000 pid=5436->954a60b5-8e85-5b88-b7db-4a00db4c2111 send: 90B guuid=78a67bd9-2400-0000-634c-b4553c150000 pid=5437 /usr/bin/curl dns net send-data guuid=78a67bd9-2400-0000-634c-b4553c150000 pid=5436->guuid=78a67bd9-2400-0000-634c-b4553c150000 pid=5437 clone guuid=78a67bd9-2400-0000-634c-b4553c150000 pid=5437->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B guuid=e73625fd-2400-0000-634c-b45541150000 pid=5441 /usr/bin/wc guuid=160514fd-2400-0000-634c-b45540150000 pid=5440->guuid=e73625fd-2400-0000-634c-b45541150000 pid=5441 execve guuid=fded2efd-2400-0000-634c-b45542150000 pid=5442 /usr/bin/tr guuid=160514fd-2400-0000-634c-b45540150000 pid=5440->guuid=fded2efd-2400-0000-634c-b45542150000 pid=5442 execve guuid=87b43e04-2500-0000-634c-b45552150000 pid=5458 /usr/bin/systemctl guuid=26a2ea03-2500-0000-634c-b45551150000 pid=5457->guuid=87b43e04-2500-0000-634c-b45552150000 pid=5458 execve guuid=93f6bc32-2500-0000-634c-b45568150000 pid=5480 /usr/bin/systemctl guuid=10fffc31-2500-0000-634c-b45567150000 pid=5479->guuid=93f6bc32-2500-0000-634c-b45568150000 pid=5480 execve guuid=7f3be862-2500-0000-634c-b4557e150000 pid=5502 /usr/bin/systemctl guuid=0eaf9561-2500-0000-634c-b4557d150000 pid=5501->guuid=7f3be862-2500-0000-634c-b4557e150000 pid=5502 execve
Score:
5%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pduv5zi6yek52hnoaccsqrke2cezdnb2hgqtny4pfwh2mgdjh2ua._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig antivm defense_evasion discovery execution linux miner persistence privilege_escalation rootkit
Link:
https://tria.ge/reports/260810-rtcyysbk7v/
Behaviour
Software Deployment Tools
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Reads CPU attributes
Deletes log files
Enumerates running processes
Modifies systemd
Removes the immutable protection flag from a file
File and Directory Permissions Modification
Indicator Removal: File Deletion
Deletes system logs
Loads a kernel module
Modifies the /etc/hosts DNS resolution file
Family: xmrig
XMRig Miner payload
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/78e95ee51ec1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:testlumma
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

sh 78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3898981/
  
Delivery method
Distributed via web download

Comments