dcrat | fe0816092e006960f2261a3fa919b577aa392291bb0a11149805c651ac633909

Processes:

cat

description	ioc	process
/var/spool/cron/crontabs	/var/spool/cron/crontabs
/etc/crontab	/etc/crontab
/var/spool/cron/	/var/spool/cron/	cat
/etc/crontab	/etc/crontab
/var/spool/cron/crontabs	/var/spool/cron/crontabs
/etc/crontab	/etc/crontab
/var/spool/cron/crontabs	/var/spool/cron/crontabs
/var/spool/cron/crontabs/root	/var/spool/cron/crontabs/root
/etc/cron.d/tomcat	/etc/cron.d/tomcat

Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc process

/etc/init.d/apparmor /etc/init.d/apparmor

description	ioc	process
/etc/init.d/apparmor	/etc/init.d/apparmor

Modifies rc script 1 TTPs 7 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

description	ioc	process
/etc/rc3.d/	/etc/rc3.d/
/etc/rc0.d/	/etc/rc0.d/
/etc/rc1.d/	/etc/rc1.d/
/etc/rc4.d/	/etc/rc4.d/
/etc/rc5.d/	/etc/rc5.d/
/etc/rc2.d/	/etc/rc2.d/
/etc/rc6.d/	/etc/rc6.d/

Write file to user bin folder 1 TTPs 30 IoCs

Hijack Execution Flow

Processes:

dpkgchattrdpkgchattrchattrufwdpkg-preconfigureinit.shdpkg-preconfigurechattrchattrchattr

description	ioc	process
/usr/bin/gawk.dpkg-new	/usr/bin/gawk.dpkg-new	dpkg
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d
/usr/sbin/service	/usr/sbin/service
/usr/bin/kswaped	/usr/bin/kswaped	chattr
/usr/sbin/service	/usr/sbin/service
/usr/sbin/unhide-posix.dpkg-new	/usr/sbin/unhide-posix.dpkg-new	dpkg
/usr/bin/irqbalanced	/usr/bin/irqbalanced	chattr
/usr/bin/pamdicks	/usr/bin/pamdicks	chattr
/usr/sbin/service	/usr/sbin/service
/usr/sbin/ufw	/usr/sbin/ufw	ufw
/usr/sbin/dpkg-preconfigure	/usr/sbin/dpkg-preconfigure	dpkg-preconfigure
/usr/bin/kswaped	/usr/bin/kswaped	init.sh
/usr/bin/pamdicks	/usr/bin/pamdicks	init.sh
/usr/sbin/unhide-linux.dpkg-new	/usr/sbin/unhide-linux.dpkg-new	dpkg
/usr/sbin/dpkg-preconfigure	/usr/sbin/dpkg-preconfigure	dpkg-preconfigure
/usr/bin/ip6network	/usr/bin/ip6network	init.sh
/usr/bin/config.json	/usr/bin/config.json
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d
/usr/bin/pyvenv.cfg	/usr/bin/pyvenv.cfg	ufw
/usr/sbin/unhide-tcp.dpkg-new	/usr/sbin/unhide-tcp.dpkg-new	dpkg
/usr/bin/igawk.dpkg-new	/usr/bin/igawk.dpkg-new	dpkg
/usr/bin/irqbalanced	/usr/bin/irqbalanced	init.sh
/usr/bin/ip6network	/usr/bin/ip6network	chattr
/usr/sbin/watchdogs	/usr/sbin/watchdogs
/usr/sbin/unhide_rb.dpkg-new	/usr/sbin/unhide_rb.dpkg-new	dpkg
/usr/bin/rctlcli	/usr/bin/rctlcli	chattr
/usr/bin/systemd-network	/usr/bin/systemd-network	chattr
/usr/bin/exin	/usr/bin/exin
/usr/bin/rctlcli	/usr/bin/rctlcli	init.sh
/usr/bin/systemd-network	/usr/bin/systemd-network	init.sh

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

pspspspspspspspspspspspspspspspspspspsps

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

modprobe

description	ioc	process
/sys/module/ip6_tables/initstate	/sys/module/ip6_tables/initstate	modprobe
/sys/module/x_tables/initstate	/sys/module/x_tables/initstate	modprobe
/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages
/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pspspspspspspspspsunhidepspspspspspspspspspspspspspsps

description	ioc	process
/proc/1393/cmdline	/proc/1393/cmdline	ps
/proc/154/status	/proc/154/status
/proc/157/cmdline	/proc/157/cmdline
/proc/302/stat	/proc/302/stat	ps
/proc/79/stat	/proc/79/stat	ps
/proc/4/stat	/proc/4/stat	ps
/proc/1/status	/proc/1/status
/proc/32/status	/proc/32/status
/proc/83/stat	/proc/83/stat	ps
/proc/152/task/152/status	/proc/152/task/152/status	ps
/proc/4/cmdline	/proc/4/cmdline	ps
/proc/88/stat	/proc/88/stat	ps
/proc/30/stat	/proc/30/stat	ps
/proc/816	/proc/816	unhide
/proc/3362	/proc/3362	unhide
/proc/13634	/proc/13634	unhide
/proc/13758	/proc/13758	unhide
/proc/29/stat	/proc/29/stat	ps
/proc/32/stat	/proc/32/stat	ps
/proc/2/status	/proc/2/status	ps
/proc/562/status	/proc/562/status
/proc/29411	/proc/29411	unhide
/proc/159/status	/proc/159/status
/proc/561/stat	/proc/561/stat
/proc/35/status	/proc/35/status
/proc/9/status	/proc/9/status
/proc/81/cmdline	/proc/81/cmdline
/proc/6398	/proc/6398	unhide
/proc/13872	/proc/13872	unhide
/proc/300/stat	/proc/300/stat
/proc/4/stat	/proc/4/stat	ps
/proc/stat	/proc/stat	ps
/proc/151/cmdline	/proc/151/cmdline
/proc/3/stat	/proc/3/stat	ps
/proc/24/status	/proc/24/status
/proc/167/status	/proc/167/status
/proc/6137	/proc/6137	unhide
/proc/14274	/proc/14274	unhide
/proc/19974	/proc/19974	unhide
/proc/14234	/proc/14234	unhide
/proc/13/stat	/proc/13/stat	ps
/proc/443/stat	/proc/443/stat	ps
/proc/344/status	/proc/344/status	ps
/proc/29/cmdline	/proc/29/cmdline	ps
/proc/190/status	/proc/190/status
/proc/114/status	/proc/114/status	ps
/proc/13/status	/proc/13/status	ps
/proc/13158	/proc/13158	unhide
/proc/546/status	/proc/546/status
/proc/9/status	/proc/9/status	ps
/proc/349/task/349/stat	/proc/349/task/349/stat	ps
/proc/19/cmdline	/proc/19/cmdline	ps
/proc/190/stat	/proc/190/stat	ps
/proc/34/cmdline	/proc/34/cmdline
/proc/2/cmdline	/proc/2/cmdline	ps
/proc/165/status	/proc/165/status
/proc/26819	/proc/26819	unhide
/proc/30574	/proc/30574	unhide
/proc/31819	/proc/31819	unhide
/proc/83	/proc/83	unhide
/proc/10689	/proc/10689	unhide
/proc/352/cmdline	/proc/352/cmdline
/proc/163/status	/proc/163/status	ps
/proc/3982	/proc/3982	unhide

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

Processes:

apt-getapt-extracttemplatesapt-getapt-extracttemplates

description	ioc	process
/tmp/fileutl.message.uSN0bD	/tmp/fileutl.message.uSN0bD	apt-get
/tmp/fileutl.message.ubPWmv	/tmp/fileutl.message.ubPWmv	apt-extracttemplates
/tmp/fileutl.message.cRbyFb	/tmp/fileutl.message.cRbyFb
/tmp/fileutl.message.aZF1Ts	/tmp/fileutl.message.aZF1Ts	apt-get
/tmp/jmxx	/tmp/jmxx
/tmp/2Ne80nA	/tmp/2Ne80nA
/tmp/.rod.tgz.2	/tmp/.rod.tgz.2
/tmp/fileutl.message.Ozyxdm	/tmp/fileutl.message.Ozyxdm
/tmp/fileutl.message.A9xhGC	/tmp/fileutl.message.A9xhGC	apt-extracttemplates
/tmp/.rod	/tmp/.rod
/tmp/watchdogs	/tmp/watchdogs
/tmp/logo9.jpg	/tmp/logo9.jpg
/tmp/proc	/tmp/proc
/tmp/fileutl.message.HuJkMX	/tmp/fileutl.message.HuJkMX	apt-get
/tmp/fileutl.message.ZjjxbU	/tmp/fileutl.message.ZjjxbU	apt-get
/tmp/fileutl.message.TRxMKf	/tmp/fileutl.message.TRxMKf
/tmp/fileutl.message.FXNXS7	/tmp/fileutl.message.FXNXS7
/tmp/fileutl.message.YHXW6l	/tmp/fileutl.message.YHXW6l	apt-get
/tmp/fileutl.message.bBfKww	/tmp/fileutl.message.bBfKww	apt-get
/tmp/.java	/tmp/.java
/tmp/.mynews1234	/tmp/.mynews1234
/tmp/fileutl.message.cC6BYt	/tmp/fileutl.message.cC6BYt	apt-get
/tmp/fileutl.message.c2DBS5	/tmp/fileutl.message.c2DBS5	apt-get
/tmp/fileutl.message.wTihdf	/tmp/fileutl.message.wTihdf	apt-get
/tmp/fileutl.message.v2sVNa	/tmp/fileutl.message.v2sVNa	apt-extracttemplates
/tmp/fileutl.message.hWWjEr	/tmp/fileutl.message.hWWjEr
/tmp/fileutl.message.GvFG1J	/tmp/fileutl.message.GvFG1J	apt-extracttemplates
/tmp/fileutl.message.bwLT5e	/tmp/fileutl.message.bwLT5e	apt-extracttemplates
/tmp/fileutl.message.9DYPso	/tmp/fileutl.message.9DYPso	apt-extracttemplates
/tmp/go.sh	/tmp/go.sh
/tmp/miner.sh	/tmp/miner.sh
/tmp/systemctI	/tmp/systemctI
/tmp/.hod	/tmp/.hod
/tmp/lilpip	/tmp/lilpip
/tmp/kerberods	/tmp/kerberods
/tmp/conf.n	/tmp/conf.n
/tmp/fileutl.message.txpt13	/tmp/fileutl.message.txpt13	apt-extracttemplates
/tmp/fileutl.message.O07NNW	/tmp/fileutl.message.O07NNW	apt-get
/tmp/fileutl.message.zNKaPR	/tmp/fileutl.message.zNKaPR	apt-get
/tmp/fileutl.message.WSioBz	/tmp/fileutl.message.WSioBz	apt-get
/tmp/fileutl.message.LyGFLv	/tmp/fileutl.message.LyGFLv	apt-get
/tmp/fileutl.message.VQp72Y	/tmp/fileutl.message.VQp72Y
/tmp/fileutl.message.uwgP8R	/tmp/fileutl.message.uwgP8R	apt-get
/tmp/.rod.tgz.1	/tmp/.rod.tgz.1
/tmp/j2.conf	/tmp/j2.conf
/tmp/seasame	/tmp/seasame
/tmp/fileutl.message.wNxa1k	/tmp/fileutl.message.wNxa1k
/tmp/fileutl.message.YDzNHZ	/tmp/fileutl.message.YDzNHZ	apt-get
/tmp/fileutl.message.Z73Jcg	/tmp/fileutl.message.Z73Jcg	apt-extracttemplates
/tmp/osw.hb	/tmp/osw.hb
/tmp/fileutl.message.eiJQy4	/tmp/fileutl.message.eiJQy4
/tmp/systemxlv	/tmp/systemxlv
/tmp/fileutl.message.NkR16Y	/tmp/fileutl.message.NkR16Y
/tmp/.mer.tgz.1	/tmp/.mer.tgz.1
/tmp/.pt.tgz.1	/tmp/.pt.tgz.1
/tmp/fileutl.message.YGIsb1	/tmp/fileutl.message.YGIsb1	apt-get
/tmp/fileutl.message.uOZcWw	/tmp/fileutl.message.uOZcWw	apt-get
/tmp/fileutl.message.vKnhsP	/tmp/fileutl.message.vKnhsP	apt-extracttemplates
/tmp/ddg	/tmp/ddg
/tmp/.tmpleve	/tmp/.tmpleve
/tmp/java	/tmp/java
/tmp/fileutl.message.KvO2BB	/tmp/fileutl.message.KvO2BB	apt-get
/tmp/runtime.sh	/tmp/runtime.sh
/tmp/fileutl.message.mRKgO5	/tmp/fileutl.message.mRKgO5	apt-get

