Analysis
- max time kernel
149s - max time network
138s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
13/09/2026, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
Resource
debian9-mipsel-20260513-en
General
- Target 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh
- Size 845KB
- Sample260913-v91azabl4s
- SHA256 5366dbec88d547b24d3673593331ead29bc87447fb688b494f9e604699e5f25c
- MD5 8f15aff4f18fa30fff48546c55ab0451
- SHA1 946110201a5e3d2715efa73ba04894fa34a38090
- SHA512 e2c80fc2e6474b38e03990854e951958d66e4a116cb967890fb54b18a70c60854eb33bb02ea9b3e3c9b465f273606d1105cfcf033b17afb1a911465fb43b2e18
- SSDEEP 24576:n4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfke0:l/o8ZatHiw5ycMVmKke0
- TLSH T14A052348E11B8C78ED4E3C8CE49EEFDD192420A28B55E1471A65346EBE347DC806B75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys bash - File and Directory Permissions Modification 1 TTPs 9 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 744 chmod 745 chmod 747 chmod 2546 Process not Found 2569 Process not Found 2575 Process not Found 2540 Process not Found 2543 Process not Found 2578 Process not Found - Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
pid Process 852 systemctl 785 systemctl 2145 Process not Found 2166 Process not Found 2311 Process not Found 2173 Process not Found 2178 Process not Found 2279 Process not Found 2593 Process not Found 2148 Process not Found 2312 Process not Found 785 systemctl 2154 Process not Found 2163 Process not Found 832 systemctl 785 systemctl 847 systemctl 2157 Process not Found 2171 Process not Found 785 systemctl 813 systemctl 2156 Process not Found 2162 Process not Found 2284 Process not Found 2289 Process not Found 2315 Process not Found 2318 Process not Found 2298 Process not Found 2306 Process not Found 2309 Process not Found 2310 Process not Found 2174 Process not Found 2152 Process not Found 2182 Process not Found 843 systemctl 813 systemctl 2175 Process not Found 825 systemctl 2292 Process not Found 2314 Process not Found 824 systemctl 834 systemctl 2166 Process not Found 813 systemctl 2145 Process not Found 2179 Process not Found 2313 Process not Found 2299 Process not Found 2160 Process not Found 2166 Process not Found 2317 Process not Found 2299 Process not Found 813 systemctl 2176 Process not Found 2166 Process not Found 2287 Process not Found 2279 Process not Found 845 systemctl 2153 Process not Found 2295 Process not Found 2165 Process not Found 2166 Process not Found 2299 Process not Found 2279 Process not Found - Executes dropped EXE 1 IoCs
ioc pid Process /etc/zzh 2574 bash - Flushes firewall rules 1 TTPs 6 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 2588 Process not Found 750 iptables 2582 Process not Found 2583 Process not Found 2584 Process not Found 2586 Process not Found - Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf bash - Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/crontab bash File opened for modification /etc/cron.daily/logrotate bash File opened for modification /etc/cron.hourly/0anacron bash File opened for modification /etc/cron.d/zzh bash -
description ioc Process File truncated /var/log/wtmp bash File truncated /var/log/secure bash -
pid Process 784 setenforce 1142 kill 1142 kill 1142 kill 1142 kill 1295 grep 1407 grep 1142 kill 1142 kill 1719 grep 1739 grep - Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.d/rc.local bash - Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
pid Process 1787 xargs 1901 Process not Found 2333 Process not Found 1064 xargs 1217 xargs 1706 xargs 1799 xargs 1167 xargs 1351 xargs 2156 Process not Found 857 xargs 1845 Process not Found 1849 Process not Found 1857 Process not Found 2190 Process not Found 2270 Process not Found 2274 Process not Found 2323 Process not Found 2577 Process not Found 1147 xargs 1593 xargs 1640 xargs 1658 xargs 1346 xargs 1474 xargs 1827 Process not Found 977 chattr 978 chattr 1575 xargs 1815 Process not Found 1823 Process not Found 1879 Process not Found 1889 Process not Found 984 chattr 1207 xargs 1302 xargs 2214 Process not Found 1652 xargs 936 xargs 1076 xargs 1272 xargs 1464 xargs 1646 xargs 1701 xargs 1811 Process not Found 2557 Process not Found 1052 xargs 1331 xargs 1454 xargs 1587 xargs 1833 Process not Found 757 chattr 964 xargs 1021 xargs 1424 xargs 1480 xargs 1616 xargs 1746 xargs 975 chattr 1622 xargs 1040 xargs 1553 xargs 1861 Process not Found 2230 Process not Found - Write file to user bin folder 6 IoCs
description ioc Process File opened for modification /usr/bin/ip6network bash File opened for modification /usr/bin/kswaped bash File opened for modification /usr/bin/irqbalanced bash File opened for modification /usr/bin/rctlcli bash File opened for modification /usr/bin/systemd-network bash File opened for modification /usr/bin/pamdicks bash - Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/top bash File opened for modification /bin/top Process not Found File opened for modification /bin/pstree bash File opened for modification /bin/pstree Process not Found File opened for modification /bin/ps bash File opened for modification /bin/ps Process not Found - Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
pid Process 723 base64 - Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1410 ps 1440 ps 1647 ps 1677 ps 1268 ps 1435 ps 1529 ps 1218 ps 1470 ps 1514 ps 1641 ps 960 ps 1183 ps 1203 ps 1238 ps 1420 ps 1491 ps 1509 ps 1544 ps 1549 ps 1564 ps 1697 ps 1122 ps 1198 ps 1223 ps 1554 ps 927 ps 947 ps 1112 ps 1188 ps 1337 ps 1606 ps 1629 ps 1193 ps 1352 ps 1465 ps 1373 ps 1450 ps 1395 ps 1455 ps 1117 ps 1233 ps 1288 ps 1332 ps 1415 ps 1425 ps 1132 ps 1378 ps 1682 ps 1273 ps 1342 ps 1368 ps 1524 ps 917 ps 1357 ps 932 ps 1248 ps 1486 ps 1137 ps 1263 ps 1298 ps 1430 ps 1208 ps 1278 ps - Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/14/cmdline ps File opened for reading /proc/meminfo ps File opened for reading /proc/76/status ps File opened for reading /proc/159/stat ps File opened for reading /proc/5/status Process not Found File opened for reading /proc/680/status Process not Found File opened for reading /proc/14/stat ps File opened for reading /proc/74/status ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/82/status Process not Found File opened for reading /proc/422/status Process not Found File opened for reading /proc/1/status Process not Found File opened for reading /proc/76/cmdline ps File opened for reading /proc/2/stat ps File opened for reading /proc/71/status ps File opened for reading /proc/258/cmdline ps File opened for reading /proc/73/stat ps File opened for reading /proc/380/cmdline ps File opened for reading /proc/21/status Process not Found File opened for reading /proc/2/status Process not Found File opened for reading /proc/71/status ps File opened for reading /proc/362/status ps File opened for reading /proc/71/status Process not Found File opened for reading /proc/258/status Process not Found File opened for reading /proc/11/status Process not Found File opened for reading /proc/9/cmdline Process not Found File opened for reading /proc/18/cmdline Process not Found File opened for reading /proc/4/status Process not Found File opened for reading /proc/76/status ps File opened for reading /proc/79/stat ps File opened for reading /proc/23/stat ps File opened for reading /proc/19/status ps File opened for reading /proc/79/stat ps File opened for reading /proc/109/status Process not Found File opened for reading /proc/82/cmdline Process not Found File opened for reading /proc/126/stat Process not Found File opened for reading /proc/159/status ps File opened for reading /proc/109/stat ps File opened for reading /proc/18/status ps File opened for reading /proc/169/status ps File opened for reading /proc/75/cmdline Process not Found File opened for reading /proc/71/cmdline Process not Found File opened for reading /proc/679/stat Process not Found File opened for reading /proc/670/status ps File opened for reading /proc/674/cmdline ps File opened for reading /proc/365/status ps File opened for reading /proc/6/cmdline Process not Found File opened for reading /proc/7/cmdline ps File opened for reading /proc/36/status ps File opened for reading /proc/24/status ps File opened for reading /proc/10/status ps File opened for reading /proc/711/status ps File opened for reading /proc/680/cmdline ps File opened for reading /proc/389/status Process not Found File opened for reading /proc/125/stat ps File opened for reading /proc/367/cmdline ps File opened for reading /proc/filesystems Process not Found File opened for reading /proc/36/status Process not Found File opened for reading /proc/17/status Process not Found File opened for reading /proc/71/status ps File opened for reading /proc/153/cmdline Process not Found File opened for reading /proc/712/stat ps - System Network Configuration Discovery 1 TTPs 7 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 971 chattr 982 chattr 1290 grep 1320 grep 1536 grep 2045 Process not Found 2589 Process not Found - Writes file to tmp directory 9 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/tmp.yweza43tM2/embedded.sh bash File opened for modification /tmp/svcguard bash File opened for modification /tmp/fileutl.message.EnoSM5 Process not Found File opened for modification /tmp/fileutl.message.4bV92F Process not Found File opened for modification /tmp/fileutl.message.qk3EDi Process not Found File opened for modification /tmp/dev/null bash File opened for modification /tmp/kdevtmpfsi bash File opened for modification /tmp/svcupdate bash File opened for modification /tmp/fileutl.message.YyLDYz Process not Found
Processes
-
/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/local/sbin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/local/bin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/sbin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/usr/bin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/sbin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵PID:715
-
/bin/bashbash /tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40_pre-append.sh1⤵
- Writes file to tmp directory
PID:715 -
/bin/mktempmktemp -d2⤵PID:720
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
PID:723
-
-
/usr/bin/python3python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "2⤵PID:724
-
-
/bin/chmodchmod +x /tmp/tmp.yweza43tM2/embedded.sh2⤵
- File and Directory Permissions Modification
PID:744
-
-
/bin/bashbash /tmp/tmp.yweza43tM2/embedded.sh1⤵
- Adds new SSH keys
- Executes dropped EXE
- Writes DNS configuration
- Creates/modifies Cron job
- Deletes log files
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:715 -
/bin/chmodchmod 777 /usr/bin/chattr2⤵
- File and Directory Permissions Modification
PID:745
-
-
/bin/chmodchmod 777 /bin/chattr2⤵
- File and Directory Permissions Modification
PID:747
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:748
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:749
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:750
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵PID:755
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵PID:756
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵
- Removes the immutable protection flag from a file
PID:757
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:758
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:759
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:760
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:761
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:762
-
-
/bin/syncsync2⤵PID:764
-
-
/bin/catcat /var/spool/cron/2⤵PID:765
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:766
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:767
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:768
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:769
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:770
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:771
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:772
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:773
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:774
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:775
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:776
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:777
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:778
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:779
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:780
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:781
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:783
-
-
/bin/psps aux2⤵PID:782
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:784
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:785
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:786
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:787
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:788
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
PID:790
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:791
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:792
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:793
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:794
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵PID:795
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:796
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
PID:797
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:798
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:799
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:800
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵PID:803
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:805
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
PID:807
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵PID:785
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:785
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Enumerates kernel/hardware configuration
PID:785
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Enumerates kernel/hardware configuration
PID:810
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:813
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:814
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:815
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:817
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:821
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
PID:820
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:824
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:825
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:828
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:829
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:832
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:834
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:836
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:838
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:840
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:843
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:845
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:847
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:813
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:813
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:813
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:813
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:813
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:813
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:852
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:856
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:853
-
-
/bin/grepgrep aegis2⤵PID:855
-
-
/bin/grepgrep -v grep2⤵PID:854
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:857
-
-
/bin/grepgrep Yun2⤵PID:865
-
-
/bin/grepgrep -v grep2⤵PID:864
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:863
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:866
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:867
-
-
/bin/grepgrep -v grep2⤵PID:873
-
-
/bin/grepgrep aegis2⤵PID:874
-
-
/usr/bin/xargsxargs dirname2⤵PID:876
-
/usr/local/sbin/dirnamedirname3⤵PID:881
-
-
/usr/local/bin/dirnamedirname3⤵PID:881
-
-
/usr/sbin/dirnamedirname3⤵PID:881
-
-
/usr/bin/dirnamedirname3⤵PID:881
-
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:872
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:875
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:877
-
/usr/local/sbin/rmrm -rf3⤵PID:884
-
-
/usr/local/bin/rmrm -rf3⤵PID:884
-
-
/usr/sbin/rmrm -rf3⤵PID:884
-
-
/usr/bin/rmrm -rf3⤵PID:884
-
-
/sbin/rmrm -rf3⤵PID:884
-
-
/bin/rmrm -rf3⤵PID:884
-
-
-
/bin/grepgrep hids2⤵PID:888
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:886
-
-
/usr/bin/xargsxargs dirname2⤵PID:890
-
/usr/local/sbin/dirnamedirname3⤵PID:893
-
-
/usr/local/bin/dirnamedirname3⤵PID:893
-
-
/usr/sbin/dirnamedirname3⤵PID:893
-
-
/usr/bin/dirnamedirname3⤵PID:893
-
-
-
/bin/grepgrep -v grep2⤵PID:887
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:889
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:891
-
/usr/local/sbin/rmrm -rf3⤵PID:895
-
-
/usr/local/bin/rmrm -rf3⤵PID:895
-
-
/usr/sbin/rmrm -rf3⤵PID:895
-
-
/usr/bin/rmrm -rf3⤵PID:895
-
-
/sbin/rmrm -rf3⤵PID:895
-
-
/bin/rmrm -rf3⤵PID:895
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:899
-
-
/bin/grepgrep -v grep2⤵PID:897
-
-
/bin/grepgrep cloudwalker2⤵PID:898
-
-
/bin/psps aux2⤵PID:896
-
-
/usr/bin/xargsxargs dirname2⤵PID:900
-
/usr/local/sbin/dirnamedirname3⤵PID:902
-
-
/usr/local/bin/dirnamedirname3⤵PID:902
-
-
/usr/sbin/dirnamedirname3⤵PID:902
-
-
/usr/bin/dirnamedirname3⤵PID:902
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:901
-
/usr/local/sbin/rmrm -rf3⤵PID:903
-
-
/usr/local/bin/rmrm -rf3⤵PID:903
-
-
/usr/sbin/rmrm -rf3⤵PID:903
-
-
/usr/bin/rmrm -rf3⤵PID:903
-
-
/sbin/rmrm -rf3⤵PID:903
-
-
/bin/rmrm -rf3⤵PID:903
-
-
-
/bin/grepgrep titanagent2⤵PID:906
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:909
-
/usr/local/sbin/rmrm -rf3⤵PID:911
-
-
/usr/local/bin/rmrm -rf3⤵PID:911
-
-
/usr/sbin/rmrm -rf3⤵PID:911
-
-
/usr/bin/rmrm -rf3⤵PID:911
-
-
/sbin/rmrm -rf3⤵PID:911
-
-
/bin/rmrm -rf3⤵PID:911
-
-
-
/bin/grepgrep -v grep2⤵PID:905
-
-
/usr/bin/xargsxargs dirname2⤵PID:908
-
/usr/local/sbin/dirnamedirname3⤵PID:910
-
-
/usr/local/bin/dirnamedirname3⤵PID:910
-
-
/usr/sbin/dirnamedirname3⤵PID:910
-
-
/usr/bin/dirnamedirname3⤵PID:910
-
-
-
/bin/psps aux2⤵PID:904
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:907
-
-
/bin/grepgrep edr2⤵PID:914
-
-
/bin/grepgrep -v grep2⤵PID:913
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:912
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:915
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:916
-
-
/bin/grepgrep -v grep2⤵PID:918
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:917
-
-
/bin/grepgrep aegis2⤵PID:919
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:920
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:921
-
-
/bin/grepgrep -v grep2⤵PID:923
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:922
-
-
/bin/grepgrep Yun2⤵PID:924
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:925
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:926
-
-
/bin/grepgrep hids2⤵PID:929
-
-
/bin/grepgrep -v grep2⤵PID:928
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:930
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:927
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:931
-
-
/bin/grepgrep -v grep2⤵PID:933
-
-
/bin/grepgrep edr2⤵PID:934
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:932
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:935
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:936
-
-
/bin/grepgrep cloudwalker2⤵PID:939
-
-
/bin/grepgrep -v grep2⤵PID:938
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:940
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:941
-
-
/bin/psps aux2⤵PID:937
-
-
/bin/grepgrep -v grep2⤵PID:943
-
-
/bin/grepgrep titanagent2⤵PID:944
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:942
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:945
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:946
-
-
/bin/grepgrep sgagent2⤵PID:949
-
-
/bin/grepgrep -v grep2⤵PID:948
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:950
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:947
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:951
-
-
/bin/grepgrep -v grep2⤵PID:953
-
-
/bin/grepgrep barad_agent2⤵PID:954
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:955
-
-
/bin/psps aux2⤵PID:952
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:956
-
-
/bin/grepgrep hostguard2⤵PID:962
-
-
/bin/grepgrep -v grep2⤵PID:961
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:963
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:960
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:964
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:965
-
-
/bin/sleepsleep 12⤵PID:966
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- System Network Configuration Discovery
PID:971
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵PID:973
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
PID:975
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
PID:977
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
PID:978
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵PID:980
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- System Network Configuration Discovery
PID:982
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
PID:984
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵PID:985
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵PID:986
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵PID:987
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵PID:989
-
-
/bin/sleepsleep 12⤵PID:991
-
-
/bin/rmrm -f /tmp/.null2⤵PID:1007
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:1009
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1014
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1015
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1016
-
-
/bin/grepgrep 194.87.139.1032⤵PID:1013
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1019
-
-
/bin/grepgrep 185.71.65.2382⤵PID:1018
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1020
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1021
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1026
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1025
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1027
-
-
/bin/grepgrep 140.82.52.872⤵PID:1024
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1032
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1034
-
-
/bin/grepgrep :232⤵PID:1030
-
-
/bin/grepgrep -v -2⤵PID:1033
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1031
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1038
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1037
-
-
/bin/grepgrep -v -2⤵PID:1039
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1040
-
-
/bin/grepgrep :1432⤵PID:1036
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1043
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1044
-
-
/bin/grepgrep -v -2⤵PID:1045
-
-
/bin/grepgrep :22222⤵PID:1042
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1046
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1049
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1050
-
-
/bin/grepgrep -v -2⤵PID:1051
-
-
/bin/grepgrep :33332⤵PID:1048
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1052
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1056
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1055
-
-
/bin/grepgrep :33892⤵PID:1054
-
-
/bin/grepgrep -v -2⤵PID:1057
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1058
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1061
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1062
-
-
/bin/grepgrep :55552⤵PID:1060
-
-
/bin/grepgrep -v -2⤵PID:1063
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1064
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1067
-
-
/bin/grepgrep :66662⤵PID:1066
