| Source: Initial sample | Potential command found: service safedog stop >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rmmod sddev >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: sleep 3 |
| Source: Initial sample | Potential command found: killall -9 sdmonitor >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall sdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall udcenter >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall sdcmd >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall sdsvrd >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall sdacm >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/sd_uninstall >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/init.d/sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/init.d/safedog >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/init.d/sdboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/init.d/udboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc2.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc3.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc4.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc5.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc2.d/S99udboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc3.d/S99udboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc4.d/S99udboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc5.d/S99udboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc2.d/S99sdboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc3.d/S99sdboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc4.d/S99sdboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/rc5.d/S99sdboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdmonitor >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sd_autoexmn >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/runsdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/udboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/udcenter >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/udpro >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdalarm >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdsetos >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/safedog_uninstall >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /usr/bin/safedog >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /usr/bin/sdboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdstart >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdsvrd >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdwebdir >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdrtdefendupdate >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdcmd >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdtest >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdui >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sduibin >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdcloud >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/udinstall >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdacm >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/sdrepo >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/uduninstall >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /usr/bin/SDDownload >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/sdinfo.conf >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/udcenter.conf >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog/libs/safedog >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog/libs/sdcommon >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog/libs/sdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/cloudhelper >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/init.d/sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/init.d/rc2.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/init.d/rc3.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/init.d/rc4.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/init.d/rc5.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/rc2.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/rc3.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/rc4.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/rc5.d/S99sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog/sdcc/bin/sdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /usr/bin/sdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog/sdcc/script/runsdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /usr/bin/runsdcc >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog/sdcc/script/sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /usr/bin/sdccboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/safedog/logs/sdcc.log >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall udpro>/dev/null 2>&1 >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/safedog/sdcc/script/udboot >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/safedog/sdcc/bin/udcenter >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/safedog/sdcc/bin/udpro >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/safedog/sdcc/bin/sdalarm >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/safedog/server/script/sdsetos >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/safedog/script/safedog_uninstall >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -rf /etc/sd_uninstall/ >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall sduibin >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall -9 aegis_cli >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall -9 aegis_update >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall -9 AliYunDun >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall -9 AliHids >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: killall -9 AliYunDunUpdate >/dev/null 2>&1 |
| Source: Initial sample | Potential command found: rm -f /etc/init.d/aegis |
| Source: Initial sample | Potential command found: rm -f "/etc/runlevels/default/aegis" >/dev/null 2>&1; |
| Source: Initial sample | Potential command found: rm -f "/etc/rc2.d/S80aegis" |
| Source: Initial sample | Potential command found: rm -f "/etc/rc3.d/S80aegis" |
| Source: Initial sample | Potential command found: rm -f "/etc/rc4.d/S80aegis" |
| Source: Initial sample | Potential command found: rm -f "/etc/rc5.d/S80aegis" |
| Source: Initial sample | Potential command found: rm -f "/etc/rc.d/rc2.d/S80aegis" |
| Source: Initial sample | Potential command found: rm -f "/etc/rc.d/rc3.d/S80aegis" |
| Source: Initial sample | Potential command found: rm -f "/etc/rc.d/rc4.d/S80aegis" |
| Source: Initial sample | Potential command found: rm -f "/etc/rc.d/rc5.d/S80aegis" |
| Source: /bin/bash (PID: 19341) | Grep executable: /bin/grep -> grep PING |
| Source: /bin/bash (PID: 19384) | Grep executable: /bin/grep -> grep [Cc]ent[Oo][Ss] |
| Source: /bin/bash (PID: 19400) | Grep executable: /bin/grep -> grep [Uu]buntu |
| Source: /bin/bash (PID: 19468) | Grep executable: /bin/grep -> grep PING |
| Source: /bin/bash (PID: 19499) | Grep executable: /bin/grep -> grep [Cc]ent[Oo][Ss] |
| Source: /bin/bash (PID: 19501) | Grep executable: /bin/grep -> grep [Uu]buntu |
| Source: /bin/bash (PID: 19504) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19505) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19513) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19514) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19548) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19549) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19565) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19566) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19585) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19586) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19618) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19619) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19640) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19641) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19677) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19678) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19709) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19710) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19749) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19750) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19764) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19765) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19797) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19798) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19828) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19829) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19864) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19865) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19884) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19885) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19916) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19917) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19949) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19950) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 19981) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 19982) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20016) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20017) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20050) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20051) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20082) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20083) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20114) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20115) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20148) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20149) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20179) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20180) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20211) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20212) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20226) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20227) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20257) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20258) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20281) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20282) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20313) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20314) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20333) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20337) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20366) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20367) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20401) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20402) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20435) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20436) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20463) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20464) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20481) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20482) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20516) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20517) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20551) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20552) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20565) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20566) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20600) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20601) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20625) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20626) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20647) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20648) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20680) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20681) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20716) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20717) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20727) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20728) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20760) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20761) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20782) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20783) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20816) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20817) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20830) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20831) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20865) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20866) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20900) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20901) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20933) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20934) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20953) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20954) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 20988) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 20989) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21000) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21001) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21033) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21034) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21058) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21059) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21072) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21073) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21111) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21112) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21125) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21126) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21165) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21166) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21197) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21198) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21216) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21217) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21229) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21230) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21253) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21254) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21282) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21283) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21313) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21314) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21354) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21355) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21389) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21390) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21420) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21421) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21436) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21437) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21468) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21469) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21489) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21490) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21512) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21513) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21545) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21546) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21582) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21583) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21613) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21614) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21646) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21647) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21669) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21670) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/bash (PID: 21696) | Grep executable: /bin/grep -> grep exe |
| Source: /bin/bash (PID: 21697) | Grep executable: /bin/grep -> grep /bin/bash |
| Source: /bin/sh (PID: 21723) | Grep executable: /bin/grep -> grep -v , |
| Source: /bin/sh (PID: 21794) | Grep executable: /bin/grep -> grep , |
| Source: /bin/sh (PID: 21801) | Grep executable: /bin/grep -> grep , |
| Source: /bin/sh (PID: 21816) | Grep executable: /bin/grep -> grep -o [0-9]\\{1,3\\}\\.[0-9]\\{1,3\\}\\.[0-9]\\{1,3\\}\\.[0-9]\\{1,3\\} |
| Source: /bin/sh (PID: 21832) | Grep executable: /bin/grep -> grep -o [0-9]\\{1,3\\}\\.[0-9]\\{1,3\\}\\.[0-9]\\{1,3\\}\\.[0-9]\\{1,3\\} |
| Source: /bin/sh (PID: 21843) | Grep executable: /bin/grep -> grep ssh |
| Source: /bin/sh (PID: 21845) | Grep executable: /bin/grep -> grep -v - |
| Source: /bin/sh (PID: 21846) | Grep executable: /bin/grep -> grep -v / |
| Source: /bin/sh (PID: 21866) | Grep executable: /bin/grep -> grep ssh |
| Source: /bin/sh (PID: 21868) | Grep executable: /bin/grep -> grep -v - |
| Source: /bin/sh (PID: 21869) | Grep executable: /bin/grep -> grep -v / |
| Source: /bin/sh (PID: 21887) | Grep executable: /bin/grep -> grep ssh |
| Source: /bin/sh (PID: 21889) | Grep executable: /bin/grep -> grep -v - |
| Source: /bin/sh (PID: 21890) | Grep executable: /bin/grep -> grep -v / |
| Source: /bin/sh (PID: 21909) | Grep executable: /bin/grep -> grep ssh |
| Source: /bin/sh (PID: 21911) | Grep executable: /bin/grep -> grep -v - |
| Source: /bin/sh (PID: 21912) | Grep executable: /bin/grep -> grep -v / |
| Source: /bin/sh (PID: 21930) | Grep executable: /bin/grep -> grep -v 127.0.0.1 |
| Source: /bin/sh (PID: 21931) | Grep executable: /bin/grep -> grep -v localhost |
| Source: /bin/bash (PID: 22249) | Grep executable: /bin/grep -> grep /usr/lib/.../diskmanagerd |
| Source: /bin/bash (PID: 22250) | Grep executable: /bin/grep -> grep -v grep |
| Source: /bin/bash (PID: 22539) | Grep executable: /bin/grep -> grep /etc/cron.hourly/gcc4lef.sh |
| Source: /bin/bash (PID: 22541) | Grep executable: /bin/grep -> grep -v grep |
| Source: /bin/bash (PID: 22612) | Grep executable: /bin/grep -> grep c04dceb4c769b2c8823cbf39f3055e6d |
| Source: /bin/bash (PID: 22650) | Grep executable: /bin/grep -> grep ad593f6a17598bdd12fd3bd0f3b2a925 |
| Source: /bin/bash (PID: 23709) | Grep executable: /bin/grep -> grep -ao ver= /tmp/vxbkyxrlq2hly2s |
| Source: /bin/bash (PID: 23737) | Grep executable: /bin/grep -> grep -ao ver= /tmp/vxbkyxrlq2hly2s |
| Source: /bin/bash (PID: 23764) | Grep executable: /bin/grep -> grep -ao ver= /tmp/vxbkyxrlq2hly2s |
| Source: /bin/bash (PID: 23793) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23796) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23799) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23805) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23819) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23845) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23857) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23868) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23876) | Grep executable: /bin/grep -> grep Content-Length: |
| Source: /bin/bash (PID: 23893) | Grep executable: /bin/grep -> grep -ao ver= /tmp/vxbkyxrlq2hly2s |
| Source: /bin/bash (PID: 23900) | Grep executable: /bin/grep -> grep -ao ver=1.0 /tmp/vxbkyxrlq2hly2s |
| Source: /bin/bash (PID: 23927) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 23948) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 23954) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 23986) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 23989) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 23995) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24037) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24045) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24079) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24090) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24119) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24127) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24156) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24174) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24195) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24198) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: /bin/bash (PID: 24212) | Grep executable: /bin/grep -> grep /usr/lib/.../kacpi_notify |
| Source: 1EC6U55yrZ | safedog: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | aegis: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | yunsuo: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | clamd: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | avast: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | avgd: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | cmdavd: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | cmdmgd: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | drweb-configd: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | drweb-spider-kmod: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | esets: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | xmirrord: ServiceNameArray=("safedog" "aegis" "yunsuo" "clamd" "avast" "avgd" "cmdavd" "cmdmgd" "drweb-configd" "drweb-spider-kmod" "esets" "xmirrord") |
| Source: 1EC6U55yrZ | safedog: "safedog" ) |
| Source: 1EC6U55yrZ | safedog: service safedog stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /etc/init.d/safedog >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /usr/bin/safedog_uninstall >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /usr/bin/safedog >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog/libs/safedog >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog/libs/sdcommon >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog/libs/sdcc >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog/sdcc/bin/sdcc >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog/sdcc/script/runsdcc >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog/sdcc/script/sdccboot >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -rf /etc/safedog/logs/sdcc.log >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /etc/safedog/sdcc/script/udboot >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /etc/safedog/sdcc/bin/udcenter >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /etc/safedog/sdcc/bin/udpro >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /etc/safedog/sdcc/bin/sdalarm >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /etc/safedog/server/script/sdsetos >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | safedog: rm -f /etc/safedog/script/safedog_uninstall >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | aegis: "aegis" ) |
| Source: 1EC6U55yrZ | aegis: killall -9 aegis_cli >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | aegis: killall -9 aegis_update >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | aegis: /etc/init.d/aegis stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | aegis: /etc/init.d/aegis uninstall >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | aegis: rm -f /etc/init.d/aegis |
| Source: 1EC6U55yrZ | aegis: rc-update del aegis default 2>/dev/null |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/runlevels/default/aegis" >/dev/null 2>&1; |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc2.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc3.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc4.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc5.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc.d/rc2.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc.d/rc3.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc.d/rc4.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -f "/etc/rc.d/rc5.d/S80aegis" |
| Source: 1EC6U55yrZ | aegis: rm -rf /usr/local/aegis/aegis_client |
| Source: 1EC6U55yrZ | aegis: rm -rf /usr/local/aegis/aegis_update |
| Source: 1EC6U55yrZ | aegis: rm -rf /usr/local/aegis/alihids |
| Source: 1EC6U55yrZ | yunsuo: "yunsuo" ) |
| Source: 1EC6U55yrZ | yunsuo: service yunsuo stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | yunsuo: /etc/init.d/yunsuo stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | yunsuo: rm -f /etc/init.d/yunsuo |
| Source: 1EC6U55yrZ | yunsuo: echo y | /usr/local/yunsuo_agent/uninstall >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | clamd: "clamd" ) |
| Source: 1EC6U55yrZ | clamd: service clamd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | clamd: /etc/init.d/clamd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | clamav: yum -y remove clamav * >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | clamav: dpkg -remove clamav * >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | clamav: dpkg --remove clamav * >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | clamav: dpkg -remove `dpkg -l | grep clamav | awk '{print $2}'` >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | clamav: dpkg --remove `dpkg -l | grep clamav | awk '{print $2}'` >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avast: "avast" ) |
| Source: 1EC6U55yrZ | avast: service avast stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avast: /etc/init.d/avast stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avast: rpm -e avast >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avast: dpkg -remove avast * >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avast: dpkg --remove avast * >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avast: dpkg -remove `dpkg -l | grep avast | awk '{print $2}'` >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avast: dpkg --remove `dpkg -l | grep avast | awk '{print $2}'` >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avgd: "avgd" ) |
| Source: 1EC6U55yrZ | avgd: service avgd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avgd: /etc/init.d/avgd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | avgd: rpm -e avgd >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | cmdavd: "cmdavd" ) |
| Source: 1EC6U55yrZ | cmdavd: service cmdavd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | cmdmgd: service cmdmgd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | cmdavd: /etc/init.d/cmdavd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | cmdmgd: /etc/init.d/cmdmgd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | cmdmgd: "cmdmgd" ) |
| Source: 1EC6U55yrZ | drweb-configd: "drweb-configd" ) |
| Source: 1EC6U55yrZ | drweb-spider-kmod: service drweb-spider-kmod stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | drweb-configd: service drweb-configd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | drweb-spider-kmod: /etc/init.d/drweb-spider-kmod stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | drweb-configd: /etc/init.d/drweb-configd stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | drweb-spider-kmod: "drweb-spider-kmod" ) |
| Source: 1EC6U55yrZ | esets: "esets" ) |
| Source: 1EC6U55yrZ | esets: service esets stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | esets: /etc/init.d/esets stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | xmirrord: "xmirrord" ) |
| Source: 1EC6U55yrZ | xmirrord: service xmirrord stop >/dev/null 2>&1 |
| Source: 1EC6U55yrZ | xmirrord: /etc/init.d/xmirrord stop >/dev/null 2>&1 |
Play interactive tour
Edit tour
Is Dropped
Number of created Files
Is malicious
Internet