Analysis
-
max time kernel
252s -
max time network
193s -
platform
debian-9_mips -
resource
debian9-mipsbe-20231221-en -
resource tags
arch:mipsimage:debian9-mipsbe-20231221-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
14-01-2024 14:47
Static task
static1
Behavioral task
behavioral1
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh
Resource
ubuntu1804-amd64-20231221-en
Behavioral task
behavioral2
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral3
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh
Resource
debian9-mipsbe-20231221-en
Behavioral task
behavioral4
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh
Resource
debian9-mipsel-20231215-en
General
-
Target
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh
-
Size
46KB
-
MD5
f0b071a68f96f23c329aa35145a6d405
-
SHA1
e80968b1833d4968da34d30ff49974bb69035535
-
SHA256
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a
-
SHA512
550093803f4931a1cd2d9c4f0e20dbfe4fcfd1170f04fcd0b76af9d508db18baa3131589c3caaf601509946a525ab731bdf00618fd03017056625d95969477d3
-
SSDEEP
768:bxlT2wDuWvWi7vFNcuFkc2zq0x3UKnicZuiR/amT8p:86F+Lc2/FicfSmT8p
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh -
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog rm -
Executes dropped EXE 1 IoCs
ioc pid Process /etc/zzh 2567 Process not Found -
Flushes firewall rules 6 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 740 iptables 2575 Process not Found 2576 Process not Found 2577 Process not Found 2579 Process not Found 2581 Process not Found -
resource yara_rule behavioral3/files/fstream-27.dat upx behavioral3/files/fstream-28.dat upx -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 1152 xargs 1282 xargs 1317 xargs 1849 Process not Found 1883 Process not Found 925 xargs 1024 xargs 1563 xargs 1222 xargs 1616 xargs 1895 Process not Found 781 grep 1513 xargs 1817 Process not Found 1879 Process not Found 2278 Process not Found 1182 xargs 1331 xargs 1502 xargs 1841 Process not Found 1072 xargs 1091 xargs 1807 xargs 1867 Process not Found 1893 Process not Found 2198 Process not Found 2262 Process not Found 2544 Process not Found 956 xargs 1247 xargs 1302 xargs 1399 xargs 1622 xargs 1857 Process not Found 1863 Process not Found 1897 Process not Found 1907 Process not Found 2234 Process not Found 2323 Process not Found 931 xargs 975 chattr 1706 xargs 1793 xargs 1459 xargs 1875 Process not Found 1136 xargs 1434 xargs 1861 Process not Found 2156 Process not Found 2333 Process not Found 1837 Process not Found 2479 Process not Found 1628 xargs 1652 xargs 1721 xargs 1599 xargs 1726 xargs 1891 Process not Found 2218 Process not Found 1853 Process not Found 1292 xargs 1419 xargs 1681 xargs 1865 Process not Found -
Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.daily/logrotate be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /etc/cron.hourly/0anacron be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /etc/cron.d/zzh be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /etc/crontab be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh -
Deletes log files 1 TTPs 2 IoCs
Deletes log files on the system.
description ioc Process File truncated /var/log/wtmp be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File truncated /var/log/secure be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh -
Disables AppArmor 64 IoCs
Disables AppArmor security module.
pid Process 2184 Process not Found 2299 Process not Found 2145 Process not Found 2174 Process not Found 2298 Process not Found 844 systemctl 2162 Process not Found 809 systemctl 2297 Process not Found 2310 Process not Found 2317 Process not Found 785 systemctl 814 systemctl 2282 Process not Found 2279 Process not Found 2148 Process not Found 2176 Process not Found 809 systemctl 2182 Process not Found 823 systemctl 809 systemctl 2175 Process not Found 2180 Process not Found 2293 Process not Found 2299 Process not Found 2088 Process not Found 2160 Process not Found 839 systemctl 2157 Process not Found 2159 Process not Found 2145 Process not Found 785 systemctl 825 systemctl 827 systemctl 2166 Process not Found 809 systemctl 2279 Process not Found 2302 Process not Found 2312 Process not Found 785 systemctl 2179 Process not Found 2164 Process not Found 2296 Process not Found 2306 Process not Found 829 systemctl 2166 Process not Found 821 systemctl 2178 Process not Found 2299 Process not Found 2318 Process not Found 2163 Process not Found 2177 Process not Found 2171 Process not Found 2166 Process not Found 2291 Process not Found 2292 Process not Found 2295 Process not Found 2155 Process not Found 2161 Process not Found 2154 Process not Found 2145 Process not Found 2287 Process not Found 2304 Process not Found 2313 Process not Found -
Disables SELinux 11 IoCs
Disables SELinux security module.