GoLang User-Agent 16 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description	flow	ioc
HTTP User-Agent header	7771	Go-http-client/1.1
HTTP User-Agent header	18852	Go-http-client/1.1
HTTP User-Agent header	40785	Go-http-client/1.1
HTTP User-Agent header	39467	Go-http-client/1.1
HTTP User-Agent header	17130	Go-http-client/1.1
HTTP User-Agent header	18887	Go-http-client/1.1
HTTP User-Agent header	19934	Go-http-client/1.1
HTTP User-Agent header	20124	Go-http-client/1.1
HTTP User-Agent header	28625	Go-http-client/1.1
HTTP User-Agent header	44376	Go-http-client/1.1
HTTP User-Agent header	51059	Go-http-client/1.1
HTTP User-Agent header	29	Go-http-client/1.1
HTTP User-Agent header	30	Go-http-client/1.1
HTTP User-Agent header	26667	Go-http-client/1.1
HTTP User-Agent header	29797	Go-http-client/1.1
HTTP User-Agent header	36545	Go-http-client/1.1

./init.sh
./init.sh
1⤵
- Deletes system logs
- Write file to user bin folder
PID:562

/bin/sync
sync
2⤵
PID:563

/bin/cat
cat /var/spool/cron/
2⤵
- Creates/modifies Cron job
PID:564

/bin/cat
cat /root/.ssh/authorized_keys
2⤵
PID:565

/bin/mv
mv /usr/bin/curl /usr/bin/url
2⤵
PID:566

/bin/mv
mv /usr/bin/url /usr/bin/cdt
2⤵
PID:567

/bin/mv
mv /usr/bin/cur /usr/bin/cdt
2⤵
PID:568

/bin/mv
mv /usr/bin/cdl /usr/bin/cdt
2⤵
PID:569

/bin/mv
mv /usr/bin/cd1 /usr/bin/cdt
2⤵
PID:570

/bin/mv
mv /usr/bin/wget /usr/bin/get
2⤵
PID:571

/bin/mv
mv /usr/bin/get /usr/bin/wdt
2⤵
PID:572

/bin/mv
mv /usr/bin/wge /usr/bin/wdt
2⤵
PID:573

/bin/mv
mv /usr/bin/wdl /usr/bin/wdt
2⤵
PID:574

/bin/mv
mv /usr/bin/wd1 /usr/bin/wdt
2⤵
PID:575

/bin/rm
rm -rf /var/log/syslog
2⤵
- Deletes system logs
PID:576

/usr/bin/chattr
chattr -iua /tmp/
2⤵
PID:577

/usr/bin/chattr
chattr -iua /var/tmp/
2⤵
PID:578

/usr/sbin/ufw
ufw disable
2⤵
- Write file to user bin folder
PID:579

/sbin/iptables
/sbin/iptables -V
3⤵
PID:585

/lib/ufw/ufw-init
/lib/ufw/ufw-init force-stop
3⤵
PID:586

/sbin/ip6tables
ip6tables -L INPUT -n
4⤵
PID:587

/sbin/iptables
iptables -F ufw-logging-deny
4⤵
PID:592

/sbin/iptables
iptables -F ufw-logging-allow
4⤵
PID:595

/sbin/iptables
iptables -F ufw-not-local
4⤵
PID:596

/sbin/iptables
iptables -F ufw-user-logging-input
4⤵
PID:597

/sbin/iptables
iptables -F ufw-user-limit-accept
4⤵
PID:598

/sbin/iptables
iptables -F ufw-user-limit
4⤵
PID:599

/sbin/iptables
iptables -F ufw-skip-to-policy-input
4⤵
PID:600

/sbin/iptables
iptables -F ufw-reject-input
4⤵
PID:601

/sbin/iptables
iptables -F ufw-after-logging-input
4⤵
PID:602

/sbin/iptables
iptables -F ufw-after-input
4⤵
PID:603

/sbin/iptables
iptables -F ufw-user-input
4⤵
PID:604

/sbin/iptables
iptables -F ufw-before-input
4⤵
PID:605

/sbin/iptables
iptables -F ufw-before-logging-input
4⤵
PID:606

/sbin/iptables
iptables -F ufw-skip-to-policy-forward
4⤵
PID:607

/sbin/iptables
iptables -F ufw-reject-forward
4⤵
PID:608

/sbin/iptables
iptables -F ufw-after-logging-forward
4⤵
PID:609

/sbin/iptables
iptables -F ufw-after-forward
4⤵
PID:610

/sbin/iptables
iptables -F ufw-user-logging-forward
4⤵
PID:611

/sbin/iptables
iptables -F ufw-user-forward
4⤵
PID:612

/sbin/iptables
iptables -F ufw-before-forward
4⤵
PID:613

/sbin/iptables
iptables -F ufw-before-logging-forward
4⤵
PID:614

/sbin/iptables
iptables -F ufw-track-forward
4⤵
PID:615

/sbin/iptables
iptables -F ufw-track-output
4⤵
PID:616

/sbin/iptables
iptables -F ufw-track-input
4⤵
PID:617

/sbin/iptables
iptables -F ufw-skip-to-policy-output
4⤵
PID:618

/sbin/iptables
iptables -F ufw-reject-output
4⤵
PID:619

/sbin/iptables
iptables -F ufw-after-logging-output
4⤵
PID:620

/sbin/iptables
iptables -F ufw-after-output
4⤵
PID:621

/sbin/iptables
iptables -F ufw-user-logging-output
4⤵
PID:622

/sbin/iptables
iptables -F ufw-user-output
4⤵
PID:623

/sbin/iptables
iptables -F ufw-before-output
4⤵
PID:624

/sbin/iptables
iptables -F ufw-before-logging-output
4⤵
PID:625

/sbin/iptables
iptables -Z ufw-logging-deny
4⤵
PID:626

/sbin/iptables
iptables -Z ufw-logging-allow
4⤵
PID:627

/sbin/iptables
iptables -Z ufw-not-local
4⤵
PID:628

/sbin/iptables
iptables -Z ufw-user-logging-input
4⤵
PID:629

/sbin/iptables
iptables -Z ufw-user-limit-accept
4⤵
PID:630

/sbin/iptables
iptables -Z ufw-user-limit
4⤵
PID:631

/sbin/iptables
iptables -Z ufw-skip-to-policy-input
4⤵
PID:632

/sbin/iptables
iptables -Z ufw-reject-input
4⤵
PID:633

/sbin/iptables
iptables -Z ufw-after-logging-input
4⤵
PID:634

/sbin/iptables
iptables -Z ufw-after-input
4⤵
PID:635

/sbin/iptables
iptables -Z ufw-user-input
4⤵
PID:636

/sbin/iptables
iptables -Z ufw-before-input
4⤵
PID:637

/sbin/iptables
iptables -Z ufw-before-logging-input
4⤵
PID:638

/sbin/iptables
iptables -Z ufw-skip-to-policy-forward
4⤵
PID:639

/sbin/iptables
iptables -Z ufw-reject-forward
4⤵
PID:640

/sbin/iptables
iptables -Z ufw-after-logging-forward
4⤵
PID:641

/sbin/iptables
iptables -Z ufw-after-forward
4⤵
PID:642

/sbin/iptables
iptables -Z ufw-user-logging-forward
4⤵
PID:643

/sbin/iptables
iptables -Z ufw-user-forward
4⤵
PID:644

/sbin/iptables
iptables -Z ufw-before-forward
4⤵
PID:645

/sbin/iptables
iptables -Z ufw-before-logging-forward
4⤵
PID:646

/sbin/iptables
iptables -Z ufw-track-forward
4⤵
PID:647

/sbin/iptables
iptables -Z ufw-track-output
4⤵
PID:648

/sbin/iptables
iptables -Z ufw-track-input
4⤵
PID:649

/sbin/iptables
iptables -Z ufw-skip-to-policy-output
4⤵
PID:650

/sbin/iptables
iptables -Z ufw-reject-output
4⤵
PID:651

/sbin/iptables
iptables -Z ufw-after-logging-output
4⤵
PID:652

/sbin/iptables
iptables -Z ufw-after-output
4⤵
PID:653

/sbin/iptables
iptables -Z ufw-user-logging-output
4⤵
PID:654

/sbin/iptables
iptables -Z ufw-user-output
4⤵
PID:655

/sbin/iptables
iptables -Z ufw-before-output
4⤵
PID:656

/sbin/iptables
iptables -Z ufw-before-logging-output
4⤵
PID:657

/sbin/iptables
iptables -X ufw-logging-deny
4⤵
PID:658

/sbin/iptables
iptables -X ufw-logging-allow
4⤵
PID:659

/sbin/iptables
iptables -X ufw-not-local
4⤵
PID:660

/sbin/iptables
iptables -X ufw-user-logging-input
4⤵
PID:661

/sbin/iptables
iptables -X ufw-user-logging-output
4⤵
PID:662

/sbin/iptables
iptables -X ufw-user-logging-forward
4⤵
PID:663

/sbin/iptables
iptables -X ufw-user-limit-accept
4⤵
PID:664

/sbin/iptables
iptables -X ufw-user-limit
4⤵
PID:665

/sbin/iptables
iptables -X ufw-user-input
4⤵
PID:666

/sbin/iptables
iptables -X ufw-user-forward
4⤵
PID:667

/sbin/iptables
iptables -X ufw-user-output
4⤵
PID:668

/sbin/iptables
iptables -X ufw-skip-to-policy-input
4⤵
PID:669

/sbin/iptables
iptables -X ufw-skip-to-policy-output
4⤵
PID:670

/sbin/iptables
iptables -X ufw-skip-to-policy-forward
4⤵
PID:671

/sbin/iptables
iptables -P INPUT ACCEPT
4⤵
PID:672

/sbin/iptables
iptables -P OUTPUT ACCEPT
4⤵
PID:673

/sbin/iptables
iptables -P FORWARD ACCEPT
4⤵
PID:674

/sbin/ip6tables
ip6tables -F ufw6-logging-deny
4⤵
PID:675

/sbin/ip6tables
ip6tables -F ufw6-logging-allow
4⤵
PID:676

/sbin/ip6tables
ip6tables -F ufw6-not-local
4⤵
PID:677

/sbin/ip6tables
ip6tables -F ufw6-user-logging-input
4⤵
PID:678

/sbin/ip6tables
ip6tables -F ufw6-user-limit-accept
4⤵
PID:679

/sbin/ip6tables
ip6tables -F ufw6-user-limit
4⤵
PID:680

/sbin/ip6tables
ip6tables -F ufw6-skip-to-policy-input
4⤵
PID:681

/sbin/ip6tables
ip6tables -F ufw6-reject-input
4⤵
PID:682

/sbin/ip6tables
ip6tables -F ufw6-after-logging-input
4⤵
PID:683

/sbin/ip6tables
ip6tables -F ufw6-after-input
4⤵
PID:684

/sbin/ip6tables
ip6tables -F ufw6-user-input
4⤵
PID:685

/sbin/ip6tables
ip6tables -F ufw6-before-input
4⤵
PID:686

/sbin/ip6tables
ip6tables -F ufw6-before-logging-input
4⤵
PID:687

/sbin/ip6tables
ip6tables -F ufw6-skip-to-policy-forward
4⤵
PID:688

/sbin/ip6tables
ip6tables -F ufw6-reject-forward
4⤵
PID:689

/sbin/ip6tables
ip6tables -F ufw6-after-logging-forward
4⤵
PID:690

/sbin/ip6tables
ip6tables -F ufw6-after-forward
4⤵
PID:691

/sbin/ip6tables
ip6tables -F ufw6-user-logging-forward
4⤵
PID:692

/sbin/ip6tables
ip6tables -F ufw6-user-forward
4⤵
PID:693

/sbin/ip6tables
ip6tables -F ufw6-before-forward
4⤵
PID:694

/sbin/ip6tables
ip6tables -F ufw6-before-logging-forward
4⤵
PID:695

/sbin/ip6tables
ip6tables -F ufw6-track-forward
4⤵
PID:696

/sbin/ip6tables
ip6tables -F ufw6-track-output
4⤵
PID:697

/sbin/ip6tables
ip6tables -F ufw6-track-input
4⤵
PID:698

/sbin/ip6tables
ip6tables -F ufw6-skip-to-policy-output
4⤵
PID:699

/sbin/ip6tables
ip6tables -F ufw6-reject-output
4⤵
PID:700

/sbin/ip6tables
ip6tables -F ufw6-after-logging-output
4⤵
PID:701

/sbin/ip6tables
ip6tables -F ufw6-after-output
4⤵
PID:702

/sbin/ip6tables
ip6tables -F ufw6-user-logging-output
4⤵
PID:703

/sbin/ip6tables
ip6tables -F ufw6-user-output
4⤵
PID:704

/sbin/ip6tables
ip6tables -F ufw6-before-output
4⤵
PID:705

/sbin/ip6tables
ip6tables -F ufw6-before-logging-output
4⤵
PID:706

/sbin/ip6tables
ip6tables -Z ufw6-logging-deny
4⤵
PID:707

/sbin/ip6tables
ip6tables -Z ufw6-logging-allow
4⤵
PID:708

/sbin/ip6tables
ip6tables -Z ufw6-not-local
4⤵
PID:709

/sbin/ip6tables
ip6tables -Z ufw6-user-logging-input
4⤵
PID:710

/sbin/ip6tables
ip6tables -Z ufw6-user-limit-accept
4⤵
PID:711

/sbin/ip6tables
ip6tables -Z ufw6-user-limit
4⤵
PID:712

/sbin/ip6tables
ip6tables -Z ufw6-skip-to-policy-input
4⤵
PID:713

/sbin/ip6tables
ip6tables -Z ufw6-reject-input
4⤵
PID:714

/sbin/ip6tables
ip6tables -Z ufw6-after-logging-input
4⤵
PID:715

/sbin/ip6tables
ip6tables -Z ufw6-after-input
4⤵
PID:716

/sbin/ip6tables
ip6tables -Z ufw6-user-input
4⤵
PID:717

/sbin/ip6tables
ip6tables -Z ufw6-before-input
4⤵
PID:718

/sbin/ip6tables
ip6tables -Z ufw6-before-logging-input
4⤵
PID:719

/sbin/ip6tables
ip6tables -Z ufw6-skip-to-policy-forward
4⤵
PID:720

/sbin/ip6tables
ip6tables -Z ufw6-reject-forward
4⤵
PID:721

/sbin/ip6tables
ip6tables -Z ufw6-after-logging-forward
4⤵
PID:722

/sbin/ip6tables
ip6tables -Z ufw6-after-forward
4⤵
PID:723

/sbin/ip6tables
ip6tables -Z ufw6-user-logging-forward
4⤵
PID:724

/sbin/ip6tables
ip6tables -Z ufw6-user-forward
4⤵
PID:725

/sbin/ip6tables
ip6tables -Z ufw6-before-forward
4⤵
PID:726

/sbin/ip6tables
ip6tables -Z ufw6-before-logging-forward
4⤵
PID:727

/sbin/ip6tables
ip6tables -Z ufw6-track-forward
4⤵
PID:728

/sbin/ip6tables
ip6tables -Z ufw6-track-output
4⤵
PID:729

/sbin/ip6tables
ip6tables -Z ufw6-track-input
4⤵
PID:730

/sbin/ip6tables
ip6tables -Z ufw6-skip-to-policy-output
4⤵
PID:731

/sbin/ip6tables
ip6tables -Z ufw6-reject-output
4⤵
PID:732

/sbin/ip6tables
ip6tables -Z ufw6-after-logging-output
4⤵
PID:733

/sbin/ip6tables
ip6tables -Z ufw6-after-output
4⤵
PID:734

/sbin/ip6tables
ip6tables -Z ufw6-user-logging-output
4⤵
PID:735

/sbin/ip6tables
ip6tables -Z ufw6-user-output
4⤵
PID:736

/sbin/ip6tables
ip6tables -Z ufw6-before-output
4⤵
PID:737

/sbin/ip6tables
ip6tables -Z ufw6-before-logging-output
4⤵
PID:738

/sbin/ip6tables
ip6tables -X ufw6-logging-deny
4⤵
PID:739

/sbin/ip6tables
ip6tables -X ufw6-logging-allow
4⤵
PID:740

/sbin/ip6tables
ip6tables -X ufw6-not-local
4⤵
PID:741

/sbin/ip6tables
ip6tables -X ufw6-user-logging-input
4⤵
PID:742

/sbin/ip6tables
ip6tables -X ufw6-user-logging-output
4⤵
PID:743

/sbin/ip6tables
ip6tables -X ufw6-user-logging-forward
4⤵
PID:744

/sbin/ip6tables
ip6tables -X ufw6-user-limit-accept
4⤵
PID:745

/sbin/ip6tables
ip6tables -X ufw6-user-limit
4⤵
PID:746

/sbin/ip6tables
ip6tables -X ufw6-user-input
4⤵
PID:747

/sbin/ip6tables
ip6tables -X ufw6-user-forward
4⤵
PID:748

/sbin/ip6tables
ip6tables -X ufw6-user-output
4⤵
PID:749

/sbin/ip6tables
ip6tables -X ufw6-skip-to-policy-input
4⤵
PID:750

/sbin/ip6tables
ip6tables -X ufw6-skip-to-policy-output
4⤵
PID:751

/sbin/ip6tables
ip6tables -X ufw6-skip-to-policy-forward
4⤵
PID:752

/sbin/ip6tables
ip6tables -P INPUT ACCEPT
4⤵
PID:753

/sbin/ip6tables
ip6tables -P OUTPUT ACCEPT
4⤵
PID:754

/sbin/ip6tables
ip6tables -P FORWARD ACCEPT
4⤵
PID:755

/sbin/iptables
iptables -F
2⤵
PID:756

/usr/sbin/userdel
userdel akay
2⤵
PID:757

/usr/sbin/userdel
userdel vfinder
2⤵
PID:758

/bin/rm
rm -rf "/tmp/addres*"
2⤵
PID:759

/bin/rm
rm -rf "/tmp/walle*"
2⤵
PID:760

/bin/rm
rm -rf /tmp/keys
2⤵
PID:761

/bin/grep
grep -i "[a]liyun"
2⤵
PID:763

/bin/ps
ps aux
2⤵
PID:762

/bin/grep
grep -i "[y]unjing"
2⤵
PID:765

/bin/ps
ps aux
2⤵
PID:764

/bin/sleep
sleep 1
2⤵
PID:766

/usr/bin/apt-get
apt-get install -y unhide
2⤵
- Deletes system logs
- Writes file to tmp directory
PID:768

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:769

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:770

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:771

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
- Modifies hosts file
- Writes DNS configuration
PID:772

/bin/sh
/bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
3⤵
PID:773

/usr/sbin/dpkg-preconfigure
/usr/sbin/dpkg-preconfigure --apt
4⤵
- Write file to user bin folder
PID:774

/usr/local/sbin/locale
locale charmap
5⤵
PID:775

/usr/local/bin/locale
locale charmap
5⤵
PID:775

/usr/sbin/locale
locale charmap
5⤵
PID:775

/usr/bin/locale
locale charmap
5⤵
PID:775

/usr/bin/dpkg
/usr/bin/dpkg --assert-multi-arch
3⤵
PID:781

/usr/bin/dpkg
/usr/bin/dpkg --status-fd 56 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/unhide_20130526-1_amd64.deb
3⤵
- Deletes system logs
- Write file to user bin folder
PID:782

/usr/local/sbin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:783

/usr/local/bin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:783

/usr/sbin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:783

/usr/bin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:783

/usr/local/sbin/dpkg-deb
dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:784

/usr/local/bin/dpkg-deb
dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:784

/usr/sbin/dpkg-deb
dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:784

/usr/bin/dpkg-deb
dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:784

/usr/local/sbin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:787

/usr/local/bin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:787

/usr/sbin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:787

/usr/bin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:787

/sbin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:787

/bin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:787

/usr/local/sbin/dpkg-deb
dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:788

/usr/local/bin/dpkg-deb
dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:788

/usr/sbin/dpkg-deb
dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:788

/usr/bin/dpkg-deb
dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
4⤵
PID:788

/usr/local/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:791

/usr/local/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:791

/usr/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:791

/usr/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:791

/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:791

/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:791

/usr/bin/dpkg
/usr/bin/dpkg --status-fd 56 --configure --pending
3⤵
- Deletes system logs
PID:792

/var/lib/dpkg/info/unhide.postinst
/var/lib/dpkg/info/unhide.postinst configure
4⤵
PID:793

/var/lib/dpkg/info/man-db.postinst
/var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
4⤵
PID:794

/usr/bin/perl
perl -e "@pwd = getpwnam(\"man\"); \$) = \$( = \$pwd[3]; \$> = \$< = \$pwd[2]; exec \"/usr/bin/mandb\", @ARGV" -- -pq
5⤵
PID:795

/usr/bin/mandb
/usr/bin/mandb -pq
5⤵
PID:795

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:812

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:813

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:814

/usr/bin/apt-get
apt-get install -y gawk
2⤵
- Deletes system logs
- Writes file to tmp directory
PID:815

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:816

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:817

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:818

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
- Modifies hosts file
- Writes DNS configuration
PID:819

/bin/sh
/bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
3⤵
PID:820

/usr/sbin/dpkg-preconfigure
/usr/sbin/dpkg-preconfigure --apt
4⤵
- Write file to user bin folder
PID:821

/usr/local/sbin/locale
locale charmap
5⤵
PID:822

/usr/local/bin/locale
locale charmap
5⤵
PID:822

/usr/sbin/locale
locale charmap
5⤵
PID:822

/usr/bin/locale
locale charmap
5⤵
PID:822

/usr/bin/dpkg
/usr/bin/dpkg --assert-multi-arch
3⤵
PID:828

/usr/bin/dpkg
/usr/bin/dpkg --status-fd 56 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
3⤵
- Deletes system logs
PID:829

/usr/local/sbin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:830

/usr/local/bin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:830

/usr/sbin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:830

/usr/bin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:830

/usr/local/sbin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:831

/usr/local/bin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:831

/usr/sbin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:831

/usr/bin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb /var/lib/dpkg/tmp.ci
4⤵
PID:831

/usr/local/sbin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:834

/usr/local/bin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:834

/usr/sbin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:834

/usr/bin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:834

/sbin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:834

/bin/tar
tar -x -f - "--warning=no-timestamp"
5⤵
PID:834

/usr/local/sbin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:835

/usr/local/bin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:835

/usr/sbin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:835

/usr/bin/dpkg-deb
dpkg-deb dpkg-deb /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb
4⤵
PID:835

/usr/local/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:838

/usr/local/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:838

/usr/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:838

/usr/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:838

/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:838

/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:838

/usr/bin/dpkg
/usr/bin/dpkg --status-fd 56 --no-triggers --configure libsigsegv2:amd64
3⤵
- Deletes system logs
PID:839

/usr/bin/dpkg
/usr/bin/dpkg --status-fd 56 --no-triggers --unpack --auto-deconfigure "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
3⤵
- Deletes system logs
- Write file to user bin folder
PID:840

/usr/local/sbin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:841

/usr/local/bin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:841

/usr/sbin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:841

/usr/bin/dpkg-split
dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:841

/usr/local/sbin/dpkg-deb
dpkg-deb --control "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb" /var/lib/dpkg/tmp.ci
4⤵
PID:842

/usr/local/bin/dpkg-deb
dpkg-deb --control "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb" /var/lib/dpkg/tmp.ci
4⤵
PID:842

/usr/sbin/dpkg-deb
dpkg-deb --control "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb" /var/lib/dpkg/tmp.ci
4⤵
PID:842

/usr/bin/dpkg-deb
dpkg-deb --control "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb" /var/lib/dpkg/tmp.ci
4⤵
PID:842

/usr/local/sbin/tar
tar -x -f -f "--warning=no-timestamp"
5⤵
PID:845

/usr/local/bin/tar
tar -x -f -f "--warning=no-timestamp"
5⤵
PID:845

/usr/sbin/tar
tar -x -f -f "--warning=no-timestamp"
5⤵
PID:845

/usr/bin/tar
tar -x -f -f "--warning=no-timestamp"
5⤵
PID:845

/sbin/tar
tar -x -f -f "--warning=no-timestamp"
5⤵
PID:845

/bin/tar
tar -x -f -f "--warning=no-timestamp"
5⤵
PID:845

/usr/local/sbin/dpkg-deb
dpkg-deb --fsys-tarfile "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:846

/usr/local/bin/dpkg-deb
dpkg-deb --fsys-tarfile "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:846

/usr/sbin/dpkg-deb
dpkg-deb --fsys-tarfile "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:846

/usr/bin/dpkg-deb
dpkg-deb --fsys-tarfile "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
4⤵
PID:846

/usr/local/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:849

/usr/local/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:849

/usr/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:849

/usr/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:849

/sbin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:849

/bin/rm
rm -rf -- /var/lib/dpkg/tmp.ci
4⤵
PID:849

/usr/bin/dpkg
/usr/bin/dpkg --status-fd 56 --configure --pending
3⤵
- Deletes system logs
PID:850

/var/lib/dpkg/info/gawk.postinst
/var/lib/dpkg/info/gawk.postinst configure
4⤵
PID:851

/usr/bin/update-alternatives
update-alternatives --quiet --install /usr/bin/awk awk /usr/bin/gawk 10 --slave /usr/share/man/man1/awk.1.gz awk.1.gz /usr/share/man/man1/gawk.1.gz --slave /usr/bin/nawk nawk /usr/bin/gawk --slave /usr/share/man/man1/nawk.1.gz nawk.1.gz /usr/share/man/man1/gawk.1.gz
5⤵
- Deletes system logs
PID:852

/var/lib/dpkg/info/man-db.postinst
/var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
4⤵
PID:853

/usr/bin/perl
perl -e "@pwd = getpwnam(\"man\"); \$) = \$( = \$pwd[3]; \$> = \$< = \$pwd[2]; exec \"/usr/bin/mandb\", @ARGV" -- -pq
5⤵
PID:854

/usr/bin/mandb
/usr/bin/mandb -pq
5⤵
PID:854

/var/lib/dpkg/info/libc-bin.postinst
/var/lib/dpkg/info/libc-bin.postinst triggered ldconfig
4⤵
PID:983

/sbin/ldconfig
ldconfig
5⤵
- Writes file to system bin folder
PID:984

/sbin/ldconfig.real
/sbin/ldconfig.real
5⤵
PID:984

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:985

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:986

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
PID:987

/bin/sleep
sleep 1
2⤵
PID:989

/usr/bin/awk
awk "{print \$4}"
2⤵
PID:992

/bin/grep
grep PID:
2⤵
PID:991

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:993

/usr/sbin/unhide
/usr/sbin/unhide quick
2⤵
- Reads runtime system information
PID:990

"" "" "ps --no-header -p 1 o pid"
3⤵
PID:994

/bin/ps
ps --no-header -p 1 o pid
4⤵
- Reads runtime system information
PID:995

�
"" "" "ps --no-header -p 2 o pid"
3⤵
PID:996

/bin/ps
ps --no-header -p 2 o pid
4⤵
PID:997

55f8348ce000-55f83496a000 r-xp 00000000 fc:01 804517 /usr/bin/gawk 55f834b69000-55f834b6d000 r--p 0009b000 fc:01 804517 /usr/bin/gawk 55f834b6d000-55f834b6f000 rw-p 0009f000 fc:01 804517 /usr/bin/gawk 55f834b6f000-55f834b75000 rw-p 00000000 00:00 0 55f836041000-55f836062000 rw-p 00000000 00:00 0 [heap] 7feb4e3b1000-7feb4e68f000 r--p 00000000 fc:01 786457 /usr/lib/locale/locale-archive 7feb4e68f000-7feb4e6b4000 r-xp 00000000 fc:01 262219 /lib/x86_64-linux-gnu/libtinfo.so.5.9 7feb4e6b4000-7feb4e8b4000 ---p 00025000 fc:01 262219 /lib/x86_64-linux-gnu/libtinfo.so.5.9 7feb4e8b4000-7feb4e8b8000 r--p 00025000 fc:01 262219 /lib/x86_64-linux-gnu/libtinfo.so.5.9 7feb4e8b8000-7feb4e8b9000 rw-p 00029000 fc:01 262219 /lib/x86_64-linux-gnu/libtinfo.so.5.9 7feb4e8b9000-7feb4eaa0000 r-xp 00000000 fc:01 272242 /lib/x86_64-linux-gnu/libc-2.27.so 7feb4eaa0000-7feb4eca0000 ---p 001e7000 fc:01 272242 /lib/x86_64-linux-gnu/libc-2.27.so 7feb4eca0000-7feb4eca4000 r--p 001e7000 fc:01 272242 /lib/x86_64-linux-gnu/libc-2.27.so 7feb4eca4000-7feb4eca6000 rw-p 001eb000 fc:01 272242 /lib/x86_64-linux-gnu/libc-2.27.so 7feb4eca6000-7feb4ecaa000 rw-p 00000000 00:00 0 7feb4ecaa000-7feb4ee47000 r-xp 00000000 fc:01 272246 /lib/x86_64-linux-gnu/libm-2.27.so 7feb4ee47000-7feb4f046000 ---p 0019d000 fc:01 272246 /lib/x86_64-linux-gnu/libm-2.27.so 7feb4f046000-7feb4f047000 r--p 0019c000 fc:01 272246 /lib/x86_64-linux-gnu/libm-2.27.so 7feb4f047000-7feb4f048000 rw-p 0019d000 fc:01 272246 /lib/x86_64-linux-gnu/libm-2.27.so 7feb4f048000-7feb4f04b000 r-xp 00000000 fc:01 272245 /lib/x86_64-linux-gnu/libdl-2.27.so 7feb4f04b000-7feb4f24a000 ---p 00003000 fc:01 272245 /lib/x86_64-linux-gnu/libdl-2.27.so 7feb4f24a000-7feb4f24b000 r--p 00002000 fc:01 272245 /lib/x86_64-linux-gnu/libdl-2.27.so 7feb4f24b000-7feb4f24c000 rw-p 00003000 fc:01 272245 /lib/x86_64-linux-gnu/libdl-2.27.so 7feb4f24c000-7feb4f2cb000 r-xp 00000000 fc:01 792204 /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2 7feb4f2cb000-7feb4f4cb000 ---p 0007f000 fc:01 792204 /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2 7feb4f4cb000-7feb4f4cc000 r--p 0007f000 fc:01 792204 /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2 7feb4f4cc000-7feb4f4cd000 rw-p 00080000 fc:01 792204 /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2 7feb4f4cd000-7feb4f54a000 r-xp 00000000 fc:01 801035 /usr/lib/x86_64-linux-gnu/libmpfr.so.6.0.1 7feb4f54a000-7feb4f74a000 ---p 0007d000 fc:01 801035 /usr/lib/x86_64-linux-gnu/libmpfr.so.6.0.1 7feb4f74a000-7feb4f74c000 r--p 0007d000 fc:01 801035 /usr/lib/x86_64-linux-gnu/libmpfr.so.6.0.1 7feb4f74c000-7feb4f74d000 rw-p 0007f000 fc:01 801035 /usr/lib/x86_64-linux-gnu/libmpfr.so.6.0.1 7feb4f74d000-7feb4f78e000 r-xp 00000000 fc:01 262728 /lib/x86_64-linux-gnu/libreadline.so.7.0 7feb4f78e000-7feb4f98d000 ---p 00041000 fc:01 262728 /lib/x86_64-linux-gnu/libreadline.so.7.0 7feb4f98d000-7feb4f98f000 r--p 00040000 fc:01 262728 /lib/x86_64-linux-gnu/libreadline.so.7.0 7feb4f98f000-7feb4f995000 rw-p 00042000 fc:01 262728 /lib/x86_64-linux-gnu/libreadline.so.7.0 7feb4f995000-7feb4f996000 rw-p 00000000 00:00 0 7feb4f996000-7feb4f999000 r-xp 00000000 fc:01 804515 /usr/lib/x86_64-linux-gnu/libsigsegv.so.2.0.5 7feb4f999000-7feb4fb98000 ---p 00003000 fc:01 804515 /usr/lib/x86_64-linux-gnu/libsigsegv.so.2.0.5 7feb4fb98000-7feb4fb99000 r--p 00002000 fc:01 804515 /usr/lib/x86_64-linux-gnu/libsigsegv.so.2.0.5
"" "" "ps --no-header -p 3 o pid"
3⤵
PID:998

/bin/ps
ps --no-header -p 3 o pid
4⤵
PID:999

/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache
"" "" "ps --no-header -p 4 o pid"
3⤵
PID:1000

/bin/ps
ps --no-header -p 4 o pid
4⤵
PID:1001

"" "" "ps --no-header -p 5 o pid"
3⤵
PID:1002

/bin/ps
ps --no-header -p 5 o pid
4⤵
- Reads runtime system information
PID:1003

"" "" "ps --no-header -p 6 o pid"
3⤵
PID:1004

/bin/ps
ps --no-header -p 6 o pid
4⤵
- Reads CPU attributes
PID:1005

"" "" "ps --no-header -p 7 o pid"
3⤵
PID:1006

/bin/ps
ps --no-header -p 7 o pid
4⤵
PID:1007

"" "" "ps --no-header -p 8 o pid"
3⤵
PID:1008

/bin/ps
ps --no-header -p 8 o pid
4⤵
PID:1009

"" "" "ps --no-header -p 9 o pid"
3⤵
PID:1010

/bin/ps
ps --no-header -p 9 o pid
4⤵
PID:1011

"" "" "ps --no-header -p 10 o pid"
3⤵
PID:1012

/bin/ps
ps --no-header -p 10 o pid
4⤵
PID:1013

"" "" "ps --no-header -p 11 o pid"
3⤵
PID:1014

/bin/ps
ps --no-header -p 11 o pid
4⤵
PID:1015

"" "" "ps --no-header -p 12 o pid"
3⤵
PID:1016

/bin/ps
ps --no-header -p 12 o pid
4⤵
PID:1017

"" "" "ps --no-header -p 13 o pid"
3⤵
PID:1018

/bin/ps
ps --no-header -p 13 o pid
4⤵
PID:1019

"" "" "ps --no-header -p 14 o pid"
3⤵
PID:1020

/bin/ps
ps --no-header -p 14 o pid
4⤵
PID:1021

"" "" "ps --no-header -p 15 o pid"
3⤵
PID:1022

/bin/ps
ps --no-header -p 15 o pid
4⤵
PID:1023

"" "" "ps --no-header -p 16 o pid"
3⤵
PID:1024

/bin/ps
ps --no-header -p 16 o pid
4⤵
PID:1025

"" "" "ps --no-header -p 17 o pid"
3⤵
PID:1026

/bin/ps
ps --no-header -p 17 o pid
4⤵
PID:1027

"" "" "ps --no-header -p 18 o pid"
3⤵
PID:1028

/bin/ps
ps --no-header -p 18 o pid
4⤵
PID:1029

"" "" "ps --no-header -p 19 o pid"
3⤵
PID:1030

/bin/ps
ps --no-header -p 19 o pid
4⤵
PID:1031

"" "" "ps --no-header -p 20 o pid"
3⤵
PID:1032

/bin/ps
ps --no-header -p 20 o pid
4⤵
PID:1033

"" "" "ps --no-header -p 21 o pid"
3⤵
PID:1034

/bin/ps
ps --no-header -p 21 o pid
4⤵
PID:1035

"" "" "ps --no-header -p 22 o pid"
3⤵
PID:1036

/bin/ps
ps --no-header -p 22 o pid
4⤵
- Reads runtime system information
PID:1037

"" "" "ps --no-header -p 23 o pid"
3⤵
PID:1038

/bin/ps
ps --no-header -p 23 o pid
4⤵
PID:1039

"" "" "ps --no-header -p 24 o pid"
3⤵
PID:1040

/bin/ps
ps --no-header -p 24 o pid
4⤵
PID:1041

"" "" "ps --no-header -p 25 o pid"
3⤵
PID:1042

/bin/ps
ps --no-header -p 25 o pid
4⤵
- Reads runtime system information
PID:1043

"" "" "ps --no-header -p 26 o pid"
3⤵
PID:1044

/bin/ps
ps --no-header -p 26 o pid
4⤵
- Reads CPU attributes
PID:1045

"" "" "ps --no-header -p 27 o pid"
3⤵
PID:1046

/bin/ps
ps --no-header -p 27 o pid
4⤵
- Reads CPU attributes
PID:1047

"" "" "ps --no-header -p 28 o pid"
3⤵
PID:1048

/bin/ps
ps --no-header -p 28 o pid
4⤵
PID:1049

"" "" "ps --no-header -p 29 o pid"
3⤵
PID:1050

/bin/ps
ps --no-header -p 29 o pid
4⤵
- Reads runtime system information
PID:1051

"" "" "ps --no-header -p 30 o pid"
3⤵
PID:1052

/bin/ps
ps --no-header -p 30 o pid
4⤵
PID:1053

"" "" "ps --no-header -p 31 o pid"
3⤵
PID:1054

/bin/ps
ps --no-header -p 31 o pid
4⤵
- Reads runtime system information
PID:1055

"" "" "ps --no-header -p 32 o pid"
3⤵
PID:1056

/bin/ps
ps --no-header -p 32 o pid
4⤵
PID:1057

"" "" "ps --no-header -p 33 o pid"
3⤵
PID:1058

/bin/ps
ps --no-header -p 33 o pid
4⤵
PID:1059

"" "" "ps --no-header -p 34 o pid"
3⤵
PID:1060

/bin/ps
ps --no-header -p 34 o pid
4⤵
PID:1061

"" "" "ps --no-header -p 35 o pid"
3⤵
PID:1062

/bin/ps
ps --no-header -p 35 o pid
4⤵
PID:1063

"" "" "ps --no-header -p 77 o pid"
3⤵
PID:1064

/bin/ps
ps --no-header -p 77 o pid
4⤵
PID:1065

"" "" "ps --no-header -p 78 o pid"
3⤵
PID:1066

/bin/ps
ps --no-header -p 78 o pid
4⤵
PID:1067

"" "" "ps --no-header -p 79 o pid"
3⤵
PID:1068

/bin/ps
ps --no-header -p 79 o pid
4⤵
PID:1069

"" "" "ps --no-header -p 80 o pid"
3⤵
PID:1070

/bin/ps
ps --no-header -p 80 o pid
4⤵
PID:1071

"" "" "ps --no-header -p 81 o pid"
3⤵
PID:1072

/bin/ps
ps --no-header -p 81 o pid
4⤵
PID:1073

"" "" "ps --no-header -p 82 o pid"
3⤵
PID:1074

/bin/ps
ps --no-header -p 82 o pid
4⤵
PID:1075

"" "" "ps --no-header -p 83 o pid"
3⤵
PID:1076

/bin/ps
ps --no-header -p 83 o pid
4⤵
PID:1077

"" "" "ps --no-header -p 84 o pid"
3⤵
PID:1078

/bin/ps
ps --no-header -p 84 o pid
4⤵
PID:1079

"" "" "ps --no-header -p 88 o pid"
3⤵
PID:1080

/bin/ps
ps --no-header -p 88 o pid
4⤵
- Reads CPU attributes
PID:1081

"" "" "ps --no-header -p 97 o pid"
3⤵
PID:1082

/bin/ps
ps --no-header -p 97 o pid
4⤵
PID:1083

"" "" "ps --no-header -p 114 o pid"
3⤵
PID:1084

/bin/ps
ps --no-header -p 114 o pid
4⤵
PID:1085

"" "" "ps --no-header -p 151 o pid"
3⤵
PID:1086

/bin/ps
ps --no-header -p 151 o pid
4⤵
PID:1087

"" "" "ps --no-header -p 152 o pid"
3⤵
PID:1088

/bin/ps
ps --no-header -p 152 o pid
4⤵
- Reads runtime system information
PID:1089

"" "" "ps --no-header -p 153 o pid"
3⤵
PID:1090

/bin/ps
ps --no-header -p 153 o pid
4⤵
- Reads runtime system information
PID:1091

"" "" "ps --no-header -p 154 o pid"
3⤵
PID:1092

/bin/ps
ps --no-header -p 154 o pid
4⤵
PID:1093

"" "" "ps --no-header -p 155 o pid"
3⤵
PID:1094

/bin/ps
ps --no-header -p 155 o pid
4⤵
- Reads runtime system information
PID:1095

"" "" "ps --no-header -p 156 o pid"
3⤵
PID:1096

/bin/ps
ps --no-header -p 156 o pid
4⤵
- Reads runtime system information
PID:1097

"" "" "ps --no-header -p 157 o pid"
3⤵
PID:1098

/bin/ps
ps --no-header -p 157 o pid
4⤵
PID:1099

"" "" "ps --no-header -p 158 o pid"
3⤵
PID:1100

/bin/ps
ps --no-header -p 158 o pid
4⤵
- Reads CPU attributes
PID:1101

"" "" "ps --no-header -p 159 o pid"
3⤵
PID:1102

/bin/ps
ps --no-header -p 159 o pid
4⤵
- Reads CPU attributes
PID:1103

"" "" "ps --no-header -p 160 o pid"
3⤵
PID:1104

/bin/ps
ps --no-header -p 160 o pid
4⤵
PID:1105

"" "" "ps --no-header -p 161 o pid"
3⤵
PID:1106

/bin/ps
ps --no-header -p 161 o pid
4⤵
PID:1107

"" "" "ps --no-header -p 162 o pid"
3⤵
PID:1108

/bin/ps
ps --no-header -p 162 o pid
4⤵
PID:1109

"" "" "ps --no-header -p 163 o pid"
3⤵
PID:1110

/bin/ps
ps --no-header -p 163 o pid
4⤵
PID:1111

"" "" "ps --no-header -p 164 o pid"
3⤵
PID:1112

/bin/ps
ps --no-header -p 164 o pid
4⤵
- Reads CPU attributes
PID:1113

"" "" "ps --no-header -p 165 o pid"
3⤵
PID:1114

/bin/ps
ps --no-header -p 165 o pid
4⤵
PID:1115

"" "" "ps --no-header -p 166 o pid"
3⤵
PID:1116

/bin/ps
ps --no-header -p 166 o pid
4⤵
- Reads CPU attributes
PID:1117

"" "" "ps --no-header -p 167 o pid"
3⤵
PID:1118

/bin/ps
ps --no-header -p 167 o pid
4⤵
PID:1119

"" "" "ps --no-header -p 169 o pid"
3⤵
PID:1120

/bin/ps
ps --no-header -p 169 o pid
4⤵
PID:1121

"" "" "ps --no-header -p 190 o pid"
3⤵
PID:1122

/bin/ps
ps --no-header -p 190 o pid
4⤵
- Reads CPU attributes
PID:1123

"" "" "ps --no-header -p 191 o pid"
3⤵
PID:1124

/bin/ps
ps --no-header -p 191 o pid
4⤵
PID:1125

"" "" "ps --no-header -p 237 o pid"
3⤵
PID:1126

/bin/ps
ps --no-header -p 237 o pid
4⤵
PID:1127

"" "" "ps --no-header -p 249 o pid"
3⤵
PID:1128

/bin/ps
ps --no-header -p 249 o pid
4⤵
PID:1129

"" "" "ps --no-header -p 250 o pid"
3⤵
PID:1130

/bin/ps
ps --no-header -p 250 o pid
4⤵
PID:1131

"" "" "ps --no-header -p 300 o pid"
3⤵
PID:1132

/bin/ps
ps --no-header -p 300 o pid
4⤵
- Reads runtime system information
PID:1133

"" "" "ps --no-header -p 302 o pid"
3⤵
PID:1134

/bin/ps
ps --no-header -p 302 o pid
4⤵
PID:1135

"" "" "ps --no-header -p 338 o pid"
3⤵
PID:1136

/bin/ps
ps --no-header -p 338 o pid
4⤵
PID:1137

"" "" ""
3⤵
PID:1138

/bin/ps
ps --no-header -eL o lwp
4⤵
- Reads CPU attributes
PID:1139

"" "" "ps --no-header -p 343 o pid"
3⤵
PID:1140

/bin/ps
ps --no-header -p 343 o pid
4⤵
- Reads runtime system information
PID:1141

"" "" "ps --no-header -p 344 o pid"
3⤵
PID:1142

/bin/ps
ps --no-header -p 344 o pid
4⤵
PID:1143

"" "" "ps --no-header -p 345 o pid"
3⤵
PID:1144

/bin/ps
ps --no-header -p 345 o pid
4⤵
PID:1145

"" "" "ps --no-header -p 346 o pid"
3⤵
PID:1146

/bin/ps
ps --no-header -p 346 o pid
4⤵
PID:1147

"" "" ""
3⤵
PID:1148

/bin/ps
ps --no-header -eL o lwp
4⤵
PID:1149

"" "" "ps --no-header -p 347 o pid"
3⤵
PID:1150

/bin/ps
ps --no-header -p 347 o pid
4⤵
PID:1151

"" "" ""
3⤵
PID:1152

/bin/ps
ps --no-header -eL o lwp
4⤵
PID:1153

"" "" "ps --no-header -p 348 o pid"
3⤵
PID:1154

/bin/ps
ps --no-header -p 348 o pid
4⤵
PID:1155

"" "" ""
3⤵
PID:1156

/bin/ps
ps --no-header -eL o lwp
4⤵
PID:1157

"" "" "ps --no-header -p 349 o pid"
3⤵
PID:1158

/bin/ps
ps --no-header -p 349 o pid
4⤵
PID:1159

"" "" "ps --no-header -p 352 o pid"
3⤵
PID:1160

/bin/ps
ps --no-header -p 352 o pid
4⤵
PID:1161

"" "" "ps --no-header -p 357 o pid"
3⤵
PID:1162

/bin/ps
ps --no-header -p 357 o pid
4⤵
PID:1163

"" "" ""
3⤵
PID:1164

/bin/ps
ps --no-header -eL o lwp
4⤵
PID:1165

"" "" "ps --no-header -p 358 o pid"
3⤵
PID:1166

/bin/ps
ps --no-header -p 358 o pid
4⤵
PID:1167

"" "" ""
3⤵
PID:1168

/bin/ps
ps --no-header -eL o lwp
4⤵
PID:1169

"" "" "ps --no-header -p 359 o pid"
3⤵
PID:1170

/bin/ps
ps --no-header -p 359 o pid
4⤵
PID:1171

"" "" "ps --no-header -p 360 o pid"
3⤵
PID:1172

/bin/ps
ps --no-header -p 360 o pid
4⤵
PID:1173

"" "" ""
3⤵
PID:1174

/bin/ps
ps --no-header -eL o lwp
4⤵
- Reads runtime system information
PID:1175

"" "" "ps --no-header -p 369 o pid"
3⤵
PID:1176

/bin/ps
ps --no-header -p 369 o pid
4⤵
PID:1177

"" "" "ps --no-header -p 370 o pid"
3⤵
PID:1178

/bin/ps
ps --no-header -p 370 o pid
4⤵
- Reads runtime system information
PID:1179

"" "" "ps --no-header -p 382 o pid"
3⤵
PID:1180

/bin/ps
ps --no-header -p 382 o pid
4⤵
PID:1181

"" "" ""
3⤵
PID:1182

/bin/ps
ps --no-header -eL o lwp
4⤵
PID:1183

"" "" "ps --no-header -p 387 o pid"
3⤵
PID:1184

/bin/ps
ps --no-header -p 387 o pid
4⤵
PID:1185

"" "" "ps --no-header -p 416 o pid"
3⤵
PID:1186

/bin/ps
ps --no-header -p 416 o pid
4⤵
PID:1187

"" "" "ps --no-header -p 443 o pid"
3⤵
PID:1188

/bin/ps
ps --no-header -p 443 o pid
4⤵
PID:1189

"" "" "ps --no-header -p 447 o pid"
3⤵
PID:1190

/bin/ps
ps --no-header -p 447 o pid
4⤵
PID:1191

"" "" "ps --no-header -p 477 o pid"
3⤵
PID:1192

/bin/ps
ps --no-header -p 477 o pid
4⤵
PID:1193

"" "" "ps --no-header -p 479 o pid"
3⤵
PID:1194

/bin/ps
ps --no-header -p 479 o pid
4⤵
PID:1195

"" "" "ps --no-header -p 546 o pid"
3⤵
PID:1196

/bin/ps
ps --no-header -p 546 o pid
4⤵
PID:1197

"" "" "ps --no-header -p 561 o pid"
3⤵
PID:1198

/bin/ps
ps --no-header -p 561 o pid
4⤵
PID:1199

"" "" "ps --no-header -p 562 o pid"
3⤵
PID:1200

/bin/ps
ps --no-header -p 562 o pid
4⤵
PID:1201

"" "" "ps --no-header -p 580 o pid"
3⤵
PID:1202

/bin/ps
ps --no-header -p 580 o pid
4⤵
- Reads runtime system information
PID:1203

"" "" "ps --no-header -p 581 o pid"
3⤵
PID:1204

/bin/ps
ps --no-header -p 581 o pid
4⤵
PID:1205

"" "" ""
3⤵
PID:1206

/bin/ps
ps --no-header -eL o lwp
4⤵
- Reads CPU attributes
- Reads runtime system information
PID:1207

"" "" "ps --no-header -p 582 o pid"
3⤵
PID:1208

/bin/ps
ps --no-header -p 582 o pid
4⤵
PID:1209

"" "" ""
3⤵
PID:1210

/bin/ps
ps --no-header -eL o lwp
4⤵
- Reads CPU attributes
PID:1211

"" "" "ps --no-header -p 583 o pid"
3⤵
PID:1212

/bin/ps
ps --no-header -p 583 o pid
4⤵
PID:1213

"" "" ""
3⤵
PID:1214

/bin/ps
ps --no-header -eL o lwp
4⤵
PID:1215

"" "" "ps --no-header -p 584 o pid"
3⤵
PID:1216

/bin/ps
ps --no-header -p 584 o pid
4⤵
PID:1217

"" "" ""
3⤵
PID:1218

/bin/ps
ps --no-header -eL o lwp
4⤵
- Reads CPU attributes
- Reads runtime system information
PID:1219

"" "" "ps --no-header -p 991 o pid"
3⤵
PID:1220

/bin/ps
ps --no-header -p 991 o pid
4⤵
PID:1221

"" "" "ps --no-header -p 992 o pid"
3⤵
PID:1222

/bin/ps
ps --no-header -p 992 o pid
4⤵
PID:1223

"" "" "ps --no-header -p 993 o pid"
3⤵
PID:1224

/bin/ps
ps --no-header -p 993 o pid
4⤵
PID:1225

/bin/sleep
sleep 1
2⤵
PID:1226

/usr/bin/chattr
chattr -i /usr/bin/ip6network
2⤵
PID:1228

/usr/bin/chattr
chattr -i /usr/bin/kswaped
2⤵
PID:1229

/usr/bin/chattr
chattr -i /usr/bin/irqbalanced
2⤵
PID:1230

/usr/bin/chattr
chattr -i /usr/bin/rctlcli
2⤵
PID:1231

/usr/bin/chattr
chattr -i /usr/bin/systemd-network
2⤵
PID:1232

/usr/bin/chattr
chattr -i /usr/bin/pamdicks
2⤵
PID:1233

/usr/bin/chattr
chattr +i /usr/bin/ip6network
2⤵
- Write file to user bin folder
PID:1234

/usr/bin/chattr
chattr +i /usr/bin/kswaped
2⤵
- Write file to user bin folder
PID:1235

/usr/bin/chattr
chattr +i /usr/bin/irqbalanced
2⤵
- Write file to user bin folder
PID:1236

/usr/bin/chattr
chattr +i /usr/bin/rctlcli
2⤵
- Write file to user bin folder
PID:1237

/usr/bin/chattr
chattr +i /usr/bin/systemd-network
2⤵
- Write file to user bin folder
PID:1238

/usr/bin/chattr
chattr +i /usr/bin/pamdicks
2⤵
- Write file to user bin folder
PID:1239

/bin/mv
mv /usr/bin/t /usr/bin/chattr
2⤵
PID:1241

/bin/sleep
sleep 1
2⤵
PID:1242

/bin/rm
rm -f /tmp/.null
2⤵
PID:1245

/sbin/sysctl
sysctl -w "vm.nr_hugepages=128"
2⤵
PID:1246

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1251

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1250

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1249

/bin/grep
grep 185.71.65.238
2⤵
PID:1248

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1256

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1255

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1254

/bin/grep
grep 140.82.52.87
2⤵
PID:1253

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1262

/bin/grep
grep -v -
2⤵
PID:1261

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1260

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1259

/bin/grep
grep :443
2⤵
PID:1258

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1268

/bin/grep
grep -v -
2⤵
PID:1267

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1266

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1265

/bin/grep
grep :23
2⤵
PID:1264

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1274

/bin/grep
grep -v -
2⤵
PID:1273

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1272

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1271

/bin/grep
grep :443
2⤵
PID:1270

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1280

/bin/grep
grep -v -
2⤵
PID:1279

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1278

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1277

/bin/grep
grep :143
2⤵
PID:1276

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1286

/bin/grep
grep -v -
2⤵
PID:1285

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1284

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1283

/bin/grep
grep :2222
2⤵
PID:1282

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1292

/bin/grep
grep -v -
2⤵
PID:1291

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1290

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1289

/bin/grep
grep :3333
2⤵
PID:1288

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1298

/bin/grep
grep -v -
2⤵
PID:1297

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1296

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1295

/bin/grep
grep :3389
2⤵
PID:1294

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1304

/bin/grep
grep -v -
2⤵
PID:1303

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1302

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1301

/bin/grep
grep :4444
2⤵
PID:1300

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1310

/bin/grep
grep -v -
2⤵
PID:1309

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1308

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1307

/bin/grep
grep :5555
2⤵
PID:1306

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1316

/bin/grep
grep -v -
2⤵
PID:1315

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1314

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1313

/bin/grep
grep :6666
2⤵
PID:1312

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1322

/bin/grep
grep -v -
2⤵
PID:1321

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1320

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1319

/bin/grep
grep :6665
2⤵
PID:1318

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1328

/bin/grep
grep -v -
2⤵
PID:1327

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1326

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1325

/bin/grep
grep :6667
2⤵
PID:1324

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1334

/bin/grep
grep -v -
2⤵
PID:1333

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1332

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1331

/bin/grep
grep :7777
2⤵
PID:1330

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1340

/bin/grep
grep -v -
2⤵
PID:1339

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1338

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1337

/bin/grep
grep :8444
2⤵
PID:1336

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1346

/bin/grep
grep -v -
2⤵
PID:1345

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1344

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1343

/bin/grep
grep :3347
2⤵
PID:1342

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1352

/bin/grep
grep -v -
2⤵
PID:1351

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:1350

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:1349

/bin/grep
grep :14433
2⤵
PID:1348

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1357

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1356

/bin/grep
grep :3333
2⤵
PID:1355

/bin/grep
grep -v grep
2⤵
PID:1354

/bin/ps
ps aux
2⤵
PID:1353

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1362

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1361

/bin/grep
grep :5555
2⤵
PID:1360

/bin/grep
grep -v grep
2⤵
PID:1359

/bin/ps
ps aux
2⤵
- Reads runtime system information
PID:1358

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1367

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1366

/bin/grep
grep "kworker -c\\"
2⤵
PID:1365

/bin/grep
grep -v grep
2⤵
PID:1364

/bin/ps
ps aux
2⤵
PID:1363

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1372

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1371

/bin/grep
grep log_
2⤵
PID:1370

/bin/grep
grep -v grep
2⤵
PID:1369

/bin/ps
ps aux
2⤵
PID:1368

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1377

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1376

/bin/grep
grep systemten
2⤵
PID:1375

/bin/grep
grep -v grep
2⤵
PID:1374

/bin/ps
ps aux
2⤵
- Reads runtime system information
PID:1373

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1382

/usr/local/sbin/kill
kill -9 14
3⤵
PID:1383

/usr/local/bin/kill
kill -9 14
3⤵
PID:1383

/usr/sbin/kill
kill -9 14
3⤵
PID:1383

/usr/bin/kill
kill -9 14
3⤵
PID:1383

/sbin/kill
kill -9 14
3⤵
PID:1383

/bin/kill
kill -9 14
3⤵
PID:1383

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1381

/bin/grep
grep netns
2⤵
PID:1380

/bin/grep
grep -v grep
2⤵
PID:1379

/bin/ps
ps aux
2⤵
PID:1378

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1388

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1387

/bin/grep
grep voltuned
2⤵
PID:1386

/bin/grep
grep -v grep
2⤵
PID:1385

/bin/ps
ps aux
2⤵
- Reads CPU attributes
PID:1384

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1393

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1392

/bin/grep
grep darwin
2⤵
PID:1391

/bin/grep
grep -v grep
2⤵
PID:1390

/bin/ps
ps aux
2⤵
- Reads runtime system information
PID:1389

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1398

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1397

/bin/grep
grep /tmp/dl
2⤵
PID:1396

/bin/grep
grep -v grep
2⤵
PID:1395

/bin/ps
ps aux
2⤵
PID:1394

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1403

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1402

/bin/grep
grep /tmp/ddg
2⤵
PID:1401

/bin/grep
grep -v grep
2⤵
PID:1400

/bin/ps
ps aux
2⤵
PID:1399

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1408

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1407

/bin/grep
grep /tmp/pprt
2⤵
PID:1406

/bin/grep
grep -v grep
2⤵
PID:1405

/bin/ps
ps aux
2⤵
PID:1404

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1413

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1412

/bin/grep
grep /tmp/ppol
2⤵
PID:1411

/bin/grep
grep -v grep
2⤵
PID:1410

/bin/ps
ps aux
2⤵
PID:1409

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1418

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1417

/bin/grep
grep "/tmp/65ccE*"
2⤵
PID:1416

/bin/grep
grep -v grep
2⤵
PID:1415

/bin/ps
ps aux
2⤵
PID:1414

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1423

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1422

/bin/grep
grep "/tmp/jmx*"
2⤵
PID:1421

/bin/grep
grep -v grep
2⤵
PID:1420

/bin/ps
ps aux
2⤵
PID:1419

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1428

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1427

/bin/grep
grep "/tmp/2Ne80*"
2⤵
PID:1426

/bin/grep
grep -v grep
2⤵
PID:1425

/bin/ps
ps aux
2⤵
PID:1424

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1433

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1432

/bin/grep
grep IOFoqIgyC0zmf2UR
2⤵
PID:1431

/bin/grep
grep -v grep
2⤵
PID:1430

/bin/ps
ps aux
2⤵
PID:1429

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1438

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1437

/bin/grep
grep 45.76.122.92
2⤵
PID:1436

/bin/grep
grep -v grep
2⤵
PID:1435

/bin/ps
ps aux
2⤵
PID:1434

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1443

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1442

/bin/grep
grep 51.38.191.178
2⤵
PID:1441

/bin/grep
grep -v grep
2⤵
PID:1440

/bin/ps
ps aux
2⤵
PID:1439

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1448

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1447

/bin/grep
grep 51.15.56.161
2⤵
PID:1446

/bin/grep
grep -v grep
2⤵
PID:1445

/bin/ps
ps aux
2⤵
PID:1444

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1453

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1452

/bin/grep
grep 86s.jpg
2⤵
PID:1451

/bin/grep
grep -v grep
2⤵
PID:1450

/bin/ps
ps aux
2⤵
PID:1449

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1458

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1457

/bin/grep
grep aGTSGJJp
2⤵
PID:1456

/bin/grep
grep -v grep
2⤵
PID:1455

/bin/ps
ps aux
2⤵
PID:1454

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1463

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1462

/bin/grep
grep nMrfmnRa
2⤵
PID:1461

/bin/grep
grep -v grep
2⤵
PID:1460

/bin/ps
ps aux
2⤵
PID:1459

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1468

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1467

/bin/grep
grep PuNY5tm2
2⤵
PID:1466

/bin/grep
grep -v grep
2⤵
PID:1465

/bin/ps
ps aux
2⤵
PID:1464

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1473

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1472

/bin/grep
grep I0r8Jyyt
2⤵
PID:1471

/bin/grep
grep -v grep
2⤵
PID:1470

/bin/ps
ps aux
2⤵
PID:1469

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1478

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1477

/bin/grep
grep AgdgACUD
2⤵
PID:1476

/bin/grep
grep -v grep
2⤵
PID:1475

/bin/ps
ps aux
2⤵
- Reads runtime system information
PID:1474

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1483

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1482

/bin/grep
grep uiZvwxG8
2⤵
PID:1481

/bin/grep
grep -v grep
2⤵
PID:1480

/bin/ps
ps aux
2⤵
PID:1479

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1488

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1487

/bin/grep
grep hahwNEdB
2⤵
PID:1486

/bin/grep
grep -v grep
2⤵
PID:1485

/bin/ps
ps aux
2⤵
PID:1484

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1493

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1492

/bin/grep
grep BtwXn5qH
2⤵
PID:1491

/bin/grep
grep -v grep
2⤵
PID:1490

/bin/ps
ps aux
2⤵
PID:1489

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1498

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1497

/bin/grep
grep 3XEzey2T
2⤵
PID:1496

/bin/grep
grep -v grep
2⤵
PID:1495

/bin/ps
ps aux
2⤵
PID:1494

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1503

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1502

/bin/grep
grep t2tKrCSZ
2⤵
PID:1501

/bin/grep
grep -v grep
2⤵
PID:1500

/bin/ps
ps aux
2⤵
PID:1499

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1508

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1507

/bin/grep
grep HD7fcBgg
2⤵
PID:1506

/bin/grep
grep -v grep
2⤵
PID:1505

/bin/ps
ps aux
2⤵
PID:1504

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1513

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1512

/bin/grep
grep zXcDajSs
2⤵
PID:1511

/bin/grep
grep -v grep
2⤵
PID:1510

/bin/ps
ps aux
2⤵
- Reads CPU attributes
PID:1509

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1518

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1517

/bin/grep
grep 3lmigMo
2⤵
PID:1516

/bin/grep
grep -v grep
2⤵
PID:1515

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1514

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1523

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1522

/bin/grep
grep AkMK4A2
2⤵
PID:1521

/bin/grep
grep -v grep
2⤵
PID:1520

/bin/ps
ps aux
2⤵
- Reads CPU attributes
PID:1519

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1528

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1527

/bin/grep
grep AJ2AkKe
2⤵
PID:1526

/bin/grep
grep -v grep
2⤵
PID:1525

/bin/ps
ps aux
2⤵
PID:1524

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1533

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1532

/bin/grep
grep HiPxCJRS
2⤵
PID:1531

/bin/grep
grep -v grep
2⤵
PID:1530

/bin/ps
ps aux
2⤵
PID:1529

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1538

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1537

/bin/grep
grep http_0xCC030
2⤵
PID:1536

/bin/grep
grep -v grep
2⤵
PID:1535

/bin/ps
ps aux
2⤵
PID:1534

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1543

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1542

/bin/grep
grep http_0xCC031
2⤵
PID:1541

/bin/grep
grep -v grep
2⤵
PID:1540

/bin/ps
ps aux
2⤵
PID:1539

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1548

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1547

/bin/grep
grep http_0xCC032
2⤵
PID:1546

/bin/grep
grep -v grep
2⤵
PID:1545

/bin/ps
ps aux
2⤵
PID:1544

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1553

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1552

/bin/grep
grep http_0xCC033
2⤵
PID:1551

/bin/grep
grep -v grep
2⤵
PID:1550

/bin/ps
ps aux
2⤵
PID:1549

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1558

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1557

/bin/grep
grep C4iLM4L
2⤵
PID:1556

/bin/grep
grep -v grep
2⤵
PID:1555

/bin/ps
ps aux
2⤵
- Reads CPU attributes
PID:1554

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1563

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1562

/bin/grep
grep aziplcr72qjhzvin
2⤵
PID:1561

/bin/grep
grep -v grep
2⤵
PID:1560

/bin/ps
ps aux
2⤵
PID:1559

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1567

/usr/bin/awk
awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
2⤵
PID:1566

/bin/grep
grep -v grep
2⤵
PID:1565

/bin/ps
ps aux
2⤵
PID:1564

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1572

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1571

/bin/grep
grep /boot/vmlinuz
2⤵
PID:1570

/bin/grep
grep -v grep
2⤵
PID:1569

/bin/ps
ps aux
2⤵
PID:1568

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1577

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1576

/bin/grep
grep i4b503a52cc5
2⤵
PID:1575

/bin/grep
grep -v grep
2⤵
PID:1574

/bin/ps
ps aux
2⤵
PID:1573

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1582

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1581

/bin/grep
grep dgqtrcst23rtdi3ldqk322j2
2⤵
PID:1580

/bin/grep
grep -v grep
2⤵
PID:1579

/bin/ps
ps aux
2⤵
PID:1578

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1587

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1586

/bin/grep
grep 2g0uv7npuhrlatd
2⤵
PID:1585

/bin/grep
grep -v grep
2⤵
PID:1584

/bin/ps
ps aux
2⤵
PID:1583

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1592

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1591

/bin/grep
grep nqscheduler
2⤵
PID:1590

/bin/grep
grep -v grep
2⤵
PID:1589

/bin/ps
ps aux
2⤵
- Reads CPU attributes
PID:1588

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1597

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1596

/bin/grep
grep rkebbwgqpl4npmm
2⤵
PID:1595

/bin/grep
grep -v grep
2⤵
PID:1594

/bin/ps
ps aux
2⤵
PID:1593

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1603

/usr/bin/awk
awk "\$3>10.0{print \$2}"
2⤵
PID:1602

/bin/grep
grep "]"
2⤵
PID:1601

/bin/grep
grep -v aux
2⤵
PID:1600

/bin/grep
grep -v grep
2⤵
PID:1599

/bin/ps
ps aux
2⤵
PID:1598

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1608

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1607

/bin/grep
grep 2fhtu70teuhtoh78jc5s
2⤵
PID:1606

/bin/grep
grep -v grep
2⤵
PID:1605

/bin/ps
ps aux
2⤵
PID:1604

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1613

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1612

/bin/grep
grep 0kwti6ut420t
2⤵
PID:1611

/bin/grep
grep -v grep
2⤵
PID:1610

/bin/ps
ps aux
2⤵
PID:1609

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1618

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1617

/bin/grep
grep 44ct7udt0patws3agkdfqnjm
2⤵
PID:1616

/bin/grep
grep -v grep
2⤵
PID:1615

/bin/ps
ps aux
2⤵
PID:1614

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1625

/usr/bin/awk
awk "length(\$11)>19{print \$2}"
2⤵
PID:1624

/bin/grep
grep -v _
2⤵
PID:1623

/bin/grep
grep -v -
2⤵
PID:1622

/bin/grep
grep -v /
2⤵
PID:1621

/bin/grep
grep -v grep
2⤵
PID:1620

/bin/ps
ps aux
2⤵
PID:1619

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1630

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1629

/bin/grep
grep "\\[^"
2⤵
PID:1628

/bin/grep
grep -v grep
2⤵
PID:1627

/bin/ps
ps aux
2⤵
PID:1626

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1635

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1634

/bin/grep
grep rsync
2⤵
PID:1633

/bin/grep
grep -v grep
2⤵
PID:1632

/bin/ps
ps aux
2⤵
PID:1631

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1640

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1639

/bin/grep
grep watchd0g
2⤵
PID:1638

/bin/grep
grep -v grep
2⤵
PID:1637

/bin/ps
ps aux
2⤵
PID:1636

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1645

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1644

/bin/egrep
egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
2⤵
- Writes file to system bin folder
PID:1643

/bin/grep
grep -v grep
2⤵
PID:1642

/usr/local/sbin/grep
grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
2⤵
PID:1643

/usr/local/bin/grep
grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
2⤵
PID:1643

/usr/sbin/grep
grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
2⤵
PID:1643

/usr/bin/grep
grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
2⤵
PID:1643

/sbin/grep
grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
2⤵
PID:1643

/bin/grep
grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
2⤵
PID:1643

/bin/ps
ps aux
2⤵
PID:1641

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1650

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1649

/bin/grep
grep 158.69.133.18:8220
2⤵
PID:1648

/bin/grep
grep -v grep
2⤵
PID:1647

/bin/ps
ps aux
2⤵
PID:1646

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1655

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1654

/bin/grep
grep /tmp/java
2⤵
PID:1653

/bin/grep
grep -v grep
2⤵
PID:1652

/bin/ps
ps aux
2⤵
PID:1651

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1660

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1659

/bin/grep
grep gitee.com
2⤵
PID:1658

/bin/grep
grep -v grep
2⤵
PID:1657

/bin/ps
ps aux
2⤵
- Reads CPU attributes
PID:1656

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1665

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1664

/bin/grep
grep /tmp/java
2⤵
PID:1663

/bin/grep
grep -v grep
2⤵
PID:1662

/bin/ps
ps aux
2⤵
PID:1661

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1670

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1669

/bin/grep
grep 104.248.4.162
2⤵
PID:1668

/bin/grep
grep -v grep
2⤵
PID:1667

/bin/ps
ps aux
2⤵
PID:1666

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1675

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1674

/bin/grep
grep 89.35.39.78
2⤵
PID:1673

/bin/grep
grep -v grep
2⤵
PID:1672

/bin/ps
ps aux
2⤵
PID:1671

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1680

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1679

/bin/grep
grep /dev/shm/z3.sh
2⤵
PID:1678

/bin/grep
grep -v grep
2⤵
PID:1677

/bin/ps
ps aux
2⤵
- Reads runtime system information
PID:1676

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1685

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1684

/bin/grep
grep kthrotlds
2⤵
PID:1683

/bin/grep
grep -v grep
2⤵
PID:1682

/bin/ps
ps aux
2⤵
PID:1681

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1690

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1689

/bin/grep
grep ksoftirqds
2⤵
PID:1688

/bin/grep
grep -v grep
2⤵
PID:1687

/bin/ps
ps aux
2⤵
- Reads runtime system information
PID:1686

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:1695

/usr/bin/awk
awk "{print \$2}"
2⤵
PID:1694

/bin/grep
grep netdns
2⤵
PID:1693

/bin/grep
grep -v grep
2⤵
PID:1692

/sbin/modprobe
/sbin/modprobe ip6_tables
1⤵
- Enumerates kernel/hardware configuration
PID:588

/usr/local/sbin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
PID:777

/usr/local/bin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
PID:777

/usr/sbin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
PID:777

/usr/bin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
- Writes file to tmp directory
PID:777

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
2⤵
PID:778

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
2⤵
PID:779

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
2⤵
PID:780

/usr/local/sbin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
1⤵
PID:824

/usr/local/bin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
1⤵
PID:824

/usr/sbin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
1⤵
PID:824

/usr/bin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/libsigsegv2_2.12-1_amd64.deb "/var/cache/apt/archives/gawk_1%3a4.1.4+dfsg-1build1_amd64.deb"
1⤵
- Writes file to tmp directory
PID:824

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
2⤵
PID:825

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
2⤵
PID:826

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
2⤵
PID:827

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Hijack Execution Flow

Scheduled Task

Boot or Logon Autostart Execution

T1547

Privilege Escalation

Hijack Execution Flow

Scheduled Task

Boot or Logon Autostart Execution

T1547

Defense Evasion

Indicator Removal on Host

T1070

Hijack Execution Flow

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution