===== [T1] /tmp artifacts (the actor's playground) ===== total 192 drwxrwxrwt. 45 root root 12288 Aug 18 10:49 . dr-xr-xr-x. 20 root root 4096 Jul 8 14:14 .. drwxr-xr-x. 2 root root 4096 Aug 17 15:44 0a8d73a4b1dedacb04bdcac84d6a7c18 drwxr-xr-x. 2 root root 4096 Aug 13 18:56 11cd08140b55242276d565b3ecc4afb2 drwxr-xr-x. 2 root root 4096 Aug 17 21:47 19951ed88f57a197e7a864ee08b7fb81 drwxr-xr-x. 2 root root 4096 Aug 11 20:11 1e24f6c5f18e4e39ca9ac4ce90b6d102 drwxr-xr-x. 2 root root 4096 Aug 11 00:16 1e767a91d282dc52e53d3d3594899a95 drwxr-xr-x. 2 root root 4096 Aug 9 09:06 2411710d359ecda9cbcb324d41ac3a14 drwxr-xr-x. 2 root root 4096 Aug 8 09:53 2bc45f703e1dc26d54c8bab2f79697df drwxr-xr-x. 2 root root 4096 Aug 11 10:41 30eac6536bbc0e31d629bebbbcf7fe56 drwxr-xr-x. 2 root root 4096 Aug 10 10:33 374cb93f4b83575f10adeb2f5e52c2c4 drwxr-xr-x. 2 root root 4096 Aug 14 12:12 3942604ce228da65a63ff708b60d40eb drwxr-xr-x. 2 root root 4096 Aug 11 11:20 3e4f824e28337e6701cd69613a2de84c drwxr-xr-x. 2 root root 4096 Aug 14 12:20 4286b743c1fbbf2617ed1240d4fa598c drwxr-xr-x. 2 root root 4096 Aug 12 14:28 47c6508cadc5dc58b1555f979768b723 drwxr-xr-x. 2 root root 4096 Aug 14 10:25 49c28e883672a3c70bff6cc56c65dd3d drwxr-xr-x. 2 root root 4096 Aug 10 13:23 4d3f176ab9d6be6859c9d821f2fb45c3 drwxr-xr-x. 2 root root 4096 Aug 11 10:43 5f723af33102833bf029288e0534c74b drwxr-xr-x. 2 root root 4096 Aug 9 22:03 63b51428b48521bbdb8ea197072668e7 drwxr-xr-x. 2 root root 4096 Aug 17 14:01 6684a3723d36d65aab478d68b9399c29 drwxr-xr-x. 2 root root 4096 Aug 8 08:49 66e6e121f47dc43df2f81519aef9cb08 drwxr-xr-x. 2 root root 4096 Aug 11 11:09 6cf6f767f56809beb7976ab79ef3e7e1 drwxr-xr-x. 2 root root 4096 Aug 10 13:48 6fe76155aef8c82653b87288461f0dc3 drwxr-xr-x. 2 root root 4096 Aug 12 10:21 7c3f291ab32a4af9d8b1a0a4ad3072d0 drwxr-xr-x. 2 root root 4096 Aug 11 00:13 888c791ecb161219f675c98bb15bf5d0 drwxr-xr-x. 2 root root 4096 Aug 10 14:01 8b91f9b4d9ccc3f705f21be5e72c6a26 drwxr-xr-x. 2 root root 4096 Aug 10 17:45 8bc058e6ff813e8d9e45d58a57cbaa45 drwxr-xr-x. 2 root root 4096 Aug 16 21:26 99e1a1a6d35063c1cb02feede77dd400 drwxr-xr-x. 2 root root 4096 Aug 14 09:28 9ebcff0dc55f9814a3786c8e0a71462a drwxr-xr-x. 2 root root 4096 Aug 12 16:20 aa5f46de4fd9bdc2fb9c9cdc3bf7ba99 drwxr-xr-x. 2 root root 4096 Aug 12 15:50 cffbb3f3af6b00b6b513f1eceee03773 drwxr-xr-x. 2 root root 4096 Aug 13 16:57 e7060c8129b97021b858a96391a7f939 drwxr-xr-x. 2 root root 4096 Aug 10 11:01 f6fb251502ba13e03fd49ccf15664b30 -rw-r--r--. 1 root root 0 Aug 13 14:21 kedebah_as_scheduler.lock -rw-r--r--. 1 root root 0 Aug 13 14:21 kedebah_hr_scheduler.lock -rw-r--r--. 1 root root 0 Aug 13 14:21 kedebah_leave_scheduler.lock -rw-r--r--. 1 root root 0 Aug 7 14:21 kedebah_payroll_scheduler.lock -rw-r--r--. 1 root root 0 Aug 13 14:21 kedebah_pt_scheduler.lock drwx------. 