pid Process 1739 grep 1142 kill 1142 kill 1142 kill 1295 grep 784 setenforce 1142 kill 1142 kill 1142 kill 1407 grep 1719 grep -
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.d/rc.local be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found -
Write file to user bin folder 1 TTPs 6 IoCs
description ioc Process File opened for modification /usr/bin/kswaped be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /usr/bin/irqbalanced be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /usr/bin/rctlcli be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /usr/bin/systemd-network be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /usr/bin/pamdicks be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /usr/bin/ip6network be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh -
Writes file to system bin folder 1 TTPs 6 IoCs
description ioc Process File opened for modification /bin/ps be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /bin/ps Process not Found File opened for modification /bin/top be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /bin/top Process not Found File opened for modification /bin/pstree be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /bin/pstree Process not Found -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/398/cmdline Process not Found File opened for reading /proc/689/status Process not Found File opened for reading /proc/721/cmdline Process not Found File opened for reading /proc/393/cmdline Process not Found File opened for reading /proc/151/cmdline ps File opened for reading /proc/14/status ps File opened for reading /proc/345/stat ps File opened for reading /proc/120/cmdline ps File opened for reading /proc/19/status ps File opened for reading /proc/75/stat ps File opened for reading /proc/13/status Process not Found File opened for reading /proc/717/cmdline Process not Found File opened for reading /proc/76/status Process not Found File opened for reading /proc/1426/stat ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/13/status Process not Found File opened for reading /proc/22/status Process not Found File opened for reading /proc/78/cmdline Process not Found File opened for reading /proc/347/stat ps File opened for reading /proc/14/status ps File opened for reading /proc/filesystems Process not Found File opened for reading /proc/24/stat ps File opened for reading /proc/10/stat ps File opened for reading /proc/353/status Process not Found File opened for reading /proc/17/status Process not Found File opened for reading /proc/17/status Process not Found File opened for reading /proc/1/stat ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/18/stat ps File opened for reading /proc/11/cmdline Process not Found File opened for reading /proc/22/status ps File opened for reading /proc/245/stat ps File opened for reading /proc/76/status ps File opened for reading /proc/345/stat ps File opened for reading /proc/120/cmdline Process not Found File opened for reading /proc/12/cmdline Process not Found File opened for reading /proc/689/cmdline Process not Found File opened for reading /proc/742/status ps File opened for reading /proc/15/status Process not Found File opened for reading /proc/37/cmdline ps File opened for reading /proc/75/cmdline Process not Found File opened for reading /proc/75/status Process not Found File opened for reading /proc/78/cmdline ps File opened for reading /proc/685/stat ps File opened for reading /proc/1506/status ps File opened for reading /proc/8/stat ps File opened for reading /proc/68/status Process not Found File opened for reading /proc/689/cmdline ps File opened for reading /proc/16/cmdline Process not Found File opened for reading /proc/8/cmdline Process not Found File opened for reading /proc/1347/stat ps File opened for reading /proc/6/status Process not Found File opened for reading /proc/10/cmdline Process not Found File opened for reading /proc/353/status Process not Found File opened for reading /proc/7/cmdline ps File opened for reading /proc/83/stat ps File opened for reading /proc/355/cmdline Process not Found File opened for reading /proc/347/status ps File opened for reading /proc/4/status Process not Found File opened for reading /proc/159/cmdline ps File opened for reading /proc/717/status ps File opened for reading /proc/78/status Process not Found File opened for reading /proc/11/cmdline Process not Found File opened for reading /proc/68/stat ps -
Writes file to tmp directory 12 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/svcguard be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /tmp/fileutl.message.0a8Qqp Process not Found File opened for modification /tmp/fileutl.message.8alfro Process not Found File opened for modification /tmp/fileutl.message.hqOIgO Process not Found File opened for modification /tmp/fileutl.message.v2xSKl Process not Found File opened for modification /tmp/dev/null be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /tmp/kdevtmpfsi be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /tmp/svcupdate be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh File opened for modification /tmp/fileutl.message.mQz8S9 Process not Found File opened for modification /tmp/fileutl.message.UhmnuG Process not Found File opened for modification /tmp/fileutl.message.uc9vS2 Process not Found File opened for modification /tmp/fileutl.message.8dWRXy Process not Found
Processes
-
/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a.sh1⤵
- Adds new SSH keys
- Writes DNS configuration
- Creates/modifies Cron job
- Deletes log files
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:730 -
/bin/chmodchmod 777 /usr/bin/chattr2⤵PID:732
-
-
/bin/chmodchmod 777 /bin/chattr2⤵PID:733
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:736
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:738
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:740
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:748
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:750
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:751
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:752
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:754
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:756
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:757
-
-
/bin/rmrm -rf /var/log/syslog2⤵
- Deletes system logs
PID:758
-
-
/bin/syncsync2⤵PID:759
-
-
/bin/catcat /var/spool/cron/2⤵PID:762
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:764
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:765
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:766
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:768
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:769
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:770
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:772
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:773
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:774
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:775
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:776
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:777
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:778
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:779
-
-
/bin/psps aux2⤵PID:780
-
-
/bin/grepgrep -i "[a]liyun"2⤵
- Attempts to change immutable files
PID:781
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:783
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:782
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:784
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:785
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:786
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:787
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:788
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:792
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:793
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:794
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:795
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:796
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:797
