4612796f8d7909642bac5713c3aa1be3cc5725131455ca95fa52546884f15e2a

Analysis

max time kernel
150s
max time network
21s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24/02/2025, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4612796f8d7909642bac5713c3aa1be3cc5725131455ca95fa52546884f15e2a.sh
Size

35KB
MD5

4dcc930330ed4fe1bbe4c91ba7f6e763
SHA1

ee72871d71e245c272f9d83f4f4a0aab2a1f414c
SHA256

4612796f8d7909642bac5713c3aa1be3cc5725131455ca95fa52546884f15e2a
SHA512

70f2edaf2fbf716ba93aa2d391b1af8633a59f676cfa95a85ca31e76aee16f59e08db142f1cf426353a5b933d77dacf39984ac6bcc34e177e38b604123b137e4
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNyt4uz:bOVF+D6cIwgosjz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
713	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
719	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1531	xargs
1622	xargs
1664	xargs
1682	xargs
1697	xargs
1830	xargs
1628	xargs
1640	xargs
1835	xargs
1996	xargs
2045	xargs
2081	xargs
2086	xargs
1467	xargs
1646	xargs
1688	xargs
1951	xargs
701	chattr
1616	xargs
1689	sed
1871	xargs
1911	xargs
2011	xargs
2001	xargs
1491	xargs
1694	xargs
1778	xargs
1825	xargs
1685	xargs
1698	sed
2016	xargs
1845	xargs
1886	xargs
1961	xargs
2071	xargs
1691	xargs
1941	xargs
1707	sed
1507	xargs
1513	xargs
1586	xargs
1866	xargs
1901	xargs
1686	sed
1704	sed
1815	xargs
1881	xargs
1676	xargs
1692	sed
1956	xargs
1461	xargs
1810	xargs
1986	xargs
744	chattr
1501	xargs
1716	sed
1991	xargs
2065	xargs
1525	xargs
1700	xargs
1856	xargs
2040	xargs
1683	sed
1861	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.KUTZ6G	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.bd7zEf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.iAAeyG	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.BAKvYY	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.NWnOHo	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.6Pr6vN	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.1vQrT5	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.FJMg3Z	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.T4phXg	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.cn9G1A	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.vtceK3	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.FJS7va	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.DUQNzk	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
2032	ps
1451	ps
1752	ps
1841	ps
1922	ps
1932	ps
2036	ps
2072	ps
1967	ps
2017	ps
1463	ps
1477	ps
1762	ps
1801	ps
2051	ps
2012	ps
1487	ps
1877	ps
1917	ps
1997	ps
2061	ps
1867	ps
1887	ps
2046	ps
2007	ps
1472	ps
1482	ps
1831	ps
1857	ps
1892	ps
1977	ps
2002	ps
1811	ps
1872	ps
1882	ps
1902	ps
1937	ps
2066	ps
2077	ps
2094	ps
1457	ps
1757	ps
1852	ps
1897	ps
1987	ps
2104	Process not Found
1826	ps
1862	ps
1972	ps
1468	ps
1992	ps
1821	ps
1816	ps
1947	ps
1952	ps
2082	ps
1527	ps
1912	ps
1942	ps
1957	ps
2027	ps
2041	ps
2099	Process not Found
1907	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/698/cmdline	pkill
File opened for reading	/proc/2059/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/333/stat	ps
File opened for reading	/proc/116/cmdline	ps
File opened for reading	/proc/339/stat	ps
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/697/status	ps
File opened for reading	/proc/75/status	ps
File opened for reading	/proc/166/cmdline	ps
File opened for reading	/proc/506/status	ps
File opened for reading	/proc/506/cmdline	pkill
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/1963/cmdline	ps
File opened for reading	/proc/37/cmdline	Process not Found
File opened for reading	/proc/333/status	pkill
File opened for reading	/proc/376/cmdline	pkill
File opened for reading	/proc/339/status	ps
File opened for reading	/proc/336/stat	ps
File opened for reading	/proc/36/stat	ps
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/72/stat	ps
File opened for reading	/proc/70/cmdline	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/506/stat	ps
File opened for reading	/proc/241/stat	ps
File opened for reading	/proc/1528/status	ps
File opened for reading	/proc/105/stat	ps
File opened for reading	/proc/339/cmdline	ps
File opened for reading	/proc/1942/stat	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/506/status	ps
File opened for reading	/proc/333/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/697/cmdline	ps
File opened for reading	/proc/105/status	ps
File opened for reading	/proc/1475/cmdline	ps
File opened for reading	/proc/1855/stat	ps
File opened for reading	/proc/77/status	ps
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/1827/stat	ps
File opened for reading	/proc/115/status	ps
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/150/status	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/702/status	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/506/status	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/336/cmdline	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1407	ls
1999	grep
2029	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	4612796f8d7909642bac5713c3aa1be3cc5725131455ca95fa52546884f15e2a.sh

