bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87

Analysis

max time kernel
64s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/02/2025, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh
Size

35KB
MD5

d7687ddb64cad3593f71086a856d53ef
SHA1

0e921dc477dd7efcd8a456a7ea8f8720b2a11947
SHA256

bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87
SHA512

a69ded2a945f0a6eaf1c325b37471c76bdc4f963ade77d816043eaafdfbfa377e85ba983123c7ee9403dafde427cca2f64eecebd3ba6e241d7cdc42700dca865
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytIuz:bOVF+D6cIwgosTz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
668	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
674	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1683	xargs
1741	xargs
659	chattr
1469	xargs
1504	xargs
1688	sed
1999	xargs
2030	xargs
1949	xargs
1595	xargs
1659	sed
1565	xargs
697	chattr
1589	xargs
1656	sed
1753	xargs
1843	xargs
1869	xargs
1492	xargs
1816	xargs
1826	xargs
1884	xargs
2009	xargs
1989	xargs
1432	xargs
1790	xargs
1899	xargs
1909	xargs
1934	xargs
1994	xargs
1665	sed
1811	xargs
1924	xargs
2020	xargs
1821	xargs
1894	xargs
1944	xargs
1625	xargs
1874	xargs
1879	xargs
1929	xargs
1690	xargs
1806	xargs
2015	xargs
1459	xargs
1423	xargs
1438	xargs
1444	grep
1679	xargs
1691	sed
698	chattr
1486	xargs
1649	xargs
1661	xargs
1668	sed
1736	xargs
1979	xargs
1571	xargs
1643	xargs
1854	xargs
1914	xargs
1664	xargs
1655	xargs
1687	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.G9kGVa	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.uo2Mfc	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.wUPFXw	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.FVAtF8	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.TNnW18	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.a3iYMj	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.bVQsIZ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.bmbJWn	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.pUyvSF	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ygopOW	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.PRlChb	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.hfi13y	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.meXwAK	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1781	ps
1870	ps
1885	ps
1890	ps
1880	ps
1915	ps
1920	ps
1945	ps
1737	ps
1419	ps
1450	ps
1833	ps
1935	ps
1839	ps
1900	ps
1905	ps
1930	ps
1955	ps
1960	ps
1807	ps
1965	ps
2026	ps
1980	ps
1985	ps
1845	ps
1850	ps
1455	ps
1732	ps
1865	ps
1817	ps
1828	ps
1855	ps
2036	ps
1727	ps
1975	ps
1995	ps
2012	ps
1460	ps
2021	ps
2031	ps
1445	ps
1940	ps
2016	ps
1434	ps
1797	ps
1895	ps
1970	ps
2041	ps
1428	ps
1812	ps
1990	ps
1443	ps
1786	ps
1791	ps
1802	ps
1822	ps
1875	ps
1910	ps
1776	ps
1950	ps
2000	ps
2005	ps
1440	ps
1860	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/654/cmdline	pkill
File opened for reading	/proc/283/status	ps
File opened for reading	/proc/210/cmdline	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/280/stat	ps
File opened for reading	/proc/266/stat	ps
File opened for reading	/proc/660/stat	ps
File opened for reading	/proc/280/stat	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/302/status	ps
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/302/cmdline	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/132/status	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/1940/stat	ps
File opened for reading	/proc/269/cmdline	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/141/cmdline	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/606/status	pkill
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/140/cmdline	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/109/cmdline	ps
File opened for reading	/proc/164/status	pkill
File opened for reading	/proc/653/status	pkill
File opened for reading	/proc/651/status	ps
File opened for reading	/proc/654/status	ps
File opened for reading	/proc/1937/status	ps
File opened for reading	/proc/210/stat	ps
File opened for reading	/proc/653/stat	ps
File opened for reading	/proc/1685/stat	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/266/cmdline	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/109/status	ps
File opened for reading	/proc/652/cmdline	pkill
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/1685/stat	ps
File opened for reading	/proc/109/status	ps
File opened for reading	/proc/1961/cmdline	ps
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/43/status	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/108/stat	ps
File opened for reading	/proc/302/cmdline	pkill
File opened for reading	/proc/1685/status	pkill
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/tty/drivers	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1375	ls
1977	grep
2007	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh

/tmp/bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh
/tmp/bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh
1⤵
- Writes file to tmp directory
PID:654
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:655
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:657
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:659
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  PID:662
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  PID:666
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:668
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:674
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:685
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOIR-0000B3-Vq
      4⤵
      PID:700
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:688
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOIS-0000B6-1f
      4⤵
      Reads CPU attributes
      PID:702
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:690
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:692
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:694
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:697
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:698
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:701
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:703
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:704
- /bin/grep
  grep exe
  2⤵
  PID:707
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:706
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:709
- /bin/grep
  grep exe
  2⤵
  PID:713
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:712
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:715
- /bin/ls
  ls -latrh /proc/106
  2⤵
  PID:718
- /bin/grep
  grep exe
  2⤵
  PID:719
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:723
- /bin/grep
  grep exe
  2⤵
  PID:726
- /bin/ls
  ls -latrh /proc/108
  2⤵
  PID:725
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:728
- /bin/grep
  grep exe
  2⤵
  PID:732
- /bin/ls
  ls -latrh /proc/109
  2⤵
  PID:731
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:734
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:737
- /bin/grep
  grep exe
  2⤵
  PID:738
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:740
- /bin/grep
  grep exe
  2⤵
  PID:743
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:742
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:745
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:747
- /bin/grep
  grep exe
  2⤵
  PID:748
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:750
- /bin/ls
  ls -latrh /proc/132
  2⤵
  PID:752
- /bin/grep
  grep exe
  2⤵
  PID:753
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:755
- /bin/grep
  grep exe
  2⤵
  PID:760
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:759
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:763
- /bin/grep
  grep exe
  2⤵
  PID:766
- /bin/ls
  ls -latrh /proc/140
  2⤵
  PID:765
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:769
- /bin/grep
  grep exe
  2⤵
  PID:773
- /bin/ls
  ls -latrh /proc/141
  2⤵
  PID:772
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:776
- /bin/ls
  ls -latrh /proc/146
  2⤵
  PID:779
- /bin/grep
  grep exe
  2⤵
  PID:780
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:784
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:787
- /bin/grep
  grep exe
  2⤵
  PID:788
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:791
- /bin/grep
  grep exe
  2⤵
  PID:795
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:794
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:798
- /bin/ls
  ls -latrh /proc/164
  2⤵
  PID:800
- /bin/grep
  grep exe
  2⤵
  PID:801
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:805
- /bin/grep
  grep exe
  2⤵
  PID:808
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:807
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:811
- /bin/grep
  grep exe
  2⤵
  PID:815
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:814
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:817
- /bin/grep
  grep exe
  2⤵
  PID:821
- /bin/ls
  ls -latrh /proc/182
  2⤵
  PID:820
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:824
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:827
- /bin/grep
  grep exe
  2⤵
  PID:828
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:831
- /bin/grep
  grep exe
  2⤵
  PID:835
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:834
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:838
- /bin/grep
  grep exe
  2⤵
  PID:842
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:841
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:844
- /bin/grep
  grep exe
  2⤵
  PID:848
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:847
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:851
- /bin/grep
  grep exe
  2⤵
  PID:855
- /bin/ls
  ls -latrh /proc/210
  2⤵
  PID:854
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:857
- /bin/grep
  grep exe
  2⤵
  PID:862
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:861
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:864
- /bin/grep
  grep exe
  2⤵
  PID:868
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:873
- /bin/grep
  grep exe
  2⤵
  PID:876
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:875
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:879
- /bin/grep
  grep exe
  2⤵
  PID:883
- /bin/ls
  ls -latrh /proc/25
  2⤵
  PID:882
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:888
- /bin/grep
  grep exe
  2⤵
  PID:892
- /bin/ls
  ls -latrh /proc/26
  2⤵
  PID:891
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:894
- /bin/grep
  grep exe
  2⤵
  PID:899
- /bin/ls
  ls -latrh /proc/266
  2⤵
  PID:898
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:902
- /bin/grep
  grep exe
  2⤵
  PID:906
- /bin/ls
  ls -latrh /proc/269
  2⤵
  PID:905
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:909
- /bin/grep
  grep exe
  2⤵
  PID:913
- /bin/ls
  ls -latrh /proc/27
  2⤵
  PID:912
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:915
- /bin/ls
  ls -latrh /proc/28
  2⤵
  PID:917
- /bin/grep
  grep exe
  2⤵
  PID:918
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:921
- /bin/grep
  grep exe
  2⤵
  PID:924
- /bin/ls
  ls -latrh /proc/280
  2⤵
  PID:923
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:926
- /bin/ls
  ls -latrh /proc/281
  2⤵
  PID:928
- /bin/grep
  grep exe
  2⤵
  PID:929
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:931
- /bin/grep
  grep exe
  2⤵
  PID:934
- /bin/ls
  ls -latrh /proc/283
  2⤵
  PID:933
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:936
- /bin/grep
  grep exe
  2⤵
  PID:939
- /bin/ls
  ls -latrh /proc/29
  2⤵
  PID:938
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:941
- /bin/grep
  grep exe
  2⤵
  PID:944