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:798
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:799
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:800
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:801
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:802
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:804
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵PID:785
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:785
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:785
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:785
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵PID:785
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵PID:785
-
-
/bin/systemctlsystemctl disable apparmor2⤵PID:807
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:809
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:810
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:812
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor
PID:814
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:821
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor
PID:823
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:825
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:827
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor
PID:829
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:831
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:833
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:835
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:837
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor
PID:839
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:842
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:844
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:809
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:809
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:809
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:809
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:809
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Enumerates kernel/hardware configuration
PID:809
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Enumerates kernel/hardware configuration
PID:848
-
-
/bin/grepgrep aegis2⤵PID:851
-
-
/bin/grepgrep -v grep2⤵PID:850
-
-
/bin/psps aux2⤵PID:849
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:852
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:853
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:859
-
-
/bin/grepgrep Yun2⤵PID:858
-
-
/bin/grepgrep -v grep2⤵PID:857
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:856
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:868
-
/usr/local/sbin/rmrm -rf3⤵PID:874
-
-
/usr/local/bin/rmrm -rf3⤵PID:874
-
-
/usr/sbin/rmrm -rf3⤵PID:874
-
-
/usr/bin/rmrm -rf3⤵PID:874
-
-
/sbin/rmrm -rf3⤵PID:874
-
-
/bin/rmrm -rf3⤵PID:874
-
-
-
/usr/bin/xargsxargs dirname2⤵PID:867
-
/usr/local/sbin/dirnamedirname3⤵PID:870
-
-
/usr/local/bin/dirnamedirname3⤵PID:870
-
-
/usr/sbin/dirnamedirname3⤵PID:870
-
-
/usr/bin/dirnamedirname3⤵PID:870
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:866
-
-
/bin/grepgrep aegis2⤵PID:865
-
-
/bin/grepgrep -v grep2⤵PID:864
-
-
/bin/psps aux2⤵PID:863
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:880
-
/usr/local/sbin/rmrm -rf3⤵PID:886
-
-
/usr/local/bin/rmrm -rf3⤵PID:886
-
-
/usr/sbin/rmrm -rf3⤵PID:886
-
-
/usr/bin/rmrm -rf3⤵PID:886
-
-
/sbin/rmrm -rf3⤵PID:886
-
-
/bin/rmrm -rf3⤵PID:886
-
-
-
/usr/bin/xargsxargs dirname2⤵PID:879
-
/usr/local/sbin/dirnamedirname3⤵PID:883
-
-
/usr/local/bin/dirnamedirname3⤵PID:883
-
-
/usr/sbin/dirnamedirname3⤵PID:883
-
-
/usr/bin/dirnamedirname3⤵PID:883
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:878
-
-
/bin/grepgrep hids2⤵PID:877
-
-
/bin/grepgrep -v grep2⤵PID:876
-
-
/bin/psps aux2⤵PID:875
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:893
-
/usr/local/sbin/rmrm -rf3⤵PID:897
-
-
/usr/local/bin/rmrm -rf3⤵PID:897
-
-
/usr/sbin/rmrm -rf3⤵PID:897
-
-
/usr/bin/rmrm -rf3⤵PID:897
-
-
/sbin/rmrm -rf3⤵PID:897
-
-
/bin/rmrm -rf3⤵PID:897
-
-
-
/usr/bin/xargsxargs dirname2⤵PID:892
-
/usr/local/sbin/dirnamedirname3⤵PID:895
-
-
/usr/local/bin/dirnamedirname3⤵PID:895
-
-
/usr/sbin/dirnamedirname3⤵PID:895
-
-
/usr/bin/dirnamedirname3⤵PID:895
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:891
-
-
/bin/grepgrep cloudwalker2⤵PID:890
-
-
/bin/grepgrep -v grep2⤵PID:889
-
-
/bin/psps aux2⤵PID:888
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:904
-
/usr/local/sbin/rmrm -rf3⤵PID:908
-
-
/usr/local/bin/rmrm -rf3⤵PID:908
-
-
/usr/sbin/rmrm -rf3⤵PID:908
-
-
/usr/bin/rmrm -rf3⤵PID:908
-
-
/sbin/rmrm -rf3⤵PID:908
-
-
/bin/rmrm -rf3⤵PID:908
-
-
-
/usr/bin/xargsxargs dirname2⤵PID:903
-
/usr/local/sbin/dirnamedirname3⤵PID:906
-
-
/usr/local/bin/dirnamedirname3⤵PID:906
-
-
/usr/sbin/dirnamedirname3⤵PID:906
-
-
/usr/bin/dirnamedirname3⤵PID:906
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:902
-
-
/bin/grepgrep titanagent2⤵PID:901
-
-
/bin/grepgrep -v grep2⤵PID:900
-
-
/bin/psps aux2⤵PID:899
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:914
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:913
-
-
/bin/grepgrep edr2⤵PID:912
-
-
/bin/grepgrep -v grep2⤵PID:911
-
-
/bin/psps aux2⤵PID:910
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:920
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:919
-
-
/bin/grepgrep aegis2⤵PID:918
-
-
/bin/grepgrep -v grep2⤵PID:917
-
-
/bin/psps aux2⤵PID:916
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Attempts to change immutable files
PID:925
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:924
-
-
/bin/grepgrep Yun2⤵PID:923
-
-
/bin/grepgrep -v grep2⤵PID:922
-
-
/bin/psps aux2⤵PID:921
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Attempts to change immutable files
PID:931
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:930
-
-
/bin/grepgrep hids2⤵PID:929
-
-
/bin/grepgrep -v grep2⤵PID:928
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:927
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:936
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:935
-
-
/bin/grepgrep edr2⤵PID:934
-
-
/bin/grepgrep -v grep2⤵PID:933
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:932
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:941
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:940
-
-
/bin/grepgrep cloudwalker2⤵PID:939
-
-
/bin/grepgrep -v grep2⤵PID:938
-
-
/bin/psps aux2⤵PID:937
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:946
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:945
-
-
/bin/grepgrep titanagent2⤵PID:944
-
-
/bin/grepgrep -v grep2⤵PID:943
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:942
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:951
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:950
-
-
/bin/grepgrep sgagent2⤵PID:949
-
-
/bin/grepgrep -v grep2⤵PID:948
-
-
/bin/psps aux2⤵PID:947
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Attempts to change immutable files
PID:956
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:955
-
-
/bin/grepgrep barad_agent2⤵PID:954
-
-
/bin/grepgrep -v grep2⤵PID:953
-
-
/bin/psps aux2⤵PID:952
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:961
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:960
-
-
/bin/grepgrep hostguard2⤵PID:959
-
-
/bin/grepgrep -v grep2⤵PID:958
-
-
/bin/psps aux2⤵PID:957
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:962
-
-
/bin/sleepsleep 12⤵PID:963
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵PID:966
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵PID:967
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵PID:968
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵PID:969
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵PID:970
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵PID:971
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵PID:972
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵PID:973
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵PID:974
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵
- Attempts to change immutable files
PID:975
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵PID:976
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵PID:978
-
-
/bin/sleepsleep 12⤵PID:980
-
-
/bin/rmrm -f /tmp/.null2⤵PID:997
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:999
-
-
/bin/grepgrep 194.87.139.1032⤵PID:1002
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1003
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1004
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1005
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1011
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1010
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1009
-
-
/bin/grepgrep 185.71.65.2382⤵PID:1008
-
-
/bin/grepgrep 140.82.52.872⤵PID:1014
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1015
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1017
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1016
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1024
-
-
/bin/grepgrep -v -2⤵PID:1023
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1022
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1021
-
-
/bin/grepgrep :232⤵PID:1020
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1031
-
-
/bin/grepgrep -v -2⤵PID:1030
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1029
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1028
-
-
/bin/grepgrep :1432⤵PID:1027
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1037
-
-
/bin/grepgrep -v -2⤵PID:1036
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1035
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1034
-
-
/bin/grepgrep :22222⤵PID:1033
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1045
-
-
/bin/grepgrep -v -2⤵PID:1044
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1043
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1042
-
-
/bin/grepgrep :33332⤵PID:1041
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1051
-
-
/bin/grepgrep -v -2⤵PID:1050
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1049
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1048
-
-
/bin/grepgrep :33892⤵PID:1047
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1058
-
-
/bin/grepgrep -v -2⤵PID:1057
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1056
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1055
-
-
/bin/grepgrep :55552⤵PID:1054
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1065
-
-
/bin/grepgrep -v -2⤵PID:1064
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1063
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1062
-
-
/bin/grepgrep :66662⤵PID:1061
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1072
-
-
/bin/grepgrep -v -2⤵PID:1071
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1070
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1069
-
-
/bin/grepgrep :66652⤵PID:1068
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1079
-
-
/bin/grepgrep -v -2⤵PID:1078
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1077
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1076
-
-
/bin/grepgrep :66672⤵PID:1075
-
-
/bin/grepgrep -v -2⤵PID:1084
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1085
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1083
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1082
-
-
/bin/grepgrep :77772⤵PID:1081
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1091
-
-
/bin/grepgrep -v -2⤵PID:1090
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1089
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1088
-
-
/bin/grepgrep :84442⤵PID:1087
-
-
/bin/grepgrep -v -2⤵PID:1096
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1097
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1095
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1094
-
-
/bin/grepgrep :33472⤵PID:1093
-
-
/bin/grepgrep -v -2⤵PID:1102
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1103
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1101
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1100
-
-
/bin/grepgrep :100082⤵PID:1099
-
-
/bin/grepgrep -v grep2⤵PID:1108
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1111
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1110
-
-
/bin/grepgrep :135312⤵PID:1109
-
-
/bin/grepgrep :33332⤵PID:1114
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1115
-
-
/bin/grepgrep -v grep2⤵PID:1113
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1116
-
-
/bin/psps aux2⤵PID:1112
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1121
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1120
-
-
/bin/grepgrep :55552⤵PID:1119
-
-
/bin/grepgrep -v grep2⤵PID:1118
-
-
/bin/psps aux2⤵PID:1117
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1126
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1125
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1124
-
-
/bin/grepgrep -v grep2⤵PID:1123
-
-
/bin/psps aux2⤵PID:1122
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1131
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1130
-
-
/bin/grepgrep log_2⤵PID:1129
-
-
/bin/grepgrep -v grep2⤵PID:1128
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1127
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1136
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1135
-
-
/bin/grepgrep systemten2⤵PID:1134
-
-
/bin/grepgrep -v grep2⤵PID:1133
-
-
/bin/psps aux2⤵PID:1132
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1141
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/bin/killkill -9 103⤵
- Disables SELinux
- Reads CPU attributes
PID:1142
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1140
-
-
/bin/grepgrep netns2⤵PID:1139
-
-
/bin/grepgrep -v grep2⤵PID:1138
-
-
/bin/psps aux2⤵PID:1137
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1147
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1146
-
-
/bin/grepgrep voltuned2⤵PID:1145
-
-
/bin/grepgrep -v grep2⤵PID:1144
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1143
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1152
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1151
-
-
/bin/grepgrep darwin2⤵PID:1150
-
-
/bin/grepgrep -v grep2⤵PID:1149
-
-
/bin/psps aux2⤵PID:1148
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1157
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1156
-
-
/bin/grepgrep /tmp/dl2⤵PID:1155
-
-
/bin/grepgrep -v grep2⤵PID:1154
-
-
/bin/psps aux2⤵PID:1153
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1161
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1160
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1162
-
-
/bin/grepgrep -v grep2⤵PID:1159
-
-
/bin/psps aux2⤵PID:1158
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1167
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1166
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1165
-
-
/bin/grepgrep -v grep2⤵PID:1164
-
-
/bin/psps aux2⤵PID:1163
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1172
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1171
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1170
-
-
/bin/grepgrep -v grep2⤵PID:1169
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1168
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1177
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1176
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1175
-
-
/bin/grepgrep -v grep2⤵PID:1174
-
-
/bin/psps aux2⤵PID:1173
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1182
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1181
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1180
-
-
/bin/grepgrep -v grep2⤵PID:1179
-
-
/bin/psps aux2⤵PID:1178
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1187
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1186
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1184
-
-
/bin/psps aux2⤵PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1192
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1191
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1190
-
-
/bin/grepgrep -v grep2⤵PID:1189
-
-
/bin/psps aux2⤵PID:1188
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1197
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1196
-
-
/bin/grepgrep 45.76.122.922⤵PID:1195
-
-
/bin/grepgrep -v grep2⤵PID:1194
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1193
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1202
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1201
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1200
-
-
/bin/grepgrep -v grep2⤵PID:1199
-
-
/bin/psps aux2⤵PID:1198
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1207
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1206
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1205
-
-
/bin/grepgrep -v grep2⤵PID:1204
-
-
/bin/psps aux2⤵PID:1203
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1212
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1211
-
-
/bin/grepgrep 86s.jpg2⤵PID:1210
-
-
/bin/grepgrep -v grep2⤵PID:1209
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1208
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1217
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1216
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1215
-
-
/bin/grepgrep -v grep2⤵PID:1214
-
-
/bin/psps aux2⤵PID:1213
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1222
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1221
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1220
-
-
/bin/grepgrep -v grep2⤵PID:1219
-
-
/bin/psps aux2⤵PID:1218
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1227
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1226
-
-
/bin/grepgrep PuNY5tm22⤵PID:1225
-
-
/bin/grepgrep -v grep2⤵PID:1224
-
-
/bin/psps aux2⤵PID:1223
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1232
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1231
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1230
-
-
/bin/grepgrep -v grep2⤵PID:1229
-
-
/bin/psps aux2⤵PID:1228
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1237
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1236
-
-
/bin/grepgrep AgdgACUD2⤵PID:1235
-
-
/bin/grepgrep -v grep2⤵PID:1234
-
-
/bin/psps aux2⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1242
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1241
-
-
/bin/grepgrep uiZvwxG82⤵PID:1240
-
-
/bin/grepgrep -v grep2⤵PID:1239
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1247
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1246
-
-
/bin/grepgrep hahwNEdB2⤵PID:1245
-
-
/bin/grepgrep -v grep2⤵PID:1244
-
-
/bin/psps aux2⤵PID:1243
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1251
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1250
-
-
/bin/grepgrep -v grep2⤵PID:1249
-
-
/bin/psps aux2⤵PID:1248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1257
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1256
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1255
-
-
/bin/grepgrep -v grep2⤵PID:1254
-
-
/bin/psps aux2⤵PID:1253
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1262
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1261
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1260
-
-
/bin/grepgrep -v grep2⤵PID:1259
-
-
/bin/psps aux2⤵PID:1258
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1267
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1266
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1265
-
-
/bin/grepgrep -v grep2⤵PID:1264
-
-
/bin/psps aux2⤵PID:1263
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1272
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1271
-
-
/bin/grepgrep zXcDajSs2⤵PID:1270
-
-
/bin/grepgrep -v grep2⤵PID:1269
-
-
/bin/psps aux2⤵PID:1268
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1277
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1276
-
-
/bin/grepgrep 3lmigMo2⤵PID:1275
-
-
/bin/grepgrep -v grep2⤵PID:1274
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1273
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1282
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1281
-
-
/bin/grepgrep AkMK4A22⤵PID:1280
-
-
/bin/grepgrep -v grep2⤵PID:1279
-
-
/bin/psps aux2⤵PID:1278
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1287
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1286
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1285
-
-
/bin/grepgrep -v grep2⤵PID:1284
-
-
/bin/psps aux2⤵PID:1283
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1292
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1291
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1290
-
-
/bin/grepgrep -v grep2⤵PID:1289
-
-
/bin/psps aux2⤵PID:1288
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1297
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1296
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1295
-
-
/bin/grepgrep -v grep2⤵PID:1294
-
-
/bin/psps aux2⤵PID:1293
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1302
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1301
-
-
/bin/grepgrep http_0xCC0312⤵PID:1300
-
-
/bin/grepgrep -v grep2⤵PID:1299
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1307
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1306
-
-
/bin/grepgrep http_0xCC0322⤵PID:1305
-
-
/bin/grepgrep -v grep2⤵PID:1304
-
-
/bin/psps aux2⤵PID:1303
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1312
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1311
-
-
/bin/grepgrep http_0xCC0332⤵PID:1310
-
-
/bin/grepgrep -v grep2⤵PID:1309
-
-
/bin/psps aux2⤵PID:1308
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1317
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1316
-
-
/bin/grepgrep C4iLM4L2⤵PID:1315
-
-
/bin/grepgrep -v grep2⤵PID:1314
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1313
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1322
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1321
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1320
-
-
/bin/grepgrep -v grep2⤵PID:1319
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1318
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1326
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1325
-
-
/bin/grepgrep -v grep2⤵PID:1324
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1323
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1331
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1330
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1329
-
-
/bin/grepgrep -v grep2⤵PID:1328
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1327
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1336
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1335
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1334
-
-
/bin/grepgrep -v grep2⤵PID:1333
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1332
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1341
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1340
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1339
-
-
/bin/grepgrep -v grep2⤵PID:1338
-
-
/bin/psps aux2⤵PID:1337
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1346
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1345
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1344
-
-
/bin/grepgrep -v grep2⤵PID:1343
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1342
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1351
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1350
-
-
/bin/grepgrep nqscheduler2⤵PID:1349
-
-
/bin/grepgrep -v grep2⤵PID:1348
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1347
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1354
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1352
-
-
/bin/grepgrep -v grep2⤵PID:1353
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1355
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1356
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1361
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1362
-
-
/bin/grepgrep "]"2⤵PID:1360
-
-
/bin/grepgrep -v aux2⤵PID:1359
-
-
/bin/grepgrep -v grep2⤵PID:1358
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1357
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1367
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1366
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1365
-
-
/bin/grepgrep -v grep2⤵PID:1364
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1363
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1372
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1371
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1370
-
-
/bin/grepgrep -v grep2⤵PID:1369
-
-
/bin/psps aux2⤵PID:1368
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1377
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1376
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1375
-
-
/bin/grepgrep -v grep2⤵PID:1374
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1373
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1383
-
-
/bin/grepgrep -v _2⤵PID:1382
-
-
/bin/grepgrep -v -2⤵PID:1381
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1384
-
-
/bin/grepgrep -v /2⤵PID:1380
-
-
/bin/grepgrep -v grep2⤵PID:1379
-
-
/bin/psps aux2⤵PID:1378
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1389
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1388
-
-
/bin/grepgrep "\\[^"2⤵PID:1387
-
-
/bin/grepgrep -v grep2⤵PID:1386
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1385
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1394
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1393
-
-
/bin/grepgrep rsync2⤵PID:1392
-
-
/bin/grepgrep -v grep2⤵PID:1391
-
-
/bin/psps aux2⤵PID:1390
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1399
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1398
-
-
/bin/grepgrep watchd0g2⤵PID:1397
-
-
/bin/grepgrep -v grep2⤵PID:1396
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1395
-
-
/bin/grepgrep -v grep2⤵PID:1401
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1400
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1404
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1403
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1409
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1408
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1407
-
-
/bin/grepgrep -v grep2⤵PID:1406
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1405
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1414
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1413
-
-
/bin/grepgrep /tmp/java2⤵PID:1412
-
-
/bin/grepgrep -v grep2⤵PID:1411
-
-
/bin/psps aux2⤵PID:1410
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1419
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1418
-
-
/bin/grepgrep gitee.com2⤵PID:1417
-
-
/bin/grepgrep -v grep2⤵PID:1416
-
-
/bin/psps aux2⤵PID:1415
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1424
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1423
-
-
/bin/grepgrep /tmp/java2⤵PID:1422
-
-
/bin/grepgrep -v grep2⤵PID:1421
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1420
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1429
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1428
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1427
-
-
/bin/grepgrep -v grep2⤵PID:1426
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1425
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1434
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1433
-
-
/bin/grepgrep 89.35.39.782⤵PID:1432
-
-
/bin/grepgrep -v grep2⤵PID:1431
-
-
/bin/psps aux2⤵PID:1430
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1439
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1438
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1437
-
-
/bin/grepgrep -v grep2⤵PID:1436
-
-
/bin/psps aux2⤵PID:1435
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1444
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1443
-
-
/bin/grepgrep kthrotlds2⤵PID:1442
-
-
/bin/grepgrep -v grep2⤵PID:1441
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1440
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1449
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1448
-
-
/bin/grepgrep ksoftirqds2⤵PID:1447
-
-
/bin/grepgrep -v grep2⤵PID:1446
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1445
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1454
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1453
-
-
/bin/grepgrep netdns2⤵PID:1452
-
-
/bin/grepgrep -v grep2⤵PID:1451
-
-
/bin/psps aux2⤵PID:1450
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1459
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1458
-
-
/bin/grepgrep watchdogs2⤵PID:1457
-
-
/bin/grepgrep -v grep2⤵PID:1456
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1455
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1464
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1462
-
-
/bin/grepgrep -v grep2⤵PID:1461
-
-
/bin/psps aux2⤵PID:1460
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1469
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1468
-
-
/bin/grepgrep kinsing2⤵PID:1467
-
-
/bin/grepgrep -v grep2⤵PID:1466
-
-
/bin/psps aux2⤵PID:1465
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1474
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1473
-
-
/bin/grepgrep redis22⤵PID:1472
-
-
/bin/grepgrep -v grep2⤵PID:1471
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1470
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1480
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1479
-
-
/bin/grepgrep " ps"2⤵PID:1478
-
-
/bin/grepgrep -v aux2⤵PID:1477
-
-
/bin/grepgrep -v grep2⤵PID:1476
-
-
/bin/psps aux2⤵PID:1475
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1485
-
-
/usr/bin/cutcut -c 9-152⤵PID:1484
-
-
/bin/grepgrep sync_supers2⤵PID:1483
-
-
/bin/grepgrep -v grep2⤵PID:1482
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1481
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1490
-
-
/usr/bin/cutcut -c 9-152⤵PID:1489
-
-
/bin/grepgrep cpuset2⤵PID:1488
-
-
/bin/grepgrep -v grep2⤵PID:1487
-
-
/bin/psps aux2⤵PID:1486
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1495
-
-
/bin/grepgrep "x]"2⤵PID:1494
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1496
-
-
/bin/grepgrep -v aux2⤵PID:1493
-
-
/bin/grepgrep -v grep2⤵PID:1492
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1491
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1502
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1501
-
-
/bin/grepgrep "sh] <"2⤵PID:1500
-
-
/bin/grepgrep -v aux2⤵PID:1499
-
-
/bin/grepgrep -v grep2⤵PID:1498
-
-
/bin/psps aux2⤵PID:1497
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1507
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1508
-
-
/bin/grepgrep " \\[]"2⤵PID:1506
-
-
/bin/grepgrep -v aux2⤵PID:1505
-
-
/bin/grepgrep -v grep2⤵PID:1504
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1503
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1513
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1512
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1511
-
-
/bin/grepgrep -v grep2⤵PID:1510
-
-
/bin/psps aux2⤵PID:1509
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1518
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1517
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1516
-
-
/bin/grepgrep -v grep2⤵PID:1515
-
-
/bin/psps aux2⤵PID:1514
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1523
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1522
-
-
/bin/grepgrep hahwNEdB2⤵PID:1521
-
-
/bin/grepgrep -v grep2⤵PID:1520
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1519
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1528
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1527
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1526
-
-
/bin/grepgrep -v grep2⤵PID:1525
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1524
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1533
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1532
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1531
-
-
/bin/grepgrep -v grep2⤵PID:1530
-
-
/bin/psps aux2⤵PID:1529
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1538
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1537
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1536
-
-
/bin/grepgrep -v grep2⤵PID:1535
-
-
/bin/psps aux2⤵PID:1534
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1543
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1542
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1541
-
-
/bin/grepgrep -v grep2⤵PID:1540
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1539
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1548
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1547
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1546
-
-
/bin/grepgrep -v grep2⤵PID:1545
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1544
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1553
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1552
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1551
-
-
/bin/grepgrep -v grep2⤵PID:1550
-
-
/bin/psps aux2⤵PID:1549
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1558
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1557
-
-
/bin/grepgrep sustse2⤵PID:1556
-
-
/bin/grepgrep -v grep2⤵PID:1555
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1554
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1563
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1562
-
-
/bin/grepgrep sustse32⤵PID:1561
-
-
/bin/grepgrep -v grep2⤵PID:1560
-
-
/bin/psps aux2⤵PID:1559
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1569
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1568
-
-
/bin/grepgrep wget2⤵PID:1567
-
-
/bin/grepgrep mr.sh2⤵PID:1566
-
-
/bin/grepgrep -v grep2⤵PID:1565
-
-
/bin/psps aux2⤵PID:1564
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1575
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1574
-
-
/bin/grepgrep curl2⤵PID:1573
-
-
/bin/grepgrep mr.sh2⤵PID:1572
-
-
/bin/grepgrep -v grep2⤵PID:1571
-
-
/bin/psps aux2⤵PID:1570
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1581
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1580
-
-
/bin/grepgrep wget2⤵PID:1579
-
-
/bin/grepgrep 2mr.sh2⤵PID:1578
-
-
/bin/grepgrep -v grep2⤵PID:1577
-
-
/bin/psps aux2⤵PID:1576
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1587
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1586
-
-
/bin/grepgrep curl2⤵PID:1585
-
-
/bin/grepgrep 2mr.sh2⤵PID:1584
-
-
/bin/grepgrep -v grep2⤵PID:1583
-
-
/bin/psps aux2⤵PID:1582
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1592
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1593
-
-
/bin/grepgrep wget2⤵PID:1591
-
-
/bin/grepgrep cr5.sh2⤵PID:1590
-
-
/bin/grepgrep -v grep2⤵PID:1589
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1588
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1599
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1598
-
-
/bin/grepgrep curl2⤵PID:1597
-
-
/bin/grepgrep cr5.sh2⤵PID:1596
-
-
/bin/grepgrep -v grep2⤵PID:1595
-
-
/bin/psps aux2⤵PID:1594
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1605
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1604
-
-
/bin/grepgrep wget2⤵PID:1603
-
-
/bin/grepgrep logo9.jpg2⤵PID:1602
-
-
/bin/grepgrep -v grep2⤵PID:1601
-
-
/bin/psps aux2⤵PID:1600
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1611
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1610
-
-
/bin/grepgrep curl2⤵PID:1609
-
-
/bin/grepgrep logo9.jpg2⤵PID:1608
-
-
/bin/grepgrep -v grep2⤵PID:1607
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1606
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1616
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1615
-
-
/bin/grepgrep j2.conf2⤵PID:1614
-
-
/bin/grepgrep -v grep2⤵PID:1613
-
-
/bin/psps aux2⤵PID:1612
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1622
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1621
-
-
/bin/grepgrep wget2⤵PID:1620
-
-
/bin/grepgrep luk-cpu2⤵PID:1619
-
-
/bin/grepgrep -v grep2⤵PID:1618
-
-
/bin/psps aux2⤵PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1628
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1627
-
-
/bin/grepgrep curl2⤵PID:1626
-
-
/bin/grepgrep luk-cpu2⤵PID:1625
-
-
/bin/grepgrep -v grep2⤵PID:1624
-
-
/bin/psps aux2⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1634
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1633
-
-
/bin/grepgrep wget2⤵PID:1632
-
-
/bin/grepgrep ficov2⤵PID:1631
-
-
/bin/grepgrep -v grep2⤵PID:1630
-
-
/bin/psps aux2⤵PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1640
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1639
-
-
/bin/grepgrep curl2⤵PID:1638
-
-
/bin/grepgrep ficov2⤵PID:1637
-
-
/bin/grepgrep -v grep2⤵PID:1636
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1635
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1646
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1645
-
-
/bin/grepgrep wget2⤵PID:1644
-
-
/bin/grepgrep he.sh2⤵PID:1643
-
-
/bin/grepgrep -v grep2⤵PID:1642
-
-
/bin/psps aux2⤵PID:1641
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1652
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1651
-
-
/bin/grepgrep curl2⤵PID:1650
-
-
/bin/grepgrep he.sh2⤵PID:1649
-
-
/bin/grepgrep -v grep2⤵PID:1648
-
-
/bin/psps aux2⤵PID:1647
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1657
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1658
-
-
/bin/grepgrep wget2⤵PID:1656
-
-
/bin/grepgrep miner.sh2⤵PID:1655
-
-
/bin/grepgrep -v grep2⤵PID:1654
-
-
/bin/psps aux2⤵PID:1653
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1664
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1663
-
-
/bin/grepgrep curl2⤵PID:1662
-
-
/bin/grepgrep miner.sh2⤵PID:1661
-
-
/bin/grepgrep -v grep2⤵PID:1660
-
-
/bin/psps aux2⤵PID:1659
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1669
-
-
/bin/grepgrep wget2⤵PID:1668
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1670
-
-
/bin/grepgrep nullcrew2⤵PID:1667
-
-
/bin/grepgrep -v grep2⤵PID:1666
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1665
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/bin/grepgrep curl2⤵PID:1674
-
-
/bin/grepgrep nullcrew2⤵PID:1673
-
-
/bin/grepgrep -v grep2⤵PID:1672
-
-
/bin/psps aux2⤵PID:1671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1681
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1680
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1679
-
-
/bin/grepgrep -v grep2⤵PID:1678
-
-
/bin/psps aux2⤵PID:1677
-
-
/bin/psps aux2⤵PID:1682
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1685
-
-
/bin/grepgrep -v grep2⤵PID:1683
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1684
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1691
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1690
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1689
-
-
/bin/grepgrep -v grep2⤵PID:1688
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1695
-
-
/bin/grepgrep 144.217.45.452⤵PID:1694
-
-
/bin/grepgrep -v grep2⤵PID:1693
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1692
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1701
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1700
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1699
-
-
/bin/grepgrep -v grep2⤵PID:1698
-
-
/bin/psps aux2⤵PID:1697
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1706
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1705
-
-
/bin/grepgrep 176.31.6.162⤵PID:1704
-
-
/bin/grepgrep -v grep2⤵PID:1703
-
-
/bin/psps aux2⤵PID:1702
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1711
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1710
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1709
-
-
/bin/grepgrep -v grep2⤵PID:1708
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1715
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1714
-
-
/bin/grepgrep -v grep2⤵PID:1713
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1712
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1721
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1720
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1719
-
-
/bin/grepgrep -v grep2⤵PID:1718
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1726
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1725
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1724
-
-
/bin/grepgrep -v grep2⤵PID:1723
-
-
/bin/psps auxf2⤵PID:1722
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1731
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1730
-
-
/bin/grepPID:1729
-
-
/bin/grepgrep -v grep2⤵PID:1728
-
-
/bin/psps auxf2⤵PID:1727
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1736
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1735
-
-
/bin/grepgrep monerohash.com2⤵PID:1734
-
-
/bin/grepgrep -v grep2⤵PID:1733
-
-
/bin/psps auxf2⤵PID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1741
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1740
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1739
-
-
/bin/grepgrep -v grep2⤵PID:1738
-
-
/bin/psps auxf2⤵PID:1737
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1746
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1745
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1744
-
-
/bin/grepgrep -v grep2⤵PID:1743
-
-
/bin/psps auxf2⤵PID:1742
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1751
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1750
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1749
-
-
/bin/grepgrep -v grep2⤵PID:1748
-
-
/bin/psps auxf2⤵PID:1747
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1756
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1755
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1754
-
-
/bin/grepgrep -v grep2⤵PID:1753
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1752
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1761
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1760
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1759
-
-
/bin/grepgrep -v grep2⤵PID:1758
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1766
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1765
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1764
-
-
/bin/grepgrep -v grep2⤵PID:1763
-
-
/bin/psps auxf2⤵PID:1762
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1771
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1770
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1769
-
-
/bin/grepgrep -v grep2⤵PID:1768
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1775
-
/usr/local/sbin/killkill -9 17733⤵PID:1776
-
-
/usr/local/bin/killkill -9 17733⤵PID:1776
-
-
/usr/sbin/killkill -9 17733⤵PID:1776
-
-
/usr/bin/killkill -9 17733⤵PID:1776
-
-
/sbin/killkill -9 17733⤵PID:1776
-
-
/bin/killkill -9 17733⤵
- Reads CPU attributes
PID:1776
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1774
-
-
/bin/grepgrep xiaoyao2⤵PID:1773
-
-
/bin/psps auxf2⤵PID:1772
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1780
-
/usr/local/sbin/killkill -9 17783⤵PID:1781
-
-
/usr/local/bin/killkill -9 17783⤵PID:1781
-
-
/usr/sbin/killkill -9 17783⤵PID:1781
-
-
/usr/bin/killkill -9 17783⤵PID:1781
-
-
/sbin/killkill -9 17783⤵PID:1781
-
-
/bin/killkill -9 17783⤵PID:1781
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1779
-
-
/bin/grepgrep xiaoxue2⤵PID:1778
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1777
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1785
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1786
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1784
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1787
-
-
/bin/grepgrep 46.243.253.152⤵PID:1783
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1792
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1791
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1793
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1790
-
-
/bin/grepgrep 176.31.6.162⤵PID:1789
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1795
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1794
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1797
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1796
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1799
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1798
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1801
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1800
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1803
-
-
/usr/bin/pgreppgrep -f addnj2⤵
- Reads CPU attributes
PID:1802
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1805
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1804
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1807
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1806
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1809
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1808
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:790
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:791
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:817
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD53d47b8e895a71930bda5d4f3d8fc8589
SHA1efbaf468b81abb6b465ca12f35fa067bae1b4f10
SHA256be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
SHA512bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
-
Filesize
52B
MD5f668da8f0525cbe5a545869cb5776913
SHA1996e6afed4498ff8a92a64330de018141af102c9
SHA256db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
SHA512f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
-
Filesize
56B
MD5896f6d504f181bd883a90b84069bcf70
SHA186fd682d1932d9e14461796e5f0fe776b8ce9d5c
SHA256b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
SHA5121f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
-
Filesize
53B
MD56956a4d6a2444151c11a73517215cb34
SHA1b279ad496f640f44418aa7e5e27a4d458bddb7fb
SHA256561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
SHA512ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
-
Filesize
53B
MD53a615a3d1952b1e2c0cb584bd253f7f9
SHA179465a5e611f19f140f169ac5bc3a9ab382696ef
SHA256ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
SHA5128819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
-
Filesize
50B
MD5b2ecca8d419b5c3fa2ee7621efa75eb7
SHA13adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
SHA256e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
SHA512c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
-
Filesize
2.5MB
MD5bbc89428aeba553981095a260e3ebbcc
SHA1b828af0719aa88e3899b2e64936de75a5090e67e
SHA2561cffb56aee820425b72a2b1ec45668b5ea42a8fda6b6019e9da926dd4c418bd7
SHA5120e3756fa5bd8efd1fc49b0ef161ef7f5319da0e354617e35abc90335a9445fe3d17478c943b2da1376f7d76656bf349cc3e4e29ce5d24b5424cd38866663da3f
-
Filesize
2.5MB
MD5bff1868dc5dc8842076dcfb5f638ca1b
SHA19bc79f7e0f69eac04daeb60acdbc668c5dec46d5
SHA2566983e3847c9c033dafa22c0e26f8297a2aca59417b7d2fa67f799d877f704a0d
SHA5121619614fe6ca902121a8348cfaaeec405c7a170838a5b7eaea24c64d99804e417ca24ae9df47588cf5704dc54f54828775ef3aaaa1840614b73c4c2f0d777b7b
-
Filesize
9B
MD5970d39f8690eff0fe573e7bcf51bda9b
SHA146f8f835d3d3d41f063d0e8346260bb622b01a3f
SHA2567e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
SHA51224952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
Filesize
557B
MD512bf68ad9999dcbc8bd1d9a728d600aa
SHA17f302d2df5e075f879586cb0ab1dcc0b0870cc98
SHA256cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
SHA512ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
-
Filesize
2B
MD56d7fce9fee471194aa8b5b6e47267f03
SHA1a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA2561121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
SHA5122b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
-
Filesize
2B
MD526ab0db90d72e28ad0ba1e22ee510510
SHA17448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA25653c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
SHA51263e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
-
Filesize
2B
MD59ae0ea9e3c9c6e1b9b6252c8395efdc1
SHA1ccf271b7830882da1791852baeca1737fcbe4b90
SHA25606e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
SHA512f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
-
Filesize
2B
MD548a24b70a0b376535542b996af517398
SHA19c6b057a2b9d96a4067a749ee3b3b0158d390cf1
SHA2567de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
SHA512db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
-
Filesize
2B
MD51dcca23355272056f04fe8bf20edfce0
SHA15d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA256f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
SHA51229b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d