105e32c8ef13d4d001923c1a43a8849d069fc4adebe48e5e6a9e726eb605ce31

Analysis

max time kernel
17s
max time network
480s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
15/04/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/a/init0
Size

9KB
MD5

019e23027bc3849142dd8625451ed5c0
SHA1

982c0318414c3fdf82e3726c4ef4e9021751bbd9
SHA256

0e8472f2005560c6f4db4e5aef39e5d35185b35c67f70a27c8b3dcb242eed25e
SHA512

89fd143e3060669df59feeb599cb5042bf8996983dd9073a53cf1d00d408ec9930e1ce29a1aa3aa1f1157a3a6dee1a0cc32f0791c92f75ed0f74c59f326cdc32
SSDEEP

96:97gXuXeR7P0YQH8h9GVQbxgeJwI222bznGWDKKFZ5W:97xeRb038hAGbxIz9/0

Score

6^/10

Malware Config

Signatures

Attempts to change immutable files 1 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
2253	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1089/cmdline	ps
File opened for reading	/proc/200/cmdline	ps
File opened for reading	/proc/1040/stat	ps
File opened for reading	/proc/903/status	ps
File opened for reading	/proc/1416/cmdline	pkill
File opened for reading	/proc/923/status	pkill
File opened for reading	/proc/200/status	pkill
File opened for reading	/proc/589/cmdline	ps
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/1192/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/164/status	pkill
File opened for reading	/proc/163/cmdline	pkill
File opened for reading	/proc/1131/status	pkill
File opened for reading	/proc/899/cmdline	ps
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/489/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/116/cmdline	pkill
File opened for reading	/proc/518/cmdline	pkill
File opened for reading	/proc/572/cmdline	pkill
File opened for reading	/proc/81/status	ps
File opened for reading	/proc/1040/status	pkill
File opened for reading	/proc/160/stat	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/807/cmdline	ps
File opened for reading	/proc/168/cmdline	pkill
File opened for reading	/proc/899/cmdline	pkill
File opened for reading	/proc/1451/cmdline	pkill
File opened for reading	/proc/90/cmdline	pkill
File opened for reading	/proc/1451/status	pkill
File opened for reading	/proc/102/cmdline	ps
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/1192/stat	killall
File opened for reading	/proc/475/cmdline	ps
File opened for reading	/proc/1101/status	ps
File opened for reading	/proc/242/stat	ps
File opened for reading	/proc/1052/status	pkill
File opened for reading	/proc/1406/cmdline	pkill
File opened for reading	/proc/589/status	pkill
File opened for reading	/proc/2034/stat	ps
File opened for reading	/proc/1414/stat	ps
File opened for reading	/proc/1411/status	pkill
File opened for reading	/proc/810/status	pkill
File opened for reading	/proc/460/status	ps
File opened for reading	/proc/175/cmdline	ps
File opened for reading	/proc/201/status	pkill
File opened for reading	/proc/1084/cmdline	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/633/status	pkill
File opened for reading	/proc/92/cmdline	pkill
File opened for reading	/proc/170/stat	ps
File opened for reading	/proc/458/status	pkill
File opened for reading	/proc/1075/status	ps
File opened for reading	/proc/790/status	ps
File opened for reading	/proc/160/status	ps
File opened for reading	/proc/1044/cmdline	ps
File opened for reading	/proc/1111/stat	ps
File opened for reading	/proc/168/cmdline	ps
File opened for reading	/proc/1104/cmdline	pkill
File opened for reading	/proc/135/cmdline	pkill
File opened for reading	/proc/790/cmdline	pkill
File opened for reading	/proc/895/status	pkill

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/crondpid
File opened for modification	/tmp/ssdpid
File opened for modification	/tmp/syslogspid
File opened for modification	/tmp/.rsync/a/.procs

/tmp/.rsync/a/init0
/tmp/.rsync/a/init0
1⤵
PID:1473
- /usr/bin/rm
  rm /tmp/.cron
  2⤵
  PID:1474
- /usr/bin/rm
  rm "/tmp/Donald*"
  2⤵
  PID:1475
- /usr/bin/rm
  rm "/tmp/Macron*"
  2⤵
  PID:1476
- /usr/bin/rm
  rm /tmp/.main
  2⤵
  PID:1477
- /usr/bin/rm
  rm "/tmp/.yam*" -rf
  2⤵
  PID:1481
- /usr/bin/rm
  rm -f /tmp/irq
  2⤵
  PID:1482
- /usr/bin/rm
  rm -f /tmp/irq.sh
  2⤵
  PID:1483
- /usr/bin/rm
  rm -f /tmp/irqbalanc1
  2⤵
  PID:1484
- /usr/bin/rm
  rm -rf /boot/grub/deamon
  2⤵
  PID:1485
- /usr/bin/rm
  rm -rf /boot/grub/disk_genius
  2⤵
  PID:1486
- /usr/bin/rm
  rm -rf "/tmp/*httpd.conf"
  2⤵
  PID:1487
- /usr/bin/rm
  rm -rf "/tmp/*httpd.conf*"
  2⤵
  PID:1488
- /usr/bin/rm
  rm -rf "/tmp/*index_bak*"
  2⤵
  PID:1489
- /usr/bin/rm
  rm -rf "/tmp/.systemd-private-*"
  2⤵
  PID:1490
- /usr/bin/rm
  rm -rf "/tmp/.xm*"
  2⤵
  PID:1491
- /usr/bin/rm
  rm -rf /tmp/a7b104c270
  2⤵
  PID:1492
- /usr/bin/rm
  rm -rf /tmp/conn
  2⤵
  PID:1493
- /usr/bin/rm
  rm -rf /tmp/conns
  2⤵
  PID:1494
- /usr/bin/rm
  rm -rf /tmp/httpd.conf
  2⤵
  PID:1495
- /usr/bin/rm
  rm -rf "/tmp/java*"
  2⤵
  PID:1496
- /usr/bin/rm
  rm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.so
  2⤵
  PID:1497
- /usr/bin/rm
  rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
  2⤵
  PID:1498
- /usr/bin/rm
  rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
  2⤵
  PID:1499
- /usr/bin/rm
  rm -rf "/tmp/xm*"
  2⤵
  PID:1500
- /usr/bin/rm
  rm -rf "/var/tmp/java*"
  2⤵
  PID:1501
- /usr/bin/killall
  killall -9 chron-34e2fg
  2⤵
  PID:1508
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1506
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1521
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1521
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1521
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1521
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1505
- /usr/bin/awk
  awk "!/awk/"
  2⤵
  PID:1504
- /usr/bin/awk
  awk /34e2fg/
  2⤵
  PID:1503
- /usr/bin/ps
  ps auxw
  2⤵
  PID:1502
- /usr/bin/awk
  awk "{if(\$2>=40.0) print \$1}"
  2⤵
  PID:1515
- /usr/bin/ps
  ps axf -o "pid %cpu"
  2⤵
  - Reads CPU attributes
  PID:1514
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1512
- - /usr/local/sbin/kill
    kill -9 1510
    3⤵
    PID:1522
- - /usr/local/bin/kill
    kill -9 1510
    3⤵
    PID:1522
- - /usr/sbin/kill
    kill -9 1510
    3⤵
    PID:1522
- - /usr/bin/kill
    kill -9 1510
    3⤵
    PID:1522
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1511
- /usr/bin/awk
  awk "/34e|r\\/v3|moy5|defunct/"
  2⤵
  PID:1510
- /usr/bin/ps
  ps wx
  2⤵
  - Reads CPU attributes
  PID:1509
- /usr/bin/killall
  killall .Historys
  2⤵
  - Reads runtime system information
  PID:1520
- /usr/bin/killall
  killall .sshd
  2⤵
  PID:1523
- /usr/bin/killall
  killall neptune
  2⤵
  PID:1524
- /usr/bin/killall
  killall xm64
  2⤵
  PID:1525
- /usr/bin/killall
  killall xm32
  2⤵
  PID:1526
- /usr/bin/killall
  killall ld-linux
  2⤵
  PID:1527
- /usr/bin/killall
  killall xmrig
  2⤵
  PID:1528
- /usr/bin/killall
  killall .xmrig
  2⤵
  PID:1529
- /usr/bin/killall
  killall suppoieup
  2⤵
  PID:1539
- /usr/bin/killall
  killall xrx
  2⤵
  PID:1540
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  PID:1543
- /usr/bin/pkill
  pkill wnTKYg
  2⤵
  - Reads CPU attributes
  PID:1551
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1564
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1570
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1570
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1570
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1570
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1563
- /usr/bin/grep
  grep mine.moneropool.com
  2⤵
  PID:1562
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1561
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1560
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1576
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1588
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1588
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1588
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1588
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1575
- /usr/bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1574
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1573
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1572
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1594
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1636
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1636
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1636
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1636
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1593
- /usr/bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1592
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1590
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1589
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1644
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1645
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1694
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1694
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1694
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1694
- /usr/bin/grep
  grep 119.9.76.107:443
  2⤵
  PID:1643
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1642
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1641
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1699
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1717
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1717
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1717
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1717
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1698
- /usr/bin/grep
  grep monerohash.com
  2⤵
  PID:1697
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1695
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1696
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1728
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1783
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1783
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1783
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1783
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1727
- /usr/bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:1726
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1725
- /usr/bin/ps
  ps auxf
  2⤵
  PID:1724
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1790
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1836
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1836
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1836
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1836
- /usr/bin/grep
  grep xmr.crypto-pool.fr:6666
  2⤵
  PID:1788
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1789
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1787
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1786
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1844
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1871
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1871
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1871
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1871
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1843
- /usr/bin/grep
  grep xmr.crypto-pool.fr:7777
  2⤵
  PID:1842
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1841
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1840
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1889
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1905
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1905
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1905
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1905
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1888
- /usr/bin/grep
  grep xmr.crypto-pool.fr:443
  2⤵
  PID:1887
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1885
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1886
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1913
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1928
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1928
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1928
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1928
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1912
- /usr/bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:1911
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1910
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1909
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1935
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1945
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1945
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1945
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1945
- /usr/bin/grep
  grep xmrpool.eu
  2⤵
  PID:1933
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1934
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1932
- /usr/bin/ps
  ps auxf
  2⤵
  PID:1931
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1951
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1960
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1960
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1960
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1960
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1950
- /usr/bin/grep
  grep xmrig
  2⤵
  PID:1949
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1948
- /usr/bin/ps
  ps auxf
  2⤵
  PID:1947
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1967
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1973
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1973
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1973
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1973
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1966
- /usr/bin/grep
  grep xmrigDaemon
  2⤵
  PID:1965
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1964
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1963
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1980
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1994
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1994
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1994
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1994
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1979
- /usr/bin/grep
  grep xmrigMiner
  2⤵
  PID:1978
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1977
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1976
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1999
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2007
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2007
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2007
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2007
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1998
- /usr/bin/grep
  grep /var/tmp/java
  2⤵
  PID:1997
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:1996
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1995
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2013
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2019
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2019
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2019
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2019
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2012
- /usr/bin/grep
  grep ddgs
  2⤵
  PID:2011
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2010
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2009
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2024
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2032
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2032
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2032
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2032
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2023
- /usr/bin/grep
  grep qW3xT
  2⤵
  PID:2022
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2021
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:2020
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2037
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2053
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2053
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2053
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2053
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2036
- /usr/bin/grep
  grep t00ls.ru
  2⤵
  PID:2035
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2034
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2033
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2060
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2077
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2077
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2077
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2077
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2059
- /usr/bin/grep
  grep /var/tmp/sustes
  2⤵
  PID:2058
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2057
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2056
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2083
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2084
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2084
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2084
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2084
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2082
- /usr/bin/grep
  grep ld-linux
  2⤵
  PID:2081
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2080
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2079
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2088
- - /usr/local/sbin/kill
    kill -9 2086
    3⤵
    PID:2089
- - /usr/local/bin/kill
    kill -9 2086
    3⤵
    PID:2089
- - /usr/sbin/kill
    kill -9 2086
    3⤵
    PID:2089
- - /usr/bin/kill
    kill -9 2086
    3⤵
    PID:2089
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2087
- /usr/bin/grep
  grep xiaoyao
  2⤵
  PID:2086
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2085
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2093
- - /usr/local/sbin/kill
    kill -9 2091
    3⤵
    PID:2094
- - /usr/local/bin/kill
    kill -9 2091
    3⤵
    PID:2094
- - /usr/sbin/kill
    kill -9 2091
    3⤵
    PID:2094
- - /usr/bin/kill
    kill -9 2091
    3⤵
    PID:2094
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2092
- /usr/bin/grep
  grep Donald
  2⤵
  PID:2091
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2090
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2098
- - /usr/local/sbin/kill
    kill -9 2096
    3⤵
    PID:2099
- - /usr/local/bin/kill
    kill -9 2096
    3⤵
    PID:2099
- - /usr/sbin/kill
    kill -9 2096
    3⤵
    PID:2099
- - /usr/bin/kill
    kill -9 2096
    3⤵
    - Reads CPU attributes
    PID:2099
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2097
- /usr/bin/grep
  grep Macron
  2⤵
  PID:2096
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2095
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2103
- - /usr/local/sbin/kill
    kill -9 2101
    3⤵
    PID:2104
- - /usr/local/bin/kill
    kill -9 2101
    3⤵
    PID:2104
- - /usr/sbin/kill
    kill -9 2101
    3⤵
    PID:2104
- - /usr/bin/kill
    kill -9 2101
    3⤵
    PID:2104
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2102
- /usr/bin/grep
  grep ld-linux
  2⤵
  PID:2101
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2100
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2108
- - /usr/local/sbin/kill
    kill -9 2106
    3⤵
    PID:2109
- - /usr/local/bin/kill
    kill -9 2106
    3⤵
    PID:2109
- - /usr/sbin/kill
    kill -9 2106
    3⤵
    PID:2109
- - /usr/bin/kill
    kill -9 2106
    3⤵
    - Reads CPU attributes
    PID:2109
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2107
- /usr/bin/grep
  grep named
  2⤵
  PID:2106
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2105
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2113
- - /usr/local/sbin/kill
    kill -9 2111
    3⤵
    PID:2114
- - /usr/local/bin/kill
    kill -9 2111
    3⤵
    PID:2114
- - /usr/sbin/kill
    kill -9 2111
    3⤵
    PID:2114
- - /usr/bin/kill
    kill -9 2111
    3⤵
    - Reads CPU attributes
    PID:2114
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2112
- /usr/bin/grep
  grep kernelcfg
  2⤵
  PID:2111
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2110
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2118
- - /usr/local/sbin/kill
    kill -9 2116
    3⤵
    PID:2119
- - /usr/local/bin/kill
    kill -9 2116
    3⤵
    PID:2119
- - /usr/sbin/kill
    kill -9 2116
    3⤵
    PID:2119
- - /usr/bin/kill
    kill -9 2116
    3⤵
    PID:2119
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2117
- /usr/bin/grep
  grep xiaoxue
  2⤵
  PID:2116
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2115
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2123
- - /usr/local/sbin/kill
    kill -9 2121
    3⤵
    PID:2124
- - /usr/local/bin/kill
    kill -9 2121
    3⤵
    PID:2124
- - /usr/sbin/kill
    kill -9 2121
    3⤵
    PID:2124
- - /usr/bin/kill
    kill -9 2121
    3⤵
    PID:2124
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2122
- /usr/bin/grep
  grep kernelupgrade
  2⤵
  PID:2121
- /usr/bin/ps
  ps auxf
  2⤵
  PID:2120
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2128
- - /usr/local/sbin/kill
    kill -9 2126
    3⤵
    PID:2129
- - /usr/local/bin/kill
    kill -9 2126
    3⤵
    PID:2129
- - /usr/sbin/kill
    kill -9 2126
    3⤵
    PID:2129
- - /usr/bin/kill
    kill -9 2126
    3⤵
    PID:2129
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2127
- /usr/bin/grep
  grep kernelorg
  2⤵
  PID:2126
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2125
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2133
- - /usr/local/sbin/kill
    kill -9 2131
    3⤵
    PID:2134
- - /usr/local/bin/kill
    kill -9 2131
    3⤵
    PID:2134
- - /usr/sbin/kill
    kill -9 2131
    3⤵
    PID:2134
- - /usr/bin/kill
    kill -9 2131
    3⤵
    - Reads CPU attributes
    PID:2134
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2132
- /usr/bin/grep
  grep kernelupdates
  2⤵
  PID:2131
- /usr/bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:2130
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2142
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2143
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2143
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2143
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2143
- /usr/bin/grep
  grep "\\-c"
  2⤵
  PID:2141
- /usr/bin/grep
  grep -v headless
  2⤵
  PID:2140
- /usr/bin/grep
  grep -v httpPort
  2⤵
  PID:2139
- /usr/bin/grep
  grep jenkins
  2⤵
  PID:2138
- /usr/bin/grep
  grep lib
  2⤵
  PID:2137
- /usr/bin/grep
  grep var
  2⤵
  PID:2136
- /usr/bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:2135
- /usr/bin/xargs
  xargs pkill -f
  2⤵
  PID:2146
- - /usr/local/sbin/pkill
    pkill -f
    3⤵
    PID:2147
- - /usr/local/bin/pkill
    pkill -f
    3⤵
    PID:2147
- - /usr/sbin/pkill
    pkill -f
    3⤵
    PID:2147
- - /usr/bin/pkill
    pkill -f
    3⤵
    - Reads CPU attributes
    PID:2147
- /usr/bin/grep
  grep -o "./[0-9]* -c"
  2⤵
  PID:2145
- /usr/bin/ps
  ps ax
  2⤵
  PID:2144
- /usr/bin/pkill
  pkill -f /usr/bin/.sshd
  2⤵
  - Reads CPU attributes
  PID:2148
- /usr/bin/pkill
  pkill -f acpid
  2⤵
  PID:2149
- /usr/bin/pkill
  pkill -f Donald
  2⤵
  - Reads CPU attributes
  PID:2150
- /usr/bin/pkill
  pkill -f Macron
  2⤵
  PID:2151
- /usr/bin/pkill
  pkill -f AnXqV.yam
  2⤵
  - Reads CPU attributes
  PID:2152
- /usr/bin/pkill
  pkill -f apaceha
  2⤵
  PID:2153
- /usr/bin/pkill
  pkill -f askdljlqw
  2⤵
  - Reads CPU attributes
  PID:2154
- /usr/bin/pkill
  pkill -f bashe
  2⤵
  PID:2155
- /usr/bin/pkill
  pkill -f bashf
  2⤵
  PID:2156
- /usr/bin/pkill
  pkill -f bashg
  2⤵
  - Reads runtime system information
  PID:2157
- /usr/bin/pkill
  pkill -f bashh
  2⤵
  - Reads runtime system information
  PID:2158
- /usr/bin/pkill
  pkill -f bashx
  2⤵
  - Reads CPU attributes
  PID:2159
- /usr/bin/pkill
  pkill -f BI5zj
  2⤵
  - Reads runtime system information
  PID:2160
- /usr/bin/pkill
  pkill -f biosetjenkins
  2⤵
  - Reads runtime system information
  PID:2161
- /usr/bin/pkill
  pkill -f bonn.sh
  2⤵
  PID:2162
- /usr/bin/pkill
  pkill -f bonns
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2163
- /usr/bin/pkill
  pkill -f conn.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2164
- /usr/bin/pkill
  pkill -f conns
  2⤵
  PID:2165
- /usr/bin/pkill
  pkill -f cryptonight
  2⤵
  - Reads runtime system information
  PID:2166
- /usr/bin/pkill
  pkill -f crypto-pool
  2⤵
  - Reads runtime system information
  PID:2167
- /usr/bin/pkill
  pkill -f ddg.2011
  2⤵
  - Reads runtime system information
  PID:2168
- /usr/bin/pkill
  pkill -f deamon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2169
- /usr/bin/pkill
  pkill -f disk_genius
  2⤵
  - Reads CPU attributes
  PID:2170
- /usr/bin/pkill
  pkill -f donns
  2⤵
  - Reads runtime system information
  PID:2171
- /usr/bin/pkill
  pkill -f Duck.sh
  2⤵
  - Reads runtime system information
  PID:2172
- /usr/bin/pkill
  pkill -f gddr
  2⤵
  PID:2173
- /usr/bin/pkill
  pkill -f Guard.sh
  2⤵
  - Reads runtime system information
  PID:2174
- /usr/bin/pkill
  pkill -f i586
  2⤵
  - Reads runtime system information
  PID:2175
- /usr/bin/pkill
  pkill -f icb5o
  2⤵
  - Reads CPU attributes
  PID:2176
- /usr/bin/pkill
  pkill -f ir29xc1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2177
- /usr/bin/pkill
  pkill -f irqba2anc1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2178
- /usr/bin/pkill
  pkill -f irqba5xnc1
  2⤵
  - Reads runtime system information
  PID:2179
- /usr/bin/pkill
  pkill -f irqbalanc1
  2⤵
  - Reads CPU attributes
  PID:2180
- /usr/bin/pkill
  pkill -f irqbalance
  2⤵
  PID:2181
- /usr/bin/pkill
  pkill -f irqbnc1
  2⤵
  PID:2182
- /usr/bin/pkill
  pkill -f JnKihGjn
  2⤵
  - Reads runtime system information
  PID:2183
- /usr/bin/pkill
  pkill -f jweri
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2184
- /usr/bin/pkill
  pkill -f kw.sh
  2⤵
  PID:2185
- /usr/bin/pkill
  pkill -f kworker34
  2⤵
  - Reads CPU attributes
  PID:2186
- /usr/bin/pkill
  pkill -f kxjd
  2⤵
  - Reads CPU attributes
  PID:2187
- /usr/bin/pkill
  pkill -f libapache
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2188
- /usr/bin/pkill
  pkill -f Loopback
  2⤵
  PID:2189
- /usr/bin/pkill
  pkill -f lx26
  2⤵
  - Reads CPU attributes
  PID:2190
- /usr/bin/pkill
  pkill -f mgwsl
  2⤵
  PID:2191
- /usr/bin/pkill
  pkill -f minerd
  2⤵
  - Reads CPU attributes
  PID:2192
- /usr/bin/pkill
  pkill -f minergate
  2⤵
  - Reads CPU attributes
  PID:2193
- /usr/bin/pkill
  pkill -f minexmr
  2⤵
  PID:2194
- /usr/bin/pkill
  pkill -f mixnerdx
  2⤵
  - Reads CPU attributes
  PID:2195
- /usr/bin/pkill
  pkill -f mstxmr
  2⤵
  PID:2196
- /usr/bin/pkill
  pkill -f nanoWatch
  2⤵
  - Reads runtime system information
  PID:2197
- /usr/bin/pkill
  pkill -f nopxi
  2⤵
  PID:2198
- /usr/bin/pkill
  pkill -f NXLAi
  2⤵
  PID:2199
- /usr/bin/pkill
  pkill -f performedl
  2⤵
  PID:2200
- /usr/bin/pkill
  pkill -f polkitd
  2⤵
  - Reads runtime system information
  PID:2201
- /usr/bin/pkill
  pkill -f pro.sh
  2⤵
  PID:2202
- /usr/bin/pkill
  pkill -f pythno
  2⤵
  - Reads CPU attributes
  PID:2203
- /usr/bin/pkill
  pkill -f qW3xT.2
  2⤵
  PID:2204
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  PID:2205
- /usr/bin/pkill
  pkill -f stratum
  2⤵
  PID:2206
- /usr/bin/pkill
  pkill -f sustes
  2⤵
  - Reads CPU attributes
  PID:2207
- /usr/bin/pkill
  pkill -f wnTKYg
  2⤵
  - Reads runtime system information
  PID:2208
- /usr/bin/pkill
  pkill -f XbashY
  2⤵
  PID:2209
- /usr/bin/pkill
  pkill -f XJnRj
  2⤵
  - Reads CPU attributes
  PID:2210
- /usr/bin/pkill
  pkill -f xmrig
  2⤵
  - Reads runtime system information
  PID:2211
- /usr/bin/pkill
  pkill -f xmrigDaemon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2212
- /usr/bin/pkill
  pkill -f xmrigMiner
  2⤵
  - Reads CPU attributes
  PID:2213
- /usr/bin/pkill
  pkill -f ysaydh
  2⤵
  - Reads CPU attributes
  PID:2214
- /usr/bin/pkill
  pkill -f zigw
  2⤵
  - Reads CPU attributes
  PID:2215
- /usr/bin/pkill
  pkill -f ld-linux
  2⤵
  - Reads runtime system information
  PID:2216
- /usr/bin/pkill
  pkill -f xrx
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2217
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:2221
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2220
- /usr/bin/grep
  grep crond
  2⤵
  PID:2219
- /usr/bin/ps
  ps ax
  2⤵
  PID:2218
- /usr/bin/rm
  rm /tmp/crondpid -f
  2⤵
  PID:2222
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2225
- /usr/bin/grep
  grep sshd
  2⤵
  PID:2224
- /usr/bin/ps
  ps ax
  2⤵
  PID:2223
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:2226
- /usr/bin/rm
  rm -f /tmp/ssdpid
  2⤵
  PID:2233
- /usr/bin/grep
  grep -v grep
  2⤵
  PID:2236
- /usr/bin/grep
  grep syslogs
  2⤵
  PID:2235
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:2237
- /usr/bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2234
- /usr/bin/rm
  rm /tmp/syslogspid -f
  2⤵
  PID:2238
- /usr/bin/grep
  grep "b 22"
  2⤵
  PID:2240
- /usr/bin/ps
  ps x
  2⤵
  - Reads runtime system information
  PID:2239
- /usr/bin/awk
  awk "{print \$1,\$5}"
  2⤵
  PID:2241
- /usr/bin/cat
  cat .procs
  2⤵
  PID:2242
- /usr/bin/chattr
  chattr -iaR /var/tmp/.xrx
  2⤵
  - Attempts to change immutable files
  PID:2253
- /usr/bin/rm
  rm -rf /var/tmp/.xrx
  2⤵
  PID:2254
- /usr/bin/awk
  awk "{print \$1,\$5}"
  2⤵
  PID:2257
- /usr/bin/grep
  grep "d 22"
  2⤵
  PID:2256
- /usr/bin/ps
  ps x
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2255
- /usr/bin/cat
  cat .procs
  2⤵
  PID:2258
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2273
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2274
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2274
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2274
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2274
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2272
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2271
- /usr/bin/grep
  grep 69.28.55.86:443
  2⤵
  PID:2270
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2279
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2280
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2280
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2280
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2280
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2278
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2277
- /usr/bin/grep
  grep 185.71.65.238
  2⤵
  PID:2276
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2285
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2286
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2286
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2286
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2286
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2284
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2283
- /usr/bin/grep
  grep 140.82.52.87
  2⤵
  PID:2282
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2291
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2292
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2292
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2292
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2292
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2290
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2289
- /usr/bin/grep
  grep 119.9.76.107
  2⤵
  PID:2288
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2297
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2298
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2298
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2298
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2298
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2296
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2295
- /usr/bin/grep
  grep :143
  2⤵
  PID:2294
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2303
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2304
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2304
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2304
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2304
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2302
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2301
- /usr/bin/grep
  grep :2222
  2⤵
  PID:2300
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2309
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2310
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2310
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2310
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2310
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2308
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2307
- /usr/bin/grep
  grep :3333
  2⤵
  PID:2306
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2315
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2316
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2316
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2316
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2316
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2314
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2313
- /usr/bin/grep
  grep :3389
  2⤵
  PID:2312
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2321
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2322
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2322
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2322
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2322
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2320
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2319
- /usr/bin/grep
  grep :4444
  2⤵
  PID:2318
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2327
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2328
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2328
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2328
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2328
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2326
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2325
- /usr/bin/grep
  grep :5555
  2⤵
  PID:2324
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2333
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2334
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2334
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2334
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2334
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2332
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2331
- /usr/bin/grep
  grep :6666
  2⤵
  PID:2330
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2339
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2340
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2340
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2340
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2340
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2338
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2337
- /usr/bin/grep
  grep :6665
  2⤵
  PID:2336
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2345
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2346
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2346
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2346
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2346
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2344
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2343
- /usr/bin/grep
  grep :6667
  2⤵
  PID:2342
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2351
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2352
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2352
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2352
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2352
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2350
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2349
- /usr/bin/grep
  grep :7777
  2⤵
  PID:2348
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2357
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2358
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2358
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2358
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2358
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2356
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2355
- /usr/bin/grep
  grep :8444
  2⤵
  PID:2354
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2363
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2364
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2364
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2364
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2364
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2362
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2361
- /usr/bin/grep
  grep :3347
  2⤵
  PID:2360
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2369
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2370
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2370
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2370
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2370
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2368
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2367
- /usr/bin/grep
  grep :14444
  2⤵
  PID:2366
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2375
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2376
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2376
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2376
- - /usr/bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:2376
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2374
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2373
- /usr/bin/grep
  grep :14433
  2⤵
  PID:2372
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2381
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2382
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2382
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2382
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2382
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2380
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2379
- /usr/bin/grep
  grep :13531
  2⤵
  PID:2378
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2387
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2388
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2388
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2388
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2388
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2386
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2385
- /usr/bin/grep
  grep 138.199.40.233:9137
  2⤵
  PID:2384
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:2393
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:2394
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:2394
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:2394
- - /usr/bin/kill
    kill -9
    3⤵
    PID:2394
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2392
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2391
- /usr/bin/grep
  grep 185.150.117.29
  2⤵
  PID:2390

/usr/bin/sed
sed -e "s/\\.[0-9]*//g"
1⤵
PID:2229

/usr/bin/grep
grep -v "%CPU"
1⤵
PID:2232

/usr/bin/ps
ps -p 564 -o "%cpu"
1⤵
- Reads CPU attributes
PID:2231

/usr/bin/awk
awk "{print \$1;}"
1⤵
PID:2246

/usr/bin/awk
awk "{print \$2;}"
1⤵
PID:2249

/usr/bin/wc
wc -c
1⤵
PID:2252

/usr/bin/awk
awk "{print \$1;}"
1⤵
PID:2262

/usr/bin/awk
awk "{print \$2;}"
1⤵
PID:2265

/usr/bin/wc
wc -c
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.rsync/a/.procs

Filesize
10B

MD5
805cf77bc5d8ee04e0ede06c5466aa75

SHA1
eb23977430b57e5550b6973f46261c2cd6a3e1c2

SHA256
9f70e3a294af86159ca00801969c67e41a931f4fdd297bdb777ac685134df08a

SHA512
bbe38881974c03367365d261fc123eb7648e3056bcd3de2826a4bb085b7aef78701f23ceb4f5b0869c9ce291d833f56d1ca6dc5bfaebfffedc6bc4ca55556316

Download Submit
/tmp/.rsync/a/.procs

Filesize
10B

MD5
472527528d45443e3a7203fd8a52a457

SHA1
caf26b0158a1f7768ff10b6efd73085ceb49e1af

SHA256
07981fe832a3248137dbef6c975003a500efcb05021891dbec30e6dc39955e55

SHA512
3c7994e6d9fad34b77173f165631e7fba2ee09da9a8c5066dd874599ea97caaa652a22009f6d1af5d2557847114bea826da026b4cd247a966e2561084e42fec9

Download Submit
/tmp/ssdpid

Filesize
4B

MD5
539e03f8562fd7a8caadd279773d98d1

SHA1
7472ddbcdb4be93eb685662a66baabd999fc896b

SHA256
a4a509e1f028f48cc823e734d1dcd446cf7605b70dc7d596706d677c1da63faa

SHA512
edda864c6169120209ccbdd554eef75c7070519a40ca8d3dadc26fd85ea22b342e06d41ca773fb693000849bfa67d0511dec8d59cfc7a877ea78fd6da3027628

Download Submit