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:943
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:946
- /bin/grep
  grep exe
  2⤵
  PID:949
- /bin/ls
  ls -latrh /proc/300
  2⤵
  PID:948
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:951
- /bin/grep
  grep exe
  2⤵
  PID:954
- /bin/ls
  ls -latrh /proc/302
  2⤵
  PID:953
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:956
- /bin/ls
  ls -latrh /proc/312
  2⤵
  PID:958
- /bin/grep
  grep exe
  2⤵
  PID:959
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:961
- /bin/ls
  ls -latrh /proc/329
  2⤵
  PID:965
- /bin/grep
  grep exe
  2⤵
  PID:966
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:968
- /bin/grep
  grep exe
  2⤵
  PID:973
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:972
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:975
- /bin/ls
  ls -latrh /proc/41
  2⤵
  PID:979
- /bin/grep
  grep exe
  2⤵
  PID:980
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:983
- /bin/grep
  grep exe
  2⤵
  PID:987
- /bin/ls
  ls -latrh /proc/42
  2⤵
  PID:986
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:990
- /bin/grep
  grep exe
  2⤵
  PID:994
- /bin/ls
  ls -latrh /proc/43
  2⤵
  PID:993
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:997
- /bin/grep
  grep exe
  2⤵
  PID:1001
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:1000
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1003
- /bin/grep
  grep exe
  2⤵
  PID:1008
- /bin/ls
  ls -latrh /proc/590
  2⤵
  PID:1007
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1010
- /bin/ls
  ls -latrh /proc/598
  2⤵
  PID:1013
- /bin/grep
  grep exe
  2⤵
  PID:1014
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1016
- /bin/grep
  grep exe
  2⤵
  PID:1020
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:1019
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1023
- /bin/ls
  ls -latrh /proc/600
  2⤵
  PID:1026
- /bin/grep
  grep exe
  2⤵
  PID:1027
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1029
- /bin/grep
  grep exe
  2⤵
  PID:1033
- /bin/ls
  ls -latrh /proc/605
  2⤵
  PID:1032
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1036
- /bin/grep
  grep exe
  2⤵
  PID:1040
- /bin/ls
  ls -latrh /proc/606
  2⤵
  PID:1039
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1043
- /bin/grep
  grep exe
  2⤵
  PID:1046
- /bin/ls
  ls -latrh /proc/640
  2⤵
  PID:1045
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1049
- /bin/grep
  grep exe
  2⤵
  PID:1053
- /bin/ls
  ls -latrh /proc/646
  2⤵
  PID:1052
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1055
- /bin/grep
  grep exe
  2⤵
  PID:1058
- /bin/ls
  ls -latrh /proc/647
  2⤵
  PID:1057
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1061
- /bin/grep
  grep exe
  2⤵
  PID:1065
- /bin/ls
  ls -latrh /proc/651
  2⤵
  PID:1064
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1068
- /bin/grep
  grep exe
  2⤵
  PID:1072
- /bin/ls
  ls -latrh /proc/652
  2⤵
  PID:1071
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1075
- /bin/grep
  grep exe
  2⤵
  PID:1079
- /bin/ls
  ls -latrh /proc/653
  2⤵
  PID:1078
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1081
- /bin/grep
  grep exe
  2⤵
  PID:1084
- /bin/ls
  ls -latrh /proc/654
  2⤵
  PID:1083
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1086
- /bin/ls
  ls -latrh /proc/660
  2⤵
  PID:1088
- /bin/grep
  grep exe
  2⤵
  PID:1089
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1091
- /bin/ls
  ls -latrh /proc/661
  2⤵
  PID:1093
- /bin/grep
  grep exe
  2⤵
  PID:1094
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1096
- /bin/grep
  grep exe
  2⤵
  PID:1099
- /bin/ls
  ls -latrh /proc/696
  2⤵
  PID:1098
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1101
- /bin/grep
  grep exe
  2⤵
  PID:1104
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1103
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1107
- /bin/ls
  ls -latrh /proc/700
  2⤵
  PID:1109
- /bin/grep
  grep exe
  2⤵
  PID:1110
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1113
- /bin/grep
  grep exe
  2⤵
  PID:1116
- /bin/ls
  ls -latrh /proc/702
  2⤵
  PID:1115
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1118
- /bin/grep
  grep exe
  2⤵
  PID:1121
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1120
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1123
- /bin/grep
  grep exe
  2⤵
  PID:1126
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1125
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1128
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1130
- /bin/grep
  grep exe
  2⤵
  PID:1131
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1133
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/ls
  ls -latrh /proc/98
  2⤵
  PID:1135
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1138
- /bin/grep
  grep exe
  2⤵
  PID:1141
- /bin/ls
  ls -latrh /proc/apm
  2⤵
  PID:1140
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1143
- /bin/grep
  grep exe
  2⤵
  PID:1146
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1145
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1148
- /bin/grep
  grep exe
  2⤵
  PID:1151
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1150
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1153
- /bin/grep
  grep exe
  2⤵
  PID:1156
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1155
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1158
- /bin/grep
  grep exe
  2⤵
  PID:1161
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1160
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1163
- /bin/grep
  grep exe
  2⤵
  PID:1166
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1165
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1168
- /bin/grep
  grep exe
  2⤵
  PID:1171
- /bin/ls
  ls -latrh /proc/cpu
  2⤵
  PID:1170
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1173
- /bin/grep
  grep exe
  2⤵
  PID:1176
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1175
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1178
- /bin/grep
  grep exe
  2⤵
  PID:1181
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1183
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1185
- /bin/grep
  grep exe
  2⤵
  PID:1186
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1188
- /bin/grep
  grep exe
  2⤵
  PID:1191
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1190
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1193
- /bin/grep
  grep exe
  2⤵
  PID:1196
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1195
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1198
- /bin/grep
  grep exe
  2⤵
  PID:1201
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1200
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1203
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1205
- /bin/grep
  grep exe
  2⤵