/tmp/4612796f8d7909642bac5713c3aa1be3cc5725131455ca95fa52546884f15e2a.sh
/tmp/4612796f8d7909642bac5713c3aa1be3cc5725131455ca95fa52546884f15e2a.sh
1⤵
- Writes file to tmp directory
PID:698
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:700
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:701
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:707
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  PID:709
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  PID:711
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:713
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:719
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:737
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNZQ-0000Bt-Fx
      4⤵
      Reads CPU attributes
      PID:746
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:740
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNZQ-0000Bw-FG
      4⤵
      Reads CPU attributes
      PID:745
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:741
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:742
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:743
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:744
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:747
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:748
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:749
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:750
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:752
- /bin/grep
  grep exe
  2⤵
  PID:753
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:755
- /bin/grep
  grep exe
  2⤵
  PID:758
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:757
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:762
- /bin/grep
  grep exe
  2⤵
  PID:765
- /bin/ls
  ls -latrh /proc/105
  2⤵
  PID:764
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:767
- /bin/grep
  grep exe
  2⤵
  PID:770
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:769
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:772
- /bin/grep
  grep exe
  2⤵
  PID:775
- /bin/ls
  ls -latrh /proc/115
  2⤵
  PID:774
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:777
- /bin/grep
  grep exe
  2⤵
  PID:780
- /bin/ls
  ls -latrh /proc/116
  2⤵
  PID:779
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:782
- /bin/grep
  grep exe
  2⤵
  PID:785
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:784
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:787
- /bin/grep
  grep exe
  2⤵
  PID:790
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:789
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:792
- /bin/grep
  grep exe
  2⤵
  PID:797
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:796
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:799
- /bin/grep
  grep exe
  2⤵
  PID:803
- /bin/ls
  ls -latrh /proc/144
  2⤵
  PID:802
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:806
- /bin/grep
  grep exe
  2⤵
  PID:809
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:808
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:812
- /bin/grep
  grep exe
  2⤵
  PID:816
- /bin/ls
  ls -latrh /proc/150
  2⤵
  PID:815
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:818
- /bin/grep
  grep exe
  2⤵
  PID:822
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:821
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:825
- /bin/grep
  grep exe
  2⤵
  PID:829
- /bin/ls
  ls -latrh /proc/166
  2⤵
  PID:828
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:832
- /bin/grep
  grep exe
  2⤵
  PID:835
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:834
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:838
- /bin/grep
  grep exe
  2⤵
  PID:842
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:841
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:844
- /bin/grep
  grep exe
  2⤵
  PID:848
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:847
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:851
- /bin/grep
  grep exe
  2⤵
  PID:854
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:853
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:858
- /bin/grep
  grep exe
  2⤵
  PID:861
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:860
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:864
- /bin/grep
  grep exe
  2⤵
  PID:868
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:870
- /bin/grep
  grep exe
  2⤵
  PID:874
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:873
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:880
- /bin/grep
  grep exe
  2⤵
  PID:883
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:882
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:886
- /bin/grep
  grep exe
  2⤵
  PID:890
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:889
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:892
- /bin/grep
  grep exe
  2⤵
  PID:896
- /bin/ls
  ls -latrh /proc/241
  2⤵
  PID:895
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:899
- /bin/grep
  grep exe
  2⤵
  PID:902
- /bin/ls
  ls -latrh /proc/3
  2⤵
  - Reads runtime system information
  PID:901
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:906
- /bin/grep
  grep exe
  2⤵
  PID:909
- /bin/ls
  ls -latrh /proc/329
  2⤵
  PID:908
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:912
- /bin/grep
  grep exe
  2⤵
  PID:916
- /bin/ls
  ls -latrh /proc/331
  2⤵
  PID:915
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:918
- /bin/grep
  grep exe
  2⤵
  PID:922
- /bin/ls
  ls -latrh /proc/333
  2⤵
  PID:921
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:927
- /bin/grep
  grep exe
  2⤵
  PID:930
- /bin/ls
  ls -latrh /proc/336
  2⤵
  PID:929
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:933
- /bin/grep
  grep exe
  2⤵
  PID:937
- /bin/ls
  ls -latrh /proc/339
  2⤵
  PID:936
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:942
- /bin/grep
  grep exe
  2⤵
  PID:946
- /bin/ls
  ls -latrh /proc/36
  2⤵
  PID:945
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:948
- /bin/grep
  grep exe
  2⤵
  PID:952
- /bin/ls
  ls -latrh /proc/37
  2⤵
  PID:951
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:955
- /bin/grep
  grep exe
  2⤵
  PID:958
- /bin/ls
  ls -latrh /proc/376
  2⤵
  PID:957
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:962
- /bin/grep
  grep exe
  2⤵
  PID:966
- /bin/ls
  ls -latrh /proc/377
  2⤵
  PID:965
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:968
- /bin/grep
  grep exe
  2⤵
  PID:972
- /bin/ls
  ls -latrh /proc/388
  2⤵
  PID:971
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:974
- /bin/grep
  grep exe
  2⤵
  PID:977
- /bin/ls
  ls -latrh /proc/391
  2⤵
  PID:976
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:979
- /bin/grep
  grep exe
  2⤵
  PID:983
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:982
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:985
- /bin/grep
  grep exe
  2⤵
  PID:988
- /bin/ls
  ls -latrh /proc/492
  2⤵
  PID:987
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:990
- /bin/grep
  grep exe
  2⤵
  PID:993
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:992
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:995
- /bin/grep
  grep exe
  2⤵
  PID:998
- /bin/ls
  ls -latrh /proc/506
  2⤵
  PID:997
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1000
- /bin/grep
  grep exe
  2⤵
  PID:1003
- /bin/ls
  ls -latrh /proc/547
  2⤵
  PID:1002
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1005
- /bin/grep
  grep exe
  2⤵
  PID:1008
- /bin/ls
  ls -latrh /proc/548
  2⤵
  PID:1007
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1010
- /bin/grep
  grep exe
  2⤵
  PID:1013
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:1012
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1015
- /bin/grep
  grep exe
  2⤵
  PID:1018
- /bin/ls
  ls -latrh /proc/676
  2⤵
  PID:1017
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1020
- /bin/grep
  grep exe
  2⤵
  PID:1023
- /bin/ls
  ls -latrh /proc/689
  2⤵
  PID:1022
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1025
- /bin/grep
  grep exe
  2⤵
  PID:1028
- /bin/ls
  ls -latrh /proc/690
  2⤵
  PID:1027
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1030
- /bin/grep
  grep exe
  2⤵
  PID:1033
- /bin/ls
  ls -latrh /proc/695
  2⤵
  PID:1032
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1035
- /bin/grep
  grep exe
  2⤵
  PID:1038
- /bin/ls
  ls -latrh /proc/696
  2⤵
  PID:1037
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1040
- /bin/ls
  ls -latrh /proc/697
  2⤵
  PID:1042
- /bin/grep
  grep exe
  2⤵
  PID:1043
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1045
- /bin/grep
  grep exe
  2⤵
  PID:1048
- /bin/ls
  ls -latrh /proc/698
  2⤵
  PID:1047
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1050
- /bin/grep
  grep exe
  2⤵
  PID:1053
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1052
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1055
- /bin/grep
  grep exe
  2⤵
  PID:1058
- /bin/ls
  ls -latrh /proc/70
  2⤵
  PID:1057
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1060
- /bin/grep
  grep exe
  2⤵
  PID:1063
- /bin/ls
  ls -latrh /proc/702
  2⤵
  PID:1062
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1065
- /bin/grep
  grep exe
  2⤵
  PID:1068
- /bin/ls
  ls -latrh /proc/708
  2⤵
  PID:1067
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1070
- /bin/grep
  grep exe
  2⤵
  PID:1073
- /bin/ls
  ls -latrh /proc/71
  2⤵
  PID:1072
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1075
- /bin/ls
  ls -latrh /proc/72
  2⤵
  PID:1077
- /bin/grep
  grep exe
  2⤵
  PID:1078
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1080
- /bin/ls
  ls -latrh /proc/73
  2⤵
  PID:1082
- /bin/grep
  grep exe
  2⤵
  PID:1083
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1085
- /bin/ls
  ls -latrh /proc/732
  2⤵
  PID:1087
- /bin/grep
  grep exe
  2⤵
  PID:1088
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1090
- /bin/grep
  grep exe
  2⤵
  PID:1093
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1092
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1095
- /bin/grep
  grep exe
  2⤵
  PID:1098
- /bin/ls
  ls -latrh /proc/745
  2⤵
  PID:1097
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1100
- /bin/ls
  ls -latrh /proc/746
  2⤵
  PID:1103
- /bin/grep
  grep exe
  2⤵
  PID:1104
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1107
- /bin/grep
  grep exe
  2⤵
  PID:1110
- /bin/ls
  ls -latrh /proc/75
  2⤵
  PID:1109
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1113
- /bin/grep
  grep exe
  2⤵
  PID:1117
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1116
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1119
- /bin/grep
  grep exe
  2⤵
  PID:1123
- /bin/ls
  ls -latrh /proc/77
  2⤵
  PID:1122
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1126
- /bin/grep
  grep exe
  2⤵
  PID:1130
- /bin/ls
  ls -latrh /proc/78
  2⤵
  PID:1129