2 nginx root 4096 Aug 8 08:10 nginx_cache --- /tmp full recursive (depth 2, actor files) --- --- stat on key actor files (mtime=modify, ctime=change/birth) --- ===== [T2] /tmp hidden + recent files (last 90 days) ===== /tmp/cffbb3f3af6b00b6b513f1eceee03773/sw.js /tmp/5f723af33102833bf029288e0534c74b/sw.js /tmp/kedebah_payroll_scheduler.lock /tmp/e7060c8129b97021b858a96391a7f939/sw.js /tmp/4286b743c1fbbf2617ed1240d4fa598c/sw.js /tmp/kedebah_pt_scheduler.lock /tmp/6fe76155aef8c82653b87288461f0dc3/sw.js /tmp/4d3f176ab9d6be6859c9d821f2fb45c3/sw.js /tmp/9ebcff0dc55f9814a3786c8e0a71462a/sw.js /tmp/kedebah_as_scheduler.lock /tmp/374cb93f4b83575f10adeb2f5e52c2c4/sw.js /tmp/6cf6f767f56809beb7976ab79ef3e7e1/sw.js /tmp/3e4f824e28337e6701cd69613a2de84c/sw.js /tmp/kedebah_hr_scheduler.lock /tmp/2411710d359ecda9cbcb324d41ac3a14/sw.js /tmp/8b91f9b4d9ccc3f705f21be5e72c6a26/sw.js /tmp/6684a3723d36d65aab478d68b9399c29/sw.js /tmp/47c6508cadc5dc58b1555f979768b723/sw.js /tmp/66e6e121f47dc43df2f81519aef9cb08/sw.js /tmp/1e24f6c5f18e4e39ca9ac4ce90b6d102/sw.js /tmp/888c791ecb161219f675c98bb15bf5d0/sw.js /tmp/2bc45f703e1dc26d54c8bab2f79697df/sw.js /tmp/1e767a91d282dc52e53d3d3594899a95/sw.js /tmp/f6fb251502ba13e03fd49ccf15664b30/sw.js /tmp/63b51428b48521bbdb8ea197072668e7/sw.js /tmp/49c28e883672a3c70bff6cc56c65dd3d/sw.js /tmp/3942604ce228da65a63ff708b60d40eb/sw.js /tmp/node-jiti/agi_business_in_a_box_admin_standalone-tailwind.config.js.d8767c6e.js /tmp/node-jiti/kedebah_v2_commerce_and_distribution-tailwind.config.js.ec6b9877.js /tmp/aa5f46de4fd9bdc2fb9c9cdc3bf7ba99/sw.js --- stat each --- ### /tmp/cffbb3f3af6b00b6b513f1eceee03773/sw.js /tmp/cffbb3f3af6b00b6b513f1eceee03773/sw.js | mtime:2026-08-12 15:50:59.106907437 +0000 | ctime:2026-08-12 15:50:59.106907437 +0000 | atime:2026-08-12 15:50:59.114907456 +0000 ### /tmp/5f723af33102833bf029288e0534c74b/sw.js /tmp/5f723af33102833bf029288e0534c74b/sw.js | mtime:2026-08-11 10:43:40.302177750 +0000 | ctime:2026-08-11 10:43:40.302177750 +0000 | atime:2026-08-11 10:43:40.319177799 +0000 ### /tmp/kedebah_payroll_scheduler.lock /tmp/kedebah_payroll_scheduler.lock | mtime:2026-08-07 14:21:02.120974944 +0000 | ctime:2026-08-07 14:21:02.120974944 +0000 | atime:2026-08-07 14:21:02.120974944 +0000 ### /tmp/e7060c8129b97021b858a96391a7f939/sw.js /tmp/e7060c8129b97021b858a96391a7f939/sw.js | mtime:2026-08-13 16:57:14.186156479 +0000 | ctime:2026-08-13 16:57:14.186156479 +0000 | atime:2026-08-13 16:57:14.199156508 +0000 ### /tmp/4286b743c1fbbf2617ed1240d4fa598c/sw.js /tmp/4286b743c1fbbf2617ed1240d4fa598c/sw.js | mtime:2026-08-14 12:20:32.786324586 +0000 | ctime:2026-08-14 12:20:32.786324586 +0000 | atime:2026-08-14 12:20:32.823324670 +0000 ### /tmp/kedebah_pt_scheduler.lock /tmp/kedebah_pt_scheduler.lock | mtime:2026-08-13 14:21:19.855482433 +0000 | ctime:2026-08-13 14:21:19.855482433 +0000 | atime:2026-08-13 14:21:19.855482433 +0000 ### /tmp/6fe76155aef8c82653b87288461f0dc3/sw.js /tmp/6fe76155aef8c82653b87288461f0dc3/sw.js | mtime:2026-08-10 13:48:02.625126558 +0000 | ctime:2026-08-10 13:48:02.625126558 +0000 | atime:2026-08-10 13:48:02.637126588 +0000 ### /tmp/4d3f176ab9d6be6859c9d821f2fb45c3/sw.js /tmp/4d3f176ab9d6be6859c9d821f2fb45c3/sw.js | mtime:2026-08-10 13:23:09.609365349 +0000 | ctime:2026-08-10 13:23:09.609365349 +0000 | atime:2026-08-10 13:23:09.618365371 +0000 ### /tmp/9ebcff0dc55f9814a3786c8e0a71462a/sw.js /tmp/9ebcff0dc55f9814a3786c8e0a71462a/sw.js | mtime:2026-08-14 09:28:55.948180440 +0000 | ctime:2026-08-14 09:28:55.948180440 +0000 | atime:2026-08-14 