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1068
-
-
/bin/grepgrep -v -2⤵PID:1069
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1070
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1073
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1074
-
-
/bin/grepgrep -v -2⤵PID:1075
-
-
/bin/grepgrep :66652⤵PID:1072
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1076
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1080
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1079
-
-
/bin/grepgrep -v -2⤵PID:1081
-
-
/bin/grepgrep :66672⤵PID:1078
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1082
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1085
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1086
-
-
/bin/grepgrep :77772⤵PID:1084
-
-
/bin/grepgrep -v -2⤵PID:1087
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1088
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1092
-
-
/bin/grepgrep -v -2⤵PID:1093
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1091
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1094
-
-
/bin/grepgrep :84442⤵PID:1090
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1097
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1098
-
-
/bin/grepgrep -v -2⤵PID:1099
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1100
-
-
/bin/grepgrep :33472⤵PID:1096
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1103
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1104
-
-
/bin/grepgrep :100082⤵PID:1102
-
-
/bin/grepgrep -v -2⤵PID:1105
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1106
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1110
-
-
/bin/grepgrep :135312⤵PID:1109
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1111
-
-
/bin/grepgrep -v grep2⤵PID:1108
-
-
/bin/grepgrep :33332⤵PID:1114
-
-
/bin/grepgrep -v grep2⤵PID:1113
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1115
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1116
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1112
-
-
/bin/grepgrep :55552⤵PID:1119
-
-
/bin/grepgrep -v grep2⤵PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1120
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1121
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1117
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1124
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1125
-
-
/bin/grepgrep -v grep2⤵PID:1123
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1126
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1122
-
-
/bin/grepgrep log_2⤵PID:1129
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1131
-
-
/bin/grepgrep -v grep2⤵PID:1128
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1130
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1127
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1135
-
-
/bin/grepgrep systemten2⤵PID:1134
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1136
-
-
/bin/grepgrep -v grep2⤵PID:1133
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1132
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1140
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1141
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
/bin/killkill -9 103⤵
- Disables SELinux
PID:1142
-
-
-
/bin/grepgrep netns2⤵PID:1139
-
-
/bin/grepgrep -v grep2⤵PID:1138
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1137
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1146
-
-
/bin/grepgrep voltuned2⤵PID:1145
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1147
-
-
/bin/grepgrep -v grep2⤵PID:1144
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1143
-
-
/bin/grepgrep darwin2⤵PID:1150
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1151
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1152
-
-
/bin/grepgrep -v grep2⤵PID:1149
-
-
/bin/psps aux2⤵PID:1148
-
-
/bin/grepgrep /tmp/dl2⤵PID:1155
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1156
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1157
-
-
/bin/grepgrep -v grep2⤵PID:1154
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1153
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1160
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1161
-
-
/bin/grepgrep -v grep2⤵PID:1159
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1162
-
-
/bin/psps aux2⤵PID:1158
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1166
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1165
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1167
-
-
/bin/grepgrep -v grep2⤵PID:1164
-
-
/bin/psps aux2⤵PID:1163
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1171
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1172
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1170
-
-
/bin/grepgrep -v grep2⤵PID:1169
-
-
/bin/psps aux2⤵PID:1168
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1176
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1175
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1177
-
-
/bin/grepgrep -v grep2⤵PID:1174
-
-
/bin/psps aux2⤵PID:1173
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1181
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1182
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1180
-
-
/bin/grepgrep -v grep2⤵PID:1179
-
-
/bin/psps aux2⤵PID:1178
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1186
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1187
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1185
-
-
/bin/grepgrep -v grep2⤵PID:1184
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1183
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1191
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1190
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1192
-
-
/bin/grepgrep -v grep2⤵PID:1189
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1188
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1196
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1197
-
-
/bin/grepgrep 45.76.122.922⤵PID:1195
-
-
/bin/grepgrep -v grep2⤵PID:1194
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1193
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1201
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1200
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1202
-
-
/bin/grepgrep -v grep2⤵PID:1199
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1198
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1206
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1207
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1205
-
-
/bin/grepgrep -v grep2⤵PID:1204
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1203
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1211
-
-
/bin/grepgrep 86s.jpg2⤵PID:1210
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1212
-
-
/bin/grepgrep -v grep2⤵PID:1209
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1208
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1215
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1216
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1217
-
-
/bin/grepgrep -v grep2⤵PID:1214
-
-
/bin/psps aux2⤵PID:1213
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1220
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1222
-
-
/bin/grepgrep -v grep2⤵PID:1219
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1221
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1218
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1226
-
-
/bin/grepgrep PuNY5tm22⤵PID:1225
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1227
-
-
/bin/grepgrep -v grep2⤵PID:1224
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1223
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1230
-
-
/bin/grepgrep -v grep2⤵PID:1229
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1231
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1232
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1228
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1236
-
-
/bin/grepgrep AgdgACUD2⤵PID:1235
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1237
-
-
/bin/grepgrep -v grep2⤵PID:1234
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1233
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1241
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1242
-
-
/bin/grepgrep uiZvwxG82⤵PID:1240
-
-
/bin/grepgrep -v grep2⤵PID:1239
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1247
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1246
-
-
/bin/grepgrep hahwNEdB2⤵PID:1245
-
-
/bin/grepgrep -v grep2⤵PID:1244
-
-
/bin/psps aux2⤵PID:1243
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1250
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1251
-
-
/bin/grepgrep -v grep2⤵PID:1249
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1252
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1257
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1255
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1256
-
-
/bin/grepgrep -v grep2⤵PID:1254
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1253
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1260
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1261
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1262
-
-
/bin/grepgrep -v grep2⤵PID:1259
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1258
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1265
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1266
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1267
-
-
/bin/grepgrep -v grep2⤵PID:1264
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1263
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1271
-
-
/bin/grepgrep zXcDajSs2⤵PID:1270
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1272
-
-
/bin/grepgrep -v grep2⤵PID:1269
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1268
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1276
-
-
/bin/grepgrep 3lmigMo2⤵PID:1275
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1277
-
-
/bin/grepgrep -v grep2⤵PID:1274
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1273
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1281
-
-
/bin/grepgrep AkMK4A22⤵PID:1280
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1282
-
-
/bin/grepgrep -v grep2⤵PID:1279
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1278
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1285
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1286
-
-
/bin/grepgrep -v grep2⤵PID:1284
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1287
-
-
/bin/psps aux2⤵PID:1283
-
-
/bin/grepgrep -v grep2⤵PID:1289
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1290
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1288
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1291
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1292
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1295
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1296
-
-
/bin/grepgrep -v grep2⤵PID:1294
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1297
-
-
/bin/psps aux2⤵PID:1293
-
-
/bin/grepgrep http_0xCC0312⤵PID:1300
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1301
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1302
-
-
/bin/grepgrep -v grep2⤵PID:1299
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1298
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1303
-
-
/bin/grepgrep http_0xCC0322⤵PID:1305
-
-
/bin/grepgrep -v grep2⤵PID:1304
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1307
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1306
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1311
-
-
/bin/grepgrep http_0xCC0332⤵PID:1310
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1312
-
-
/bin/grepgrep -v grep2⤵PID:1309
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1308
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1316
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1317
-
-
/bin/grepgrep C4iLM4L2⤵PID:1315
-
-
/bin/grepgrep -v grep2⤵PID:1314
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1313
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1321
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1320
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1322
-
-
/bin/grepgrep -v grep2⤵PID:1319
-
-
/bin/psps aux2⤵PID:1318
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1326
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1325
-
-
/bin/grepgrep -v grep2⤵PID:1324
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1323
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1330
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1329
-
-
/bin/grepgrep -v grep2⤵PID:1328
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1331
-
-
/bin/psps aux2⤵PID:1327
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1335
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1336
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1334
-
-
/bin/grepgrep -v grep2⤵PID:1333
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1332
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1340
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1339
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1341
-
-
/bin/grepgrep -v grep2⤵PID:1338
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1337
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1345
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1346
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1344
-
-
/bin/grepgrep -v grep2⤵PID:1343
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1342
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1350
-
-
/bin/grepgrep nqscheduler2⤵PID:1349
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1351
-
-
/bin/grepgrep -v grep2⤵PID:1348
-
-
/bin/psps aux2⤵PID:1347
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1355
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1354
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1356
-
-
/bin/grepgrep -v grep2⤵PID:1353
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1352
-
-
/bin/grepgrep "]"2⤵PID:1360
-
-
/bin/grepgrep -v aux2⤵PID:1359
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1361
-
-
/bin/grepgrep -v grep2⤵PID:1358
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1362
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1357
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1367
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1366
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1365
-
-
/bin/grepgrep -v grep2⤵PID:1364
-
-
/bin/psps aux2⤵PID:1363
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1371
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1370
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1372
-
-
/bin/grepgrep -v grep2⤵PID:1369
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1368
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1376
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1377
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1375
-
-
/bin/grepgrep -v grep2⤵PID:1374
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1373
-
-
/bin/grepgrep -v /2⤵PID:1380
-
-
/bin/grepgrep -v -2⤵PID:1381
-
-
/bin/grepgrep -v _2⤵PID:1382
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1383
-
-
/bin/grepgrep -v grep2⤵PID:1379
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1384
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1378
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1388
-
-
/bin/grepgrep "\\[^"2⤵PID:1387
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1389
-
-
/bin/grepgrep -v grep2⤵PID:1386
-
-
/bin/psps aux2⤵PID:1385
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1393
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1394
-
-
/bin/grepgrep rsync2⤵PID:1392
-
-
/bin/grepgrep -v grep2⤵PID:1391
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1390
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1398
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1399
-
-
/bin/grepgrep watchd0g2⤵PID:1397
-
-
/bin/grepgrep -v grep2⤵PID:1396
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1395
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1403
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1404
-
-
/bin/grepgrep -v grep2⤵PID:1401
-
-
/bin/psps aux2⤵PID:1400
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1402
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1407
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1408
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1409
-
-
/bin/grepgrep -v grep2⤵PID:1406
-
-
/bin/psps aux2⤵PID:1405
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1413
-
-
/bin/grepgrep /tmp/java2⤵PID:1412
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1414
-
-
/bin/grepgrep -v grep2⤵PID:1411
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1410
-
-
/bin/grepgrep gitee.com2⤵PID:1417
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1418
-
-
/bin/grepgrep -v grep2⤵PID:1416
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1419
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1415
-
-
/bin/grepgrep /tmp/java2⤵PID:1422
-
-
/bin/grepgrep -v grep2⤵PID:1421
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1423
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1424
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1420
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1428
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1427
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1429
-
-
/bin/grepgrep -v grep2⤵PID:1426
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1425
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1433
-
-
/bin/grepgrep 89.35.39.782⤵PID:1432
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1434
-
-
/bin/grepgrep -v grep2⤵PID:1431
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1430
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1438
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1439
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1437
-
-
/bin/grepgrep -v grep2⤵PID:1436
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1435
-
-
/bin/grepgrep kthrotlds2⤵PID:1442
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1443
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1444
-
-
/bin/grepgrep -v grep2⤵PID:1441
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1440
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1449
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1448
-
-
/bin/grepgrep ksoftirqds2⤵PID:1447
-
-
/bin/grepgrep -v grep2⤵PID:1446
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1445
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1453
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1454
-
-
/bin/grepgrep netdns2⤵PID:1452
-
-
/bin/grepgrep -v grep2⤵PID:1451
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1450
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1458
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1459
-
-
/bin/grepgrep watchdogs2⤵PID:1457
-
-
/bin/grepgrep -v grep2⤵PID:1456
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1455
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1462
-
-
/bin/grepgrep -v grep2⤵PID:1461
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1463
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1464
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1460
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1468
-
-
/bin/grepgrep kinsing2⤵PID:1467
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1469
-
-
/bin/grepgrep -v grep2⤵PID:1466
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1465
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1473
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1474
-
-
/bin/grepgrep redis22⤵PID:1472
-
-
/bin/grepgrep -v grep2⤵PID:1471
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1470
-
-
/bin/grepgrep -v aux2⤵PID:1477
-
-
/bin/grepgrep " ps"2⤵PID:1478
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1479
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1480
-
-
/bin/grepgrep -v grep2⤵PID:1476
-
-
/bin/psps aux2⤵PID:1475
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1485
-
-
/bin/grepgrep sync_supers2⤵PID:1483
-
-
/bin/grepgrep -v grep2⤵PID:1482
-
-
/bin/psps aux2⤵PID:1481
-
-
/usr/bin/cutcut -c 9-152⤵PID:1484
-
-
/usr/bin/cutcut -c 9-152⤵PID:1489
-
-
/bin/grepgrep cpuset2⤵PID:1488
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1490
-
-
/bin/grepgrep -v grep2⤵PID:1487
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1486
-
-
/bin/grepgrep "x]"2⤵PID:1494
-
-
/bin/grepgrep -v aux2⤵PID:1493
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1495
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1496
-
-
/bin/grepgrep -v grep2⤵PID:1492
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1491
-
-
/bin/grepgrep "sh] <"2⤵PID:1500
-
-
/bin/grepgrep -v aux2⤵PID:1499
-
-
/bin/grepgrep -v grep2⤵PID:1498
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1501
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1502
-
-
/bin/psps aux2⤵PID:1497
-
-
/bin/grepgrep -v aux2⤵PID:1505
-
-
/bin/grepgrep " \\[]"2⤵PID:1506
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1507
-
-
/bin/grepgrep -v grep2⤵PID:1504
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1508
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1503
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1511
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1512
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1513
-
-
/bin/grepgrep -v grep2⤵PID:1510
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1509
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1517
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1516
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1518
-
-
/bin/grepgrep -v grep2⤵PID:1515
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1514
-
-
/bin/grepgrep hahwNEdB2⤵PID:1521
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1523
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1522
-
-
/bin/grepgrep -v grep2⤵PID:1520
-
-
/bin/psps aux2⤵PID:1519
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1527
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1526
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1528
-
-
/bin/grepgrep -v grep2⤵PID:1525
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1524
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1532
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1531
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1533
-
-
/bin/grepgrep -v grep2⤵PID:1530
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1529
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1536
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1537
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1538
-
-
/bin/grepgrep -v grep2⤵PID:1535
-
-
/bin/psps aux2⤵PID:1534
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1542
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1543
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1541
-
-
/bin/grepgrep -v grep2⤵PID:1540
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1539
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1547
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1546
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1548
-
-
/bin/grepgrep -v grep2⤵PID:1545
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1544
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1552
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1553
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1551
-
-
/bin/grepgrep -v grep2⤵PID:1550
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1549
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1557
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1558
-
-
/bin/grepgrep sustse2⤵PID:1556
-
-
/bin/grepgrep -v grep2⤵PID:1555
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1554
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1562
-
-
/bin/grepgrep sustse32⤵PID:1561
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1563
-
-
/bin/grepgrep -v grep2⤵PID:1560
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1559
-
-
/bin/grepgrep mr.sh2⤵PID:1566
-
-
/bin/grepgrep wget2⤵PID:1567
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1568
-
-
/bin/grepgrep -v grep2⤵PID:1565
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1569
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1564
-
-
/bin/grepgrep curl2⤵PID:1573
-
-
/bin/grepgrep mr.sh2⤵PID:1572
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1574
-
-
/bin/grepgrep -v grep2⤵PID:1571
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1575
-
-
/bin/psps aux2⤵PID:1570
-
-
/bin/grepgrep 2mr.sh2⤵PID:1578
-
-
/bin/grepgrep wget2⤵PID:1579
-
-
/bin/grepgrep -v grep2⤵PID:1577
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1580
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1581
-
-
/bin/psps aux2⤵PID:1576
-
-
/bin/grepgrep curl2⤵PID:1585
-
-
/bin/grepgrep 2mr.sh2⤵PID:1584
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1586
-
-
/bin/grepgrep -v grep2⤵PID:1583
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1587
-
-
/bin/psps aux2⤵PID:1582
-
-
/bin/grepgrep cr5.sh2⤵PID:1590
-
-
/bin/grepgrep wget2⤵PID:1591
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1592
-
-
/bin/grepgrep -v grep2⤵PID:1589
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1593
-
-
/bin/psps aux2⤵PID:1588
-
-
/bin/grepgrep curl2⤵PID:1597
-
-
/bin/grepgrep cr5.sh2⤵PID:1596
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1598
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1595
-
-
/bin/psps aux2⤵PID:1594
-
-
/bin/grepgrep wget2⤵PID:1603
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1604
-
-
/bin/grepgrep logo9.jpg2⤵PID:1602
-
-
/bin/grepgrep -v grep2⤵PID:1601
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1605
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1600
-
-
/bin/grepgrep curl2⤵PID:1609
-
-
/bin/grepgrep logo9.jpg2⤵PID:1608
-
-
/bin/grepgrep -v grep2⤵PID:1607
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1610
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1611
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1606
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1615
-
-
/bin/grepgrep j2.conf2⤵PID:1614
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1616
-
-
/bin/grepgrep -v grep2⤵PID:1613
-
-
/bin/psps aux2⤵PID:1612
-
-
/bin/grepgrep wget2⤵PID:1620
-
-
/bin/grepgrep luk-cpu2⤵PID:1619
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1621
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1622
-
-
/bin/grepgrep -v grep2⤵PID:1618
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1617
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1627
-
-
/bin/grepgrep -v grep2⤵PID:1624
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1628
-
-
/bin/grepgrep luk-cpu2⤵PID:1625
-
-
/bin/grepgrep curl2⤵PID:1626
-
-
/bin/grepgrep wget2⤵PID:1632
-
-
/bin/grepgrep ficov2⤵PID:1631
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1633
-
-
/bin/grepgrep -v grep2⤵PID:1630
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1634
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1629
-
-
/bin/grepgrep curl2⤵PID:1638
-
-
/bin/grepgrep ficov2⤵PID:1637
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1639
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1640
-
-
/bin/grepgrep -v grep2⤵PID:1636
-
-
/bin/psps aux2⤵PID:1635
-
-
/bin/grepgrep he.sh2⤵PID:1643
-
-
/bin/grepgrep wget2⤵PID:1644
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1645
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1646
-
-
/bin/grepgrep -v grep2⤵PID:1642
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1641
-
-
/bin/grepgrep curl2⤵PID:1650
-
-
/bin/grepgrep he.sh2⤵PID:1649
-
-
/bin/grepgrep -v grep2⤵PID:1648
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1652
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1651
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1647
-
-
/bin/grepgrep wget2⤵PID:1656
-
-
/bin/grepgrep miner.sh2⤵PID:1655
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1657
-
-
/bin/grepgrep -v grep2⤵PID:1654
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1658
-
-
/bin/psps aux2⤵PID:1653
-
-
/bin/grepgrep curl2⤵PID:1662
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1663
-
-
/bin/grepgrep miner.sh2⤵PID:1661
-
-
/bin/grepgrep -v grep2⤵PID:1660
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1664
-
-
/bin/psps aux2⤵PID:1659
-
-
/bin/grepgrep wget2⤵PID:1668
-
-
/bin/grepgrep nullcrew2⤵PID:1667
-
-
/bin/grepgrep -v grep2⤵PID:1666
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1669
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1670
-
-
/bin/psps aux2⤵PID:1665
-
-
/bin/grepgrep curl2⤵PID:1674
-
-
/bin/grepgrep nullcrew2⤵PID:1673
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1675
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1676
-
-
/bin/grepgrep -v grep2⤵PID:1672
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1671
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1680
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1679
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1681
-
-
/bin/grepgrep -v grep2⤵PID:1678
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1677
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1685
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1686
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1684
-
-
/bin/grepgrep -v grep2⤵PID:1683
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1682
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1690
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1691
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1689
-
-
/bin/grepgrep -v grep2⤵PID:1688
-
-
/bin/psps aux2⤵PID:1687
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1695
-
-
/bin/grepgrep 144.217.45.452⤵PID:1694
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1696
-
-
/bin/grepgrep -v grep2⤵PID:1693
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1692
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1700
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1699
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1701
-
-
/bin/grepgrep -v grep2⤵PID:1698
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1697
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1705
-
-
/bin/grepgrep 176.31.6.162⤵PID:1704
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1706
-
-
/bin/grepgrep -v grep2⤵PID:1703
-
-
/bin/psps aux2⤵PID:1702
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1711
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1710
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1709
-
-
/bin/grepgrep -v grep2⤵PID:1708
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1707
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1714
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1715
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1716
-
-
/bin/grepgrep -v grep2⤵PID:1713
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1712
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1720
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1721
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1719
-
-
/bin/grepgrep -v grep2⤵PID:1718
-
-
/bin/psps auxf2⤵PID:1717
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1725
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1724
-
-
/bin/grepgrep -v grep2⤵PID:1723
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1726
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1722
-
-
/bin/grepPID:1729
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1730
-
-
/bin/grepgrep -v grep2⤵PID:1728
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1731
-
-
/bin/psps auxf2⤵PID:1727
-
-
/bin/grepgrep monerohash.com2⤵PID:1734
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1735
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1736
-
-
/bin/grepgrep -v grep2⤵PID:1733
-
-
/bin/psps auxf2⤵PID:1732
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1740
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1739
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1741
-
-
/bin/grepgrep -v grep2⤵PID:1738
-
-
/bin/psps auxf2⤵PID:1737
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1745
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1746
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1744
-
-
/bin/grepgrep -v grep2⤵PID:1743
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1742
-
-
/bin/grepgrep -v grep2⤵PID:1748
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1749
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1750
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1747
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1751
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1755
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1756
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1754
-
-
/bin/grepgrep -v grep2⤵PID:1753
-
-
/bin/psps auxf2⤵PID:1752
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1760
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1759
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1761
-
-
/bin/grepgrep -v grep2⤵PID:1758
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1757
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1765
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1764
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1766
-
-
/bin/grepgrep -v grep2⤵PID:1763
-
-
/bin/psps auxf2⤵PID:1762
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1770
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1769
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1771
-
-
/bin/grepgrep -v grep2⤵PID:1768
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1767
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1775
-
/usr/local/sbin/killkill -9 17733⤵PID:1776
-
-
/usr/local/bin/killkill -9 17733⤵PID:1776
-
-
/usr/sbin/killkill -9 17733⤵PID:1776
-
-
/usr/bin/killkill -9 17733⤵PID:1776
-
-
/sbin/killkill -9 17733⤵PID:1776
-
-
/bin/killkill -9 17733⤵PID:1776
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1774
-
-
/bin/grepgrep xiaoyao2⤵PID:1773
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1772
-
-
/bin/grepgrep xiaoxue2⤵PID:1778
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1779
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1780
-
/usr/local/sbin/killkill -9 17783⤵PID:1781
-
-
/usr/local/bin/killkill -9 17783⤵PID:1781
-
-
/usr/sbin/killkill -9 17783⤵PID:1781
-
-
/usr/bin/killkill -9 17783⤵PID:1781
-
-
/sbin/killkill -9 17783⤵PID:1781
-
-
/bin/killkill -9 17783⤵PID:1781
-
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1777
-
-
/bin/grepgrep 46.243.253.152⤵PID:1783
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1784
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1785
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1787
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1786
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1790
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1791
-
-
/bin/grepgrep 176.31.6.162⤵PID:1789
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1792
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1793
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1795
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1794
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1797
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1796
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1799
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1Clear Linux or Mac System Logs
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /bin/ps
- Size 13B
- SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
- MD5 3d47b8e895a71930bda5d4f3d8fc8589
- SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
- SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
- MD5 SHA1 SHA512
- Path /bin/ps
- Size 52B
- SHA256 db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
- MD5 f668da8f0525cbe5a545869cb5776913
- SHA1 996e6afed4498ff8a92a64330de018141af102c9
- SHA512 f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
- TLSH T16890028D05189D111A545D12A371AED5818458204B4397415478028E4191192316005E
- MD5 SHA1 SHA512 TLSH
- Path /bin/pstree
- Size 56B
- SHA256 b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
- MD5 896f6d504f181bd883a90b84069bcf70
- SHA1 86fd682d1932d9e14461796e5f0fe776b8ce9d5c
- SHA512 1f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
- TLSH T1B090028D452CAD101A544D12A3712E95C08428348B4397415468028B4152192313009E
- MD5 SHA1 SHA512 TLSH
- Path /bin/top
- Size 53B
- SHA256 561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
- MD5 6956a4d6a2444151c11a73517215cb34
- SHA1 b279ad496f640f44418aa7e5e27a4d458bddb7fb
- SHA512 ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
- TLSH T11990028D05189D101A548A11A3716E99908514248987AB815069018A4141193356015E
- MD5 SHA1 SHA512 TLSH
- Path /etc/cron.d/zzh
- Size 53B
- SHA256 ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
- MD5 3a615a3d1952b1e2c0cb584bd253f7f9
- SHA1 79465a5e611f19f140f169ac5bc3a9ab382696ef
- SHA512 8819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
- TLSH T1889002B6541558466804AD289604406E084355A111953A426DCD4490461C30F0517661
- MD5 SHA1 SHA512 TLSH
- Path /etc/crontab
- Size 50B
- SHA256 e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
- MD5 b2ecca8d419b5c3fa2ee7621efa75eb7
- SHA1 3adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
- SHA512 c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
- TLSH T19B9002B6541548466804EC189605605E0843956100553A426ECD4490461830E0116621
- MD5 SHA1 SHA512 TLSH
- Path /etc/zzhs
- Size 9B
- SHA256 7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
- MD5 970d39f8690eff0fe573e7bcf51bda9b
- SHA1 46f8f835d3d3d41f063d0e8346260bb622b01a3f
- SHA512 24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
- MD5 SHA1 SHA512
- Path /etc/zzhs
- Size 2B
- SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
- MD5 b026324c6904b2a9cb4b88d6d61c81d1
- SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
- SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 557B
- SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
- MD5 12bf68ad9999dcbc8bd1d9a728d600aa
- SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
- SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
- TLSH T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
- MD5 SHA1 SHA512 TLSH
- Path /tmp/tmp.yweza43tM2/embedded.sh
- Size 46KB
- SHA256 378297c7b1cd991b3c57c4b5d8404572c4f741048930a6a097c2f88d03d64889
- MD5 f2cee3906040db1df6d795c0e5fc0147
- SHA1 cd99312906fe89d01528b4e140c169e055e8d65c
- SHA512 cccd09d7f4b981afad13889189882f935d3e1e07a4115f3f7990c523943dcd2a6d32e85d4b8cb9be60d5b58bd390fcd64396f87f97c105fd641de6d7edaead61
- SSDEEP 768:xxlT2wDuWvWi7JFNcuFkc2zq0x3UKnicZuiR/amT8z:GwF+Lc2/FicfSmT8z
- TLSH T12423AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /usr/bin/irqbalanced
- Size 2B
- SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
- MD5 6d7fce9fee471194aa8b5b6e47267f03
- SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
- SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
- MD5 SHA1 SHA512
- Path /usr/bin/kswaped
- Size 2B
- SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
- MD5 26ab0db90d72e28ad0ba1e22ee510510
- SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
- SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
- MD5 SHA1 SHA512
- Path /usr/bin/pamdicks
- Size 2B
- SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
- MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
- SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
- SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
- MD5 SHA1 SHA512
- Path /usr/bin/rctlcli
- Size 2B
- SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
- MD5 48a24b70a0b376535542b996af517398
- SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
- SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
- MD5 SHA1 SHA512
- Path /usr/bin/systemd-network
- Size 2B
- SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
- MD5 1dcca23355272056f04fe8bf20edfce0
- SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
- SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
- MD5 SHA1 SHA512