A program whose file is gone
A responder collected the /proc exe links from vpn-01. One running process points at a deleted file. Find it, its original path, and the port it serves.
Briefing
Malware often deletes its own file after it starts, so a disk scan finds nothing. The kernel still knows what was loaded: the link at /proc/<pid>/exe ends in (deleted).
The responder saved the output of ls -l /proc/*/exe to /cases/ir-88/proc_exe.txt before anything was changed.
vpn-01 · Processes and ports
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.