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1133
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/ls
  ls -latrh /proc/79
  2⤵
  PID:1135
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1139
- /bin/grep
  grep exe
  2⤵
  PID:1143
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1142
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1145
- /bin/grep
  grep exe
  2⤵
  PID:1149
- /bin/ls
  ls -latrh /proc/82
  2⤵
  PID:1148
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1152
- /bin/grep
  grep exe
  2⤵
  PID:1155
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1154
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1158
- /bin/grep
  grep exe
  2⤵
  PID:1162
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1161
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1164
- /bin/grep
  grep exe
  2⤵
  PID:1168
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1167
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1171
- /bin/grep
  grep exe
  2⤵
  PID:1174
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1173
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1178
- /bin/grep
  grep exe
  2⤵
  PID:1181
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1183
- /bin/grep
  grep exe
  2⤵
  PID:1187
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1186
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1190
- /bin/grep
  grep exe
  2⤵
  PID:1193
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1192
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1197
- /bin/grep
  grep exe
  2⤵
  PID:1200
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1199
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1203
- /bin/grep
  grep exe
  2⤵
  PID:1207
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1206
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1209
- /bin/grep
  grep exe
  2⤵
  PID:1213
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1212
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1216
- /bin/grep
  grep exe
  2⤵
  PID:1219
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1218
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1221
- /bin/grep
  grep exe
  2⤵
  PID:1225
- /bin/ls
  ls -latrh /proc/dma
  2⤵
  PID:1224
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1228
- /bin/grep
  grep exe
  2⤵
  PID:1231
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1230
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1234
- /bin/grep
  grep exe
  2⤵
  PID:1238
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1237
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1240
- /bin/grep
  grep exe
  2⤵
  PID:1243
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1242
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1245
- /bin/grep
  grep exe
  2⤵
  PID:1248
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1247
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1250
- /bin/grep
  grep exe
  2⤵
  PID:1253
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1252
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1255
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1257
- /bin/grep
  grep exe
  2⤵
  PID:1258
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1260
- /bin/grep
  grep exe
  2⤵
  PID:1263
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1262
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1265
- /bin/grep
  grep exe
  2⤵
  PID:1268
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1267
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1270
- /bin/grep
  grep exe
  2⤵
  PID:1273
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1272
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1275
- /bin/grep
  grep exe
  2⤵
  PID:1278
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1277
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1280
- /bin/grep
  grep exe
  2⤵
  PID:1283
- /bin/ls
  ls -latrh /proc/kcore
  2⤵
  PID:1282
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1285
- /bin/grep
  grep exe
  2⤵
  PID:1288
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1287
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1290
- /bin/grep
  grep exe
  2⤵
  PID:1293
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1292
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1295
- /bin/grep
  grep exe
  2⤵
  PID:1298
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1297
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1300
- /bin/grep
  grep exe
  2⤵
  PID:1303
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1302
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1305
- /bin/grep
  grep exe
  2⤵
  PID:1308
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1307
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1310
- /bin/grep
  grep exe
  2⤵
  PID:1313
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1312
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1315
- /bin/grep
  grep exe
  2⤵
  PID:1318
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1317
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1320
- /bin/grep
  grep exe
  2⤵
  PID:1323
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1322
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1325
- /bin/grep
  grep exe
  2⤵
  PID:1328
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1327
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1330
- /bin/grep
  grep exe
  2⤵
  PID:1333
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1332
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1335
- /bin/grep
  grep exe
  2⤵
  PID:1338
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1337
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1340
- /bin/grep
  grep exe
  2⤵
  PID:1343
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1342
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1345
- /bin/grep
  grep exe
  2⤵
  PID:1348
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1347
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1350
- /bin/grep
  grep exe
  2⤵
  PID:1353
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1352
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1355
- /bin/grep
  grep exe
  2⤵
  PID:1358
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1357
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1360
- /bin/grep
  grep exe
  2⤵
  PID:1363
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1362
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1365
- /bin/grep
  grep exe
  2⤵
  PID:1368
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1367
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1370
- /bin/grep
  grep exe
  2⤵
  PID:1373
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1372
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1375
- /bin/grep
  grep exe
  2⤵
  PID:1378
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1377
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1380
- /bin/grep
  grep exe
  2⤵
  PID:1383
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1382
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1385
- /bin/grep
  grep exe
  2⤵
  PID:1388
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1387
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1390
- /bin/grep
  grep exe
  2⤵
  PID:1393
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1392
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1395
- /bin/grep
  grep exe
  2⤵
  PID:1398
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1397
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1400
- /bin/grep
  grep exe
  2⤵
  PID:1403
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1402
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1405
- /bin/grep
  grep exe
  2⤵
  PID:1408
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1407
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1410
- /bin/grep
  grep exe
  2⤵
  PID:1413
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1412
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1415
- /bin/grep
  grep exe
  2⤵
  PID:1418
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1417
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1420
- /bin/grep
  grep exe
  2⤵
  PID:1423
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1422
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1425
- /bin/grep
  grep exe
  2⤵
  PID:1428
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1427
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1430
- /bin/grep
  grep exe
  2⤵
  PID:1433
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1432
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1435
- /bin/grep
  grep exe
  2⤵
  PID:1438
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1437
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1440
- /bin/grep
  grep exe
  2⤵
  PID:1443
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1442
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1445
- /bin/grep
  grep exe
  2⤵
  PID:1448
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1447
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1450
- /bin/grep
  grep /dot
  2⤵
  PID:1452
- /bin/grep
  grep -v grep
  2⤵
  PID:1453
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1451
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1454
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1455
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads CPU attributes
  PID:1456
- /bin/grep
  grep -v grep
  2⤵
  PID:1459
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1461
- /bin/grep
  grep tracepath
  2⤵
  PID:1458
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1457
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1460
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  PID:1462
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1466
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1467
- /bin/grep
  grep -v grep
  2⤵
  PID:1465
- /bin/grep
  grep ./ll1
  2⤵
  PID:1464
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1463
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1469
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1468
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1471
- /bin/ps
  ps aux
  2⤵
  PID:1470
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1475
- /bin/grep
  grep -v grep
  2⤵
  PID:1474
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1473
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1476
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1472
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1480
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1481
- /bin/grep
  grep -v grep
  2⤵
  PID:1479
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1478
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1477
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1486
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1485
- /bin/grep
  grep -v grep
  2⤵
  PID:1484
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1483
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1482
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1490
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1491
- /bin/grep
  grep -v grep
  2⤵
  PID:1489
- /bin/grep
  grep perfctl
  2⤵
  PID:1488
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1487
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1494
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1496
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1493
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1495
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1500
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1499
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1501
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1498
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1505
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1504
- /bin/grep
  grep -v -
  2⤵
  PID:1506
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1507
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1503
- /bin/grep
  grep -v -
  2⤵
  PID:1512
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1510
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1513
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1509
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1511
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1517
- /bin/grep
  grep -v -
  2⤵
  PID:1518
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1515
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1516
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1519
- /bin/grep
  grep -v -
  2⤵
  PID:1524
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1522
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1523
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1521
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1525
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads runtime system information
  PID:1526
- /bin/grep
  grep agetty
  2⤵
  PID:1528
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1530
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1531
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1527
- /bin/grep
  grep -v grep
  2⤵
  PID:1529
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads runtime system information
  PID:1532
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1533
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1535
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1534
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1538
- /bin/sed
  sed /base64/d
  2⤵
  PID:1537
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1536
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1541
- /bin/sed
  sed /python/d
  2⤵
  PID:1540
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1539
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1544
- /bin/sed
  sed /shm/d
  2⤵
  PID:1543
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1542
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1547
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1546
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1545
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1550
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1549
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1548
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1553
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1551
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1556
- /bin/sed
  sed /linux/d
  2⤵
  PID:1555
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1554
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1559
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1558
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1557
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1562
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1561
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1560
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1565
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1564
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1563
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1568
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1567
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1566
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1571
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1570
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1569
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  PID:1572
- /usr/bin/pkill
  pkill -f htop
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1573
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  PID:1575
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads runtime system information
  PID:1576
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  - Reads CPU attributes
  PID:1577
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  - Reads CPU attributes
  PID:1578
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  PID:1579
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads runtime system information
  PID:1580
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1584
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1583
- /bin/grep
  grep -v -
  2⤵
  PID:1585
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1586
- /bin/grep
  grep :1414
  2⤵
  PID:1582
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1590
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1589
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1592
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1588
- /bin/grep
  grep -v -
  2⤵
  PID:1591
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1596
- /bin/grep
  grep -v -
  2⤵
  PID:1597
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1595
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1598
- /bin/grep
  grep :143
  2⤵
  PID:1594
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1602
- /bin/grep
  grep -v -
  2⤵
  PID:1603
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1604
- /bin/grep
  grep :2222
  2⤵
  PID:1600
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1601
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1608
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1610
- /bin/grep
  grep :3333
  2⤵
  PID:1606
- /bin/grep
  grep -v -
  2⤵
  PID:1609
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1607
- /bin/grep
  grep -v -
  2⤵
  PID:1615
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1614
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1613
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1616
- /bin/grep
  grep :3389
  2⤵
  PID:1612
- /bin/grep
  grep -v -
  2⤵
  PID:1621
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1620
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1622
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1619
- /bin/grep
  grep :4444
  2⤵
  PID:1618
- /bin/grep
  grep :5555
  2⤵
  PID:1624
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1625
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1626
- /bin/grep
  grep -v -
  2⤵
  PID:1627
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1628
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1632
- /bin/grep
  grep -v -
  2⤵
  PID:1633
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1634
- /bin/grep
  grep :6666
  2⤵
  PID:1630
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1631
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1638
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1637
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1640
- /bin/grep
  grep -v -
  2⤵
  PID:1639
- /bin/grep
  grep :6665
  2⤵
  PID:1636
- /bin/grep
  grep -v -
  2⤵
  PID:1645
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1646
- /bin/grep
  grep :6667
  2⤵
  PID:1642
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1643
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1644
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1650
- /bin/grep
  grep -v -
  2⤵
  PID:1651
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1649
- /bin/grep
  grep :7777
  2⤵
  PID:1648
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1652
- /bin/grep
  grep -v -
  2⤵
  PID:1657
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1658
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1655
- /bin/grep
  grep :8444
  2⤵
  PID:1654
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1656
- /bin/grep
  grep -v -
  2⤵
  PID:1663
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1662
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1661
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1664
- /bin/grep
  grep :3347
  2⤵
  PID:1660
- /bin/grep
  grep -v -
  2⤵
  PID:1669
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1668
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1667
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1670
- /bin/grep
  grep :14444
  2⤵
  PID:1666
- /bin/grep
  grep -v -
  2⤵
  PID:1675
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1676
- /bin/grep
  grep :14433
  2⤵
  PID:1672
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1674
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1673
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1679
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1680
- /bin/grep
  grep -v -
  2⤵
  PID:1681
- /bin/grep
  grep :13531
  2⤵
  PID:1678
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1682
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1683
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1685
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1684
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1686
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1688
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1687
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  - Attempts to change immutable files
  PID:1689
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1691
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1690
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1692
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1694
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1693
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  PID:1695
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1697
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1696
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  - Attempts to change immutable files
  PID:1698
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1700
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1699
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1701
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1702
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1703
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  - Attempts to change immutable files
  PID:1704
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1706
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1705
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  - Attempts to change immutable files
  PID:1707
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1709
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1708
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1710
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1712
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1711
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  PID:1713
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1715
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1714
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  - Attempts to change immutable files
  PID:1716
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1718
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1717
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1719
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads runtime system information
  PID:1720
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  PID:1721
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  PID:1722
- /usr/bin/pkill
  pkill -f monero
  2⤵
  PID:1723
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  PID:1724
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  PID:1725
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  PID:1726
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  PID:1727
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  PID:1728
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1729
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  PID:1730
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  PID:1731
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  PID:1732
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  PID:1733
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  PID:1734
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  PID:1735
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  PID:1736
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  PID:1737
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1738
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  PID:1739
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads runtime system information
  PID:1740
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1741
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1742
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  PID:1743
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1744
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  PID:1745
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1746
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  PID:1747
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1748
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1749
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  PID:1750
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  PID:1751
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1756
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1755
- /bin/grep
  grep -v grep
  2⤵
  PID:1754
- /bin/grep
  grep ./udp
  2⤵
  PID:1753
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1752
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1761
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1760
- /bin/grep
  grep -v grep
  2⤵
  PID:1759
- /bin/grep
  grep ./oka
  2⤵
  PID:1758
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1757
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1765
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1766
- /bin/grep
  grep -v grep
  2⤵
  PID:1764
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1763
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1762
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1770
- /bin/grep
  grep -v bin
  2⤵
  PID:1769
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1772
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1768
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1773
- /bin/grep
  grep -v "("
  2⤵
  PID:1771
- /bin/grep
  grep -v postgres
  2⤵
  PID:1774
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:1767
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1775
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1776
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1777
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1778
- /bin/grep
  grep -v "("
  2⤵
  PID:1783
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1782
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1784
- /bin/grep
  grep -v bin
  2⤵
  PID:1781
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1785
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1780
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1787
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:1779
- /bin/grep
  grep -v postgres
  2⤵
  PID:1786
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1788
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1789
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1793
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1791
- /bin/grep
  grep -v "("
  2⤵
  PID:1794
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1795
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1796
- /bin/grep
  grep -v bin
  2⤵
  PID:1792
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1790
- /bin/grep
  grep -v postgres
  2⤵
  PID:1797
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1798
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1799
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1800
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1805
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1804
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1803
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1801
- /bin/grep
  grep -v grep
  2⤵
  PID:1802
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1810
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1809
- /bin/grep
  grep -v grep
  2⤵
  PID:1808
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1807
- /bin/ps
  ps aux
  2⤵
  PID:1806
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1815
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1814
- /bin/grep
  grep -v grep
  2⤵
  PID:1813
- /bin/grep
  grep ./crun
  2⤵
  PID:1812
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1811
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1819
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1820
- /bin/grep
  grep -v grep
  2⤵
  PID:1818
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1817
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1816
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1825
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1824
- /bin/grep
  grep :3333
  2⤵
  PID:1823
- /bin/grep
  grep -v grep
  2⤵
  PID:1822
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1821
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1830
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1829
- /bin/grep
  grep :5555
  2⤵
  PID:1828
- /bin/grep
  grep -v grep
  2⤵
  PID:1827
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1826
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1835
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1833
- /bin/grep
  grep -v grep
  2⤵
  PID:1832
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1834
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1831
- /bin/grep
  grep log_
  2⤵
  PID:1838
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1840
- /bin/grep
  grep -v grep
  2⤵
  PID:1837
- /bin/ps
  ps aux
  2⤵
  PID:1836
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1845
- /bin/grep
  grep systemten
  2⤵
  PID:1843
- /bin/grep
  grep -v grep
  2⤵
  PID:1842
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1844
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1850
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1851
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1851
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1851
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1851
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1851
- - /bin/kill
    kill -9 10
    3⤵
    PID:1851
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1849
- /bin/grep
  grep netns
  2⤵
  PID:1848
- /bin/grep
  grep -v grep
  2⤵
  PID:1847
- /bin/ps
  ps aux
  2⤵
  PID:1846
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1856
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1855
- /bin/grep
  grep voltuned
  2⤵
  PID:1854
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1852
- /bin/grep
  grep -v grep
  2⤵
  PID:1853
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1861
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1860
- /bin/grep
  grep darwin
  2⤵
  PID:1859
- /bin/grep
  grep -v grep
  2⤵
  PID:1858
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1866
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1865
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1864
- /bin/grep
  grep -v grep
  2⤵
  PID:1863
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1862
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1870
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1869
- /bin/grep
  grep -v grep
  2⤵
  PID:1868
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1871
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1867
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1876
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1875
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1874
- /bin/grep
  grep -v grep
  2⤵
  PID:1873
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1872
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1881
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1880
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1879
- /bin/grep
  grep -v grep
  2⤵
  PID:1878
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1877
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1886
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1885
- /bin/grep
  grep -v grep
  2⤵
  PID:1883
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1882
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1884
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1889
- /bin/grep
  grep -v grep
  2⤵
  PID:1888
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1890
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1891
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1887
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1896
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1894
- /bin/grep
  grep -v grep
  2⤵
  PID:1893
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1895
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1892
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1899
- /bin/grep
  grep -v grep
  2⤵
  PID:1898
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1897
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1901
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1900
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1906
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1904
- /bin/grep
  grep -v grep
  2⤵
  PID:1903
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1902
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1910
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1909
- /bin/grep
  grep -v grep
  2⤵
  PID:1908
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1907
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1911
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1915
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1914
- /bin/grep
  grep -v grep
  2⤵
  PID:1913
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1916
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1912
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1921
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1920
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1919
- /bin/grep
  grep -v grep
  2⤵
  PID:1918
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1917
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1926
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1925
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1924
- /bin/grep
  grep -v grep
  2⤵
  PID:1923
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1922
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1930
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1931
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1929
- /bin/grep
  grep -v grep
  2⤵
  PID:1928
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1927
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1932
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1935
- /bin/grep
  grep -v grep
  2⤵
  PID:1933
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1936
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1941
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1939
- /bin/grep
  grep -v grep
  2⤵
  PID:1938
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1940
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1937
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1946
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1945
- /bin/grep
  grep -v grep
  2⤵
  PID:1943
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1942
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1951
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1950
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1949
- /bin/grep
  grep -v grep
  2⤵
  PID:1948
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1947
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1956
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1955
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1954
- /bin/grep
  grep -v grep
  2⤵
  PID:1953
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1952
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1961
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1960
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1959
- /bin/grep
  grep -v grep
  2⤵
  PID:1958
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1966
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1965
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1964
- /bin/grep
  grep -v grep
  2⤵
  PID:1963
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1962
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1971
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1970
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1969
- /bin/grep
  grep -v grep
  2⤵
  PID:1968
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1967
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1976
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1974
- /bin/grep
  grep -v grep
  2⤵
  PID:1973
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1975
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1972
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1981
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1980
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1979
- /bin/grep
  grep -v grep
  2⤵
  PID:1978
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1977
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1986
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1985
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1984
- /bin/grep
  grep -v grep
  2⤵
  PID:1983
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1982
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1991
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1990
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1989
- /bin/grep
  grep -v grep
  2⤵
  PID:1988
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1987
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1996
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:1994
- /bin/grep
  grep -v grep
  2⤵
  PID:1993
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1995
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1992
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2000
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:1999
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2001
- /bin/grep
  grep -v grep
  2⤵
  PID:1998
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1997
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2006
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:2004
- /bin/grep
  grep -v grep
  2⤵
  PID:2003
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2005
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2002
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2011
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2010
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:2009
- /bin/grep
  grep -v grep
  2⤵
  PID:2008
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2007
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2016
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2015
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2014
- /bin/grep
  grep -v grep
  2⤵
  PID:2013
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2012
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2021
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2019
- /bin/grep
  grep -v grep
  2⤵
  PID:2018
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2020
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2017
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2025
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2026
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2024
- /bin/grep
  grep -v grep
  2⤵
  PID:2023
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2022
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2030
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2029
- /bin/grep
  grep -v grep
  2⤵
  PID:2028
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2031
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2027
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2035
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2034
- /bin/grep
  grep -v grep
  2⤵
  PID:2033
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2032
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2039
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2038
- /bin/grep
  grep -v grep
  2⤵
  PID:2037
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2040
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2036
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2045
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2044
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2043
- /bin/grep
  grep -v grep
  2⤵
  PID:2042
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2041
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2050
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2049
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2048
- /bin/grep
  grep -v grep
  2⤵
  PID:2047
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2046
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2055
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2054
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2053
- /bin/grep
  grep -v grep
  2⤵
  PID:2052
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2051
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2060
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2059
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2058
- /bin/grep
  grep -v grep
  2⤵
  PID:2057
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2056
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2065
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2064
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2063
- /bin/grep
  grep -v grep
  2⤵
  PID:2062
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2061
- /bin/grep
  grep "]"
  2⤵
  PID:2069
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:2070
- /bin/grep
  grep -v aux
  2⤵
  PID:2068
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2071
- /bin/grep
  grep -v grep
  2⤵
  PID:2067
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2066
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2076
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2075
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:2074
- /bin/grep
  grep -v grep
  2⤵
  PID:2073
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2072
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2081
- /bin/grep
  grep -v grep
  2⤵
  PID:2078
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2080
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2077
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:2079
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2086
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2085
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:2084
- /bin/grep
  grep -v grep
  2⤵
  PID:2083
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2082
- /bin/grep
  grep -v -
  2⤵
  PID:2090
- /bin/grep
  grep -v /
  2⤵
  PID:2089
- /bin/grep
  grep -v grep
  2⤵
  PID:2088
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:2092
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2093
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2087
- /bin/grep
  grep -v _
  2⤵
  PID:2091
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2098
- /bin/grep
  grep "\\[^"
  2⤵
  PID:2096
- /bin/grep
  grep -v grep
  2⤵
  PID:2095
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2097
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2094
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2102
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2103
- /bin/grep
  grep rsync
  2⤵
  PID:2101

