This routine won’t always be observed, however, as it would only be performed randomly. kaudited — A file installed as /usr/bin/kaudited. To ensure that the infected machine won’t crash due to the kernel-mode rootkits, it uses different modules for specific kernel versions. The kaudited binary also drops a watchdog component that will monitor the cryptocurrency miner file and process