09:28:55.958180461 +0000 ### /tmp/kedebah_as_scheduler.lock /tmp/kedebah_as_scheduler.lock | mtime:2026-08-13 14:21:22.848489158 +0000 | ctime:2026-08-13 14:21:22.848489158 +0000 | atime:2026-08-13 14:21:22.848489158 +0000 ### /tmp/374cb93f4b83575f10adeb2f5e52c2c4/sw.js /tmp/374cb93f4b83575f10adeb2f5e52c2c4/sw.js | mtime:2026-08-10 10:33:40.558278699 +0000 | ctime:2026-08-10 10:33:40.558278699 +0000 | atime:2026-08-10 10:33:40.569278725 +0000 ### /tmp/6cf6f767f56809beb7976ab79ef3e7e1/sw.js /tmp/6cf6f767f56809beb7976ab79ef3e7e1/sw.js | mtime:2026-08-11 11:09:37.589236360 +0000 | ctime:2026-08-11 11:09:37.589236360 +0000 | atime:2026-08-11 11:09:37.601236392 +0000 ### /tmp/3e4f824e28337e6701cd69613a2de84c/sw.js /tmp/3e4f824e28337e6701cd69613a2de84c/sw.js | mtime:2026-08-11 11:20:01.653680257 +0000 | ctime:2026-08-11 11:20:01.653680257 +0000 | atime:2026-08-11 11:20:01.667680289 +0000 ### /tmp/kedebah_hr_scheduler.lock /tmp/kedebah_hr_scheduler.lock | mtime:2026-08-13 14:21:13.816468864 +0000 | ctime:2026-08-13 14:21:13.816468864 +0000 | atime:2026-08-13 14:21:13.816468864 +0000 ### /tmp/2411710d359ecda9cbcb324d41ac3a14/sw.js /tmp/2411710d359ecda9cbcb324d41ac3a14/sw.js | mtime:2026-08-09 09:06:28.668451914 +0000 | ctime:2026-08-09 09:06:28.668451914 +0000 | atime:2026-08-09 09:06:28.679451938 +0000 ===== [T3] bash_history mtime (last modification = last command run) ===== /home/npontucontrl/.bash_history | mtime:2026-07-22 05:15:49.545911422 +0000 | ctime:2026-07-22 05:15:49.545911422 +0000 --- other users' bash_history mtime --- /home/jones/.bash_history | mtime:2024-07-16 01:56:36.845859782 +0000 /home/john/.bash_history | mtime:2025-08-23 13:46:32.414147896 +0000 /home/daniel/.bash_history | mtime:2025-10-16 23:06:39.729991233 +0000 /home/david/.bash_history | mtime:2025-10-07 05:13:34.590626644 +0000 /home/deployer/.bash_history | mtime:2024-08-15 16:42:44.973153850 +0000 /home/prince/.bash_history | mtime:2025-09-07 17:46:34.161889563 +0000 ===== [T4] auth logs (SSH logins, su, sudo) ===== --- /var/log/secure (CentOS auth log) --- -rw-------. 1 root root 238057 Aug 18 10:49 /var/log/secure -rw-------. 1 root root 3083775 Jul 26 00:38 /var/log/secure-20260726 -rw-------. 1 root root 457003 Aug 2 02:44 /var/log/secure-20260802 -rw-------. 1 root root 523507 Aug 9 02:02 /var/log/secure-20260809 -rw-------. 1 root root 610569 Aug 16 03:43 /var/log/secure-20260816 --- last 50 lines of secure (readable?) --- --- journalctl sshd (last 30) --- -- Logs begin at Mon 2025-04-07 15:33:58 UTC, end at Tue 2026-08-18 10:49:46 UTC. -- Aug 18 09:44:14 CentOS-80-stream-amd64-base sshd[486938]: User child is on pid 487091 Aug 18 09:56:28 CentOS-80-stream-amd64-base sshd[585722]: Connection from 154.164.176.11 port 54780 on 138.201.221.144 port 2304 Aug 18 09:56:29 CentOS-80-stream-amd64-base sshd[585722]: Accepted password for evans from 154.164.176.11 port 54780 ssh2 Aug 18 09:56:29 CentOS-80-stream-amd64-base sshd[585722]: pam_unix(sshd:session): session opened for user evans by (uid=0) Aug 18 09:56:29 CentOS-80-stream-amd64-base sshd[585722]: User child is on pid 585827 Aug 18 10:13:09 CentOS-80-stream-amd64-base sshd[686008]: Connection from 154.161.2.77 port 18593 on 138.201.221.144 port 2304 Aug 18 10:13:10 CentOS-80-stream-amd64-base sshd[686008]: Accepted password for mylar from 154.161.2.77 port 18593 ssh2 Aug 18 10:13:10 CentOS-80-stream-amd64-base sshd[686008]: pam_unix(sshd:session): session opened for user mylar by (uid=0) Aug 18 10:13:10 CentOS-80-stream-amd64-base sshd[686008]: User child is on pid 686086 Aug 18 10:41:00 CentOS-80-stream-amd64-base sshd[871946]: Connection from 65.109.51.221 port 44574 on 138.201.221.144 port 2304 Aug 18 10:41:01 CentOS-80-stream-amd64-base sshd[871946]: Accepted key RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw found at /home/npontucontrl/.ssh/authorized_keys:1 Aug 18 10:41:01 CentOS-80-stream-amd64-base sshd[871946]: Accepted publickey for npontucontrl from 65.109.51.221 port 44574 ssh2: RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw Aug 18 10:41:01 CentOS-80-stream-amd64-base sshd[871946]: pam_unix(sshd:session): session opened for user npontucontrl by (uid=0) Aug 18 10:41:01 CentOS-80-stream-amd64-base sshd[871946]: User child is on pid 872026 Aug 18 10:41:01 CentOS-80-stream-amd64-base sshd[871946]: pam_unix(sshd:session): session closed for user npontucontrl Aug 18 10:42:05 CentOS-80-stream-amd64-base sshd[877198]: Connection from 65.109.51.221 port 40652 on 138.201.221.144 port 2304 Aug 18 10:42:05 CentOS-80-stream-amd64-base sshd[877198]: Accepted key RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw found at /home/npontucontrl/.ssh/authorized_keys:1 Aug 18 10:42:05 CentOS-80-stream-amd64-base sshd[877198]: Accepted publickey for npontucontrl from 65.109.51.221 port 40652 ssh2: RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw Aug 18 10:42:06 CentOS-80-stream-amd64-base sshd[877198]: pam_unix(sshd:session): session opened for user npontucontrl by (uid=0) Aug 18 10:42:06 CentOS-80-stream-amd64-base sshd[877198]: User child is on pid 877225 Aug 18 10:45:08 CentOS-80-stream-amd64-base sshd[895039]: Connection from 65.109.51.221 port 58486 on 138.201.221.144 port 2304 Aug 18 10:45:08 CentOS-80-stream-amd64-base sshd[895039]: Accepted key RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw found at /home/npontucontrl/.ssh/authorized_keys:1 Aug 18 10:45:08 CentOS-80-stream-amd64-base sshd[895039]: Accepted publickey for npontucontrl from 65.109.51.221 port 58486 ssh2: RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw Aug 18 10:45:08 CentOS-80-stream-amd64-base sshd[895039]: pam_unix(sshd:session): session opened for user npontucontrl by (uid=0) Aug 18 10:45:08 CentOS-80-stream-amd64-base sshd[895039]: User child is on pid 895097 Aug 18 10:49:45 CentOS-80-stream-amd64-base sshd[928875]: Connection from 65.109.51.221 port 59320 on 138.201.221.144 port 2304 Aug 18 10:49:45 CentOS-80-stream-amd64-base sshd[928875]: Accepted key RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw found at /home/npontucontrl/.ssh/authorized_keys:1 Aug 18 10:49:45 CentOS-80-stream-amd64-base sshd[928875]: Accepted publickey for npontucontrl from 65.109.51.221 port 59320 ssh2: RSA SHA256:Xwt1z1aJLKUdTpS7eZldy3opW/L9qF/kAoJpIZd3KDw Aug 18 10:49:46 CentOS-80-stream-amd64-base sshd[928875]: pam_unix(sshd:session): session opened for user npontucontrl by (uid=0) Aug 18 10:49:46 CentOS-80-stream-amd64-base sshd[928875]: User child is on pid 928921 --- wtmp (last logins) --- mylar pts/3 154.161.2.77 Tue Aug 18 10:13 - 10:47 (00:34) evans pts/4 154.164.176.11 Tue Aug 18 09:56 still logged in evans pts/3 154.164.176.11 Tue Aug 18 09:44 - 10:03 (00:19) mylar pts/3 154.161.2.77 Tue Aug 18 08:27 - 09:33 (01:06) mylar pts/3 154.161.2.77 Tue Aug 18 07:03 - 07:18 (00:15) mylar pts/3 154.161.2.77 Tue Aug 18 06:02 - 06:17 (00:15) mylar pts/3 154.161.2.77 Tue Aug 18 05:34 - 05:49 (00:15) mylar pts/3 154.161.2.77 Tue Aug 18 04:00 - 04:15 (00:15) mylar pts/3 154.161.2.77 Tue Aug 18 02:17 - 02:33 (00:16) mylar pts/3 154.161.2.77 Tue Aug 18 01:55 - 02:14 (00:19) mylar pts/3 154.161.2.77 Tue Aug 18 01:33 - 01:48 (00:15) mylar pts/3 154.161.2.77 Mon Aug 17 23:49 - 00:06 (00:17) mylar pts/3 154.161.2.77 Mon Aug 17 23:30 - 23:46 (00:16) evans pts/3 154.162.70.195 Mon Aug 17 21:45 - 22:27 (00:42) mylar pts/4 154.164.176.11 Mon Aug 17 20:44 - 21:01 (00:17) mylar pts/3 154.164.176.11 Mon Aug 17 20:44 - 21:01 (00:17) mylar pts/4 154.164.176.11 Mon Aug 17 20:24 - 20:42 (00:18) mylar pts/3 154.164.176.11 Mon Aug 17 20:24 - 20:42 (00:18) mylar pts/6 154.164.176.11 Mon Aug 17 19:02 - 20:21 (01:19) mylar pts/5 154.164.176.11 Mon Aug 17 19:02 - 20:22 (01:20) mylar pts/4 154.164.176.11 Mon Aug 17 18:52 - 19:04 (00:12) mylar pts/3 154.164.176.11 Mon Aug 17 18:52 - 19:04 (00:12) mylar pts/4 154.164.176.11 Mon Aug 17 18:13 - 18:28 (00:15) mylar pts/3 154.164.176.11 Mon Aug 17 18:12 - 18:28 (00:15) evans pts/3 154.164.176.11 Mon Aug 17 15:56 - 18:05 (02:08) evans pts/9 154.164.176.11 Mon Aug 17 15:11 - 16:08 (00:57) evans pts/8 154.162.70.195 Mon Aug 17 15:07 - 15:12 (00:05) mylar pts/7 154.161.2.77 Mon Aug 17 15:07 - 18:10 (03:03) mylar pts/5 154.161.2.77 Mon Aug 17 15:07 - 18:10 (03:03) mylar pts/4 154.164.176.11 Mon Aug 17 14:06 - 15:19 (01:13) wtmp begins Thu Aug 13 03:40:55 2026 --- lastlog (all users last login) --- Username Port From Latest root pts/3 Mon Aug 17 23:30:50 +0000 2026 bin **Never logged in** daemon **Never logged in** adm **Never logged in** lp **Never logged in** sync **Never logged in** shutdown **Never logged in** halt **Never logged in** mail **Never logged in** operator **Never logged in** games **Never logged in** ftp **Never logged in** nobody **Never logged in** dbus **Never logged in** systemd-coredump **Never logged in** systemd-resolve **Never logged in** polkitd **Never logged in** unbound **Never logged in** tss **Never logged in** sssd **Never logged in** chrony **Never logged in** sshd **Never logged in** nginx **Never logged in** apache **Never logged in** npontucontrl pts/3 Wed Jul 22 00:43:57 +0000 2026 jones pts/15 145.224.72.81 Tue Jul 16 10:25:12 +0000 2024 deployer pts/45 102.176.94.96 Thu Aug 15 15:31:58 +0000 2024 redis **Never logged in** evans pts/4 154.164.176.11 Tue Aug 18 09:56:29 +0000 2026 ===== [T5] running suspicious processes + etime ===== 7 root 359-20:48:04 [kworker/0:0H-events_highpri] 23 root 359-20:48:04 [kworker/1:0H-events_highpri] 29 root 359-20:48:04 [kworker/2:0H-events_highpri] 35 root 359-20:48:04 [kworker/3:0H-events_highpri] 41 root 359-20:48:04 [kworker/4:0H-events_highpri] 47 root 359-20:48:04 [kworker/5:0H-events_highpri] 53 root 359-20:48:04 [kworker/6:0H-events_highpri] 59 root 359-20:48:04 [kworker/7:0H-events_highpri] 88 root 359-20:48:04 [kworker/1:1H-kblockd] 263 root 359-20:48:03 [kworker/2:1H-kblockd] 266 root 359-20:48:03 [kworker/0:1H-kblockd] 269 root 359-20:48:03 [kworker/3:1H-kblockd] 270 root 359-20:48:03 [kworker/7:1H-kblockd] 274 root 359-20:48:03 [kworker/6:1H-kblockd] 279 root 359-20:48:03 [kworker/4:1H-kblockd] 284 root 359-20:48:03 [kworker/5:1H-kblockd] 738639 root 29:15 [kworker/1:0-cgroup_pidlist_destroy] 747076 root 28:14 [kworker/4:3-cgroup_pidlist_destroy] 776739 root 24:45 [kworker/5:1-cgroup_pidlist_destroy] 785139 root 23:37 [kworker/2:2-cgroup_pidlist_destroy] --- ALL non-system processes (etimes) --- 3 root 359-20:48:04 [rcu_gp] 4 root 359-20:48:04 [rcu_par_gp] 5 root 359-20:48:04 [slub_flushwq] 10 root 359-20:48:04 [mm_percpu_wq] 11 root 359-20:48:04 [rcu_tasks_rude_] 12 root 359-20:48:04 [rcu_tasks_trace] 14 root 359-20:48:04 [rcu_sched] 15 root 359-20:48:04 [migration/0] 16 root 359-20:48:04 [watchdog/0] 17 root 359-20:48:04 [cpuhp/0] 18 root 359-20:48:04 [cpuhp/1] 19 root 359-20:48:04 [watchdog/1] 20 root 359-20:48:04 [migration/1] 24 root 359-20:48:04 [cpuhp/2] 25 root 359-20:48:04 [watchdog/2] 26 root 359-20:48:04 [migration/2] 30 root 359-20:48:04 [cpuhp/3] 31 root 359-20:48:04 [watchdog/3] 32 root 359-20:48:04 [migration/3] 36 root 359-20:48:04 [cpuhp/4] 37 root 359-20:48:04 [watchdog/4] 38 root 359-20:48:04 [migration/4] 42 root 359-20:48:04 [cpuhp/5] 43 root 359-20:48:04 [watchdog/5] 44 root 359-20:48:04 [migration/5] 48 root 359-20:48:04 [cpuhp/6] 49 root 359-20:48:04 [watchdog/6] 50 root 359-20:48:04 [migration/6] 54 root 359-20:48:04 [cpuhp/7] 55 root 359-20:48:04 [watchdog/7] ===== [T6] network connections (C2 / mining pool) ===== State Recv-Q Send-Q Local Address:Port Peer Address:Port Process ESTAB 0 0 138.201.221.144:4444 62.249.157.21:54782 ESTAB 0 0 138.201.221.144:443 104.23.239.96:10687 ESTAB 0 0 138.201.221.144:4444 179.64.71.73:31688 ESTAB 0 0 138.201.221.144:39612 95.216.48.142:3117 ESTAB 0 0 138.201.221.144:443 170.81.43.147:36452 ESTAB 0 0 138.201.221.144:47668 136.243.14.79:9092 ESTAB 0 0 138.201.221.144:443 172.70.248.24:10647 ESTAB 0 0 138.201.221.144:59012 65.21.134.82:3117 ESTAB 0 0 138.201.221.144:80 162.158.243.137:12807 ESTAB 0 0 138.201.221.144:443 104.23.221.95:13118 ESTAB 0 0 138.201.221.144:443 172.69.151.148:13842 CLOSE-WAIT 110 0 138.201.221.144:49366 49.12.119.112:587 ESTAB 0 0 138.201.221.144:4444 154.160.19.211:13471 ESTAB 0 0 138.201.221.144:4444 154.164.176.11:62800 ESTAB 0 0 138.201.221.144:4444 154.160.17.224:38043 ESTAB 0 0 138.201.221.144:4444 179.64.71.73:28784 ESTAB 0 0 138.201.221.144:4444 154.164.176.11:56693 ESTAB 0 0 138.201.221.144:443 172.68.194.201:14175 ESTAB 0 0 138.201.221.144:443 162.158.182.189:10856 ESTAB 0 0 138.201.221.144:443 162.158.110.28:13518 ESTAB 0 0 138.201.221.144:443 172.71.164.72:12491 ESTAB 0 0 138.201.221.144:4444 154.160.19.211:14742 ESTAB 0 0 138.201.221.144:443 172.71.196.130:12423 ESTAB 0 0 138.201.221.144:4444 91.202.233.79:63518 ESTAB 0 0 138.201.221.144:4444 179.64.71.73:40512 ESTAB 0 0 138.201.221.144:443 172.70.247.94:13381 ESTAB 0 0 138.201.221.144:4444 154.160.17.157:25405 ESTAB 0 0 138.201.221.144:37798 65.21.134.82:3117 ESTAB 0 0 138.201.221.144:4444 154.161.31.230:39702 --- /proc/net raw if ss hides --- Recv-Q Send-Q Local Address:Port Peer Address:Port Process 0 0 138.201.221.144:4444 62.249.157.21:54782 0 0 138.201.221.144:443 104.23.239.96:10687 0 0 127.0.0.1:53956 127.0.0.1:6379 0 0 127.0.0.1:49974 127.0.0.1:5432 0 0 138.201.221.144:2304 154.161.26.0:33698 0 0 138.201.221.144:4444 179.64.71.73:31688 0 0 138.201.221.144:39612 95.216.48.142:3117 0 0 138.201.221.144:443 170.81.43.147:36452 0 0 127.0.0.1:35874 127.0.0.1:5432 0 0 138.201.221.144:47668 136.243.14.79:9092 0 0 138.201.221.144:443 172.70.248.24:10647 0 0 138.201.221.144:2304 143.105.209.30:1204 0 0 138.201.221.144:5432 138.201.221.144:43568 0 0 138.201.221.144:59012 65.21.134.82:3117 0 0 138.201.221.144:80 162.158.243.137:12807 0 0 138.201.221.144:443 104.23.221.95:13118 0 0 127.0.0.1:45040 127.0.0.1:5432 0 0 138.201.221.144:443 172.69.151.148:13842 0 0 127.0.0.1:6379 127.0.0.1:35360 0 0 127.0.0.1:32934 127.0.0.1:9082 0 0 138.201.221.144:4444 154.160.19.211:13471 0 0 138.201.221.144:4444 154.164.176.11:62800 0 0 138.201.221.144:4444 154.160.17.224:38043 0 0 127.0.0.1:40880 127.0.0.1:5432 0 0 127.0.0.1:32914 127.0.0.1:5432 0 0 138.201.221.144:4444 179.64.71.73:28784 0 0 138.201.221.144:4444 154.164.176.11:56693 0 0 138.201.221.144:2304 154.161.18.189:48320 0 0 127.0.0.1:6379 127.0.0.1:38298 ===== [T7] cron / systemd persistence (actor-installed) ===== --- all user crontabs --- ### npontucontrl ### mylar ### nosa ### kelvin ### root --- systemd timers (non-standard) --- NEXT LEFT LAST PASSED UNIT ACTIVATES 4 timers listed. --- systemd services modified recently --- /etc/systemd/system/cleanweb.service ===== [T8] yum/rpm history (actor-installed packages) ===== filebeat-8.19.5-1.x86_64 Fri 17 Oct 2025 08:02:25 PM UTC gpg-pubkey-d88e42b4-64f6fad9 Fri 17 Oct 2025 08:01:05 PM UTC ffmpeg-devel-4.2.10-1.el8.x86_64 Fri 17 Oct 2025 12:01:17 AM UTC libavdevice-4.2.10-1.el8.x86_64 Thu 16 Oct 2025 11:54:00 PM UTC lame-libs-3.100-6.el8.x86_64 Thu 16 Oct 2025 11:54:00 PM UTC ffmpeg-libs-4.2.10-1.el8.x86_64 Thu 16 Oct 2025 11:54:00 PM UTC ffmpeg-4.2.10-1.el8.x86_64 Thu 16 Oct 2025 11:54:00 PM UTC pulseaudio-libs-14.0-4.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC mesa-libGL-23.1.4-2.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libvpx-1.7.0-10.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libvdpau-1.4-2.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libva-2.13.0-2.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libv4l-1.14.2-3.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libmfx-1.25-4.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libglvnd-glx-1.3.4-2.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libglvnd-1.3.4-2.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libcdio-paranoia-10.2+0.94+2-3.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libcdio-2.0.0-3.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libbluray-1.0.2-3.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC libasyncns-0.8-14.el8.x86_64 Thu 16 Oct 2025 11:53:59 PM UTC --- yum history --- -rw-r--r--. 1 root root 582197 Aug 18 10:28 /var/log/dnf.log cli.run() File "/usr/lib/python3.6/site-packages/dnf/cli/cli.py", line 1055, in run return self.command.run() File "/usr/lib/python3.6/site-packages/dnf/cli/commands/makecache.py", line 50, in run return self.base.update_cache(timer) File "/usr/lib/python3.6/site-packages/dnf/base.py", line 376, in update_cache self.fill_sack(load_system_repo=False, load_available_repos=True) # performs the md sync File "/usr/lib/python3.6/site-packages/dnf/base.py", line 405, in fill_sack self._add_repo_to_sack(r) File "/usr/lib/python3.6/site-packages/dnf/base.py", line 140, in _add_repo_to_sack repo.load() File "/usr/lib/python3.6/site-packages/dnf/repo.py", line 580, in load raise dnf.exceptions.RepoError(str(e)) dnf.exceptions.RepoError: Failed to download metadata for repo 'pgdg13': Cannot download repomd.xml: Status code: 410 for https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-8-x86_64/repodata/repomd.xml (IP: 2a04:4e42::820) 2026-08-18T09:16:33+0000 CRITICAL Error: Failed to download metadata for repo 'pgdg13': Cannot download repomd.xml: Status code: 410 for https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-8-x86_64/repodata/repomd.xml (IP: 2a04:4e42::820) 2026-08-18T10:28:01+0000 INFO --- logging initialized --- 2026-08-18T10:28:01+0000 DDEBUG timer: config: 42 ms 2026-08-18T10:28:01+0000 DEBUG Loaded plugins: builddep, changelog, config-manager, copr, debug, debuginfo-install, download, generate_completion_cache, groups-manager, needs-restarting, playground, repoclosure, repodiff, repograph, repomanage, reposync, system-upgrade 2026-08-18T10:28:01+0000 DEBUG DNF version: 4.7.0 2026-08-18T10:28:01+0000 DDEBUG Command: dnf makecache --timer 2026-08-18T10:28:01+0000 DDEBUG Installroot: / 2026-08-18T10:28:01+0000 DDEBUG Releasever: 8 2026-08-18T10:28:01+0000 DEBUG cachedir: /var/cache/dnf 2026-08-18T10:28:01+0000 DDEBUG Base command: makecache 2026-08-18T10:28:01+0000 DDEBUG Extra commands: ['makecache', '--timer'] 2026-08-18T10:28:01+0000 DEBUG Unknown configuration option: autorefresh = 1 in /etc/yum.repos.d/elastic.repo 2026-08-18T10:28:01+0000 DEBUG Making cache files for all metadata files. 2026-08-18T10:28:01+0000 INFO Metadata cache refreshed recently. 2026-08-18T10:28:01+0000 DDEBUG Cleaning up. 2026-08-18T10:28:02+0000 DDEBUG Plugins were unloaded. ===== [T9] miner artifacts (known IOCs) ===== --- known miner paths --- ===== [T10] .bash_history file birth time (first command after user creation) ===== File: /home/npontucontrl/.bash_history Size: 1441 Blocks: 8 IO Block: 4096 regular file Device: 902h/2306d Inode: 4985803 Links: 1 Access: (0600/-rw-------) Uid: ( 1000/npontucontrl) Gid: ( 1000/npontucontrl) Context: unconfined_u:object_r:user_home_t:s0 Access: 2026-08-18 10:44:30.005632160 +0000 Modify: 2026-07-22 05:15:49.545911422 +0000 Change: 2026-07-22 05:15:49.545911422 +0000 Birth: 2023-05-29 15:20:54.356998592 +0000 ===== TIMELINE RECON COMPLETE =====