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
843B

MD5
fe58b9e176a103244b9a7b2092e812a8

SHA1
4c9671747cf4af4a64385d8232b5d4ebcd6d0fad

SHA256
1ced2a9824f996a33a77cbb7fe0935bc657457e7cdbff20ea2e997085f2006ac

SHA512
14e37072910e60a764b0125e8bba5349adfef8860aa47569b2e7c055f59239fd4120a1902781b76209f731a370b9139b2e71fbaf517aeef77e5558caa9b593c5

Download Submit
/var/mail/user

Filesize
1KB

MD5
e184f333ef4240f851c61256a3d55a31

SHA1
aef9b4207648a8d4fa9200f03fdc099c8e97ae26

SHA256
8013f52fa2bb3c787f41f3b2e32762fd93ca377b4f4aebad9574eef700f99c94

SHA512
15015d54b664dd25edf169d8e68a74e056383defdc2decba4c508e6270a9fca4977408f1af3595f70acab8b0ceb4efe519bd38009d8196612753591be6f6a574

Download Submit
/var/spool/cron/crontabs/tmp.DUQNzk

Filesize
175B

MD5
b1de4f7c50438f6ea7c0ae708c2e4f56

SHA1
0404620392a00eeac14083db0e881939f188448c

SHA256
fc208c97d815a3b6ea435263929e8cdff498b42118ecd34dbde69168b9e0d74d

SHA512
28e4625050eb0672e844526a8828a2ca43ecb6517ea6325749ba7b33bc17b3a5c6107a3b3f9c03a2c7030af4360c33c50f388725f3d9b28034d2072d3583a04d

Download Submit
/var/spool/cron/crontabs/tmp.NWnOHo

Filesize
175B

MD5
3e886be6ef4a92f56e9e80b57a205dbc

SHA1
542e4dc6ba58ba475049cf00da749e1a3ed0f771

SHA256
3fefe4f0c18f2b278e7045aec76f025488a4f0609cbe4d5b798acedb96df67ed

SHA512
b81d226fd2426d026e9fefeab502d8b7a50e5f97bbc94f0f30cad81dc0ac7495d3337fdc4e6b5ec370456cbf4852baa860a441dd588620f3c9805a433bcc4785

Download Submit
/var/spool/cron/crontabs/tmp.T4phXg

Filesize
175B

MD5
990c1d2739f7394082ef48a0bbdbead1

SHA1
1ef8b2d16a5f58ae7bf9c55baa7995c0b4e1081b

SHA256
d1a91c241bfda608557e309d49053fe316f6b6ce4e7d2ae4df785f79b64ed841

SHA512
6e2eec4c785013aad0a6d8cdc308324208023825ae52f151afb81645dfb5805043c9aae8700b75d164dca1f5020074a4c3aa213972494441c88058fe1bb4ff9d

Download Submit
/var/spool/cron/crontabs/tmp.bd7zEf

Filesize
175B

MD5
e33b0f47a5aca2e4ed70309330d06c43

SHA1
b5056bd71a6320222b99be345ea11b5cd5f1fc4c

SHA256
0d00c6780b8625c6bdef40272183775be0229a3cd84ba9577b03920f819ca167

SHA512
6d616531db0898240d56b4c701ca021d3f410c59bf85ebe1b864a973989337d628d0e21bc76c79d76b91e3eabd1f5cf26d5dad8258d322a4f5ff485bc2acf304

Download Submit
/var/spool/cron/crontabs/tmp.vtceK3

Filesize
175B

MD5
b49c31802490f6e93f1d18ef467da233

SHA1
1a7454e973b46e7fbafddf8b6d3da007e8d9e2da

SHA256
79e92540dd9f5b69cc5a376ef6ff01538e54a4e57edf4ac6a5b78be04d6ecf00

SHA512
c009482b7c22f3a6fabc76f65b5e23b47c8dc3c4a6be8f4ab8f3ecfc3f63c87d20f207a9fcbf32763982ecc6f207feeea52dde25519f94b011da04da973c2c4d

Download Submit
/var/spool/exim4/input/1tmNZQ-0000Bt-Fx-D

Filesize
128B

MD5
a6169077d6a5eddef50d830076f1dab8

SHA1
f207a15c8696d4bb689d06efb8e097fb4d221c57

SHA256
7116e5cb46b8497924a07ad556200b1ae2f9c59471d3367177d6fe36931fff88

SHA512
6df4f9b47655c6aea82759998f5fee643428d21f48be7b908b23bf982b153a2c70676ffeacffbc26c12b4b1b530439960ef954df99858cd5212239f4c62299e5

Download Submit
/var/spool/exim4/input/1tmNZQ-0000Bw-FG-D

Filesize
146B

MD5
57bf8593d6625898d9c9fb16f4837a3d

SHA1
2908c51dc3c33bf521345c789ba759fbdd955232

SHA256
a0030fc2f82ad13230ac5be51d3824b8a634f711a209bd8b8956c6de548db62e

SHA512
783dfaaf20f7dda6542045d381e9cf5d0880439cad7cf79c69f0e44af63069475f3d01557ef7c07aea661bbf2be4c25d7037dc2306585843318abdc60c50e204

Download Submit
/var/spool/exim4/input/1tmNZQ-0000Bw-FG-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/hdr.737

Filesize
915B

MD5
c851ffce52ed30c0d597c187aecfaa7e

SHA1
7855aa41b81370d7fc02e71ea4a51714fbe3f8b5

SHA256
26e79de3d07e40ec5d5f0e6a6a135dfa416df7383b61d283c83d096ff6864b4f

SHA512
600abd12d649f5ce15329a9c2cf6b0a26f50ad9eb160ad9950178f71396bc5183c22e646eca2d10d692b69f157ffa7e2e7a662f019424917a341c45787a3c708

Download Submit
/var/spool/exim4/msglog/1tmNZQ-0000Bt-Fx

Filesize
288B

MD5
9deb19586491c2cb0397d2b134029b02

SHA1
a01d8e94399b7fbb06435a55e92c004d8eae304d

SHA256
8653fb7b5b0079c43c69f93ec4e5aae8d12a7b33bb7a6871d3224434cf4ef80a

SHA512
a6bc1f143ed1dc1e5e378faf78ff8337fae8da5a6bad5e0356d273e47de60a437b256ce2f2c6dfe928edb09602d4dd8de7a4a0662c7919f1ae61509b21b7f9f1

Download Submit
/var/spool/exim4/msglog/1tmNZQ-0000Bt-Fx

Filesize
89B

MD5
37c7f9facc3aae32e61490b86267b99c

SHA1
c59cbd529b422c09d9b5a45e9f3101c526940834

SHA256
13e6c2de62ff2db42254496bd2995d393ccb0b9fa04db374c0b5c264878a7260

SHA512
0060c2b2c473010727e09e6667a1edf3b6de50b8406d2de3f61f1f39f716810b37a602b51c817fe496f1dc97101b5c6b264a9fd7527fb25f2952200f5fae2276

Download Submit
/var/spool/exim4/msglog/1tmNZQ-0000Bw-FG

Filesize
288B

MD5
62d2116711c49e6087c976231460d8a5

SHA1
e76f1b6601bcf2d295746ec7fb4dd786dce7bbf6

SHA256
62af6cadee8eb6624835ba5b290676e5f7bfb029b300341b42bd87eba899da2f

SHA512
32b7121c4e374faff1f8b3fa7053690e1f8876030c6cb7fcced1ddbaa6978a66a7e96bdf4727dd76fa263ee834f5b075dc38b917fcba96b03bf583f08c261f95

Download Submit
/var/spool/exim4/msglog/1tmNZQ-0000Bw-FG

Filesize
89B

MD5
8b652aacbe9db999b975b776e686c4df

SHA1
173f264aa58a4d4ee0ef927076770d452f528b03

SHA256
e49ce3c038bcbf39444c51dec1ab9fb1d6bedffb97b47d92e354e2732fd691da

SHA512
7e4daa151d522607698277177966dd79566e7dd6b706193a97d47aeb0bb4fbabcb636a83a4866d5641b9b83dfe3434fd79d3dd20de5bdfb3b2588c45bca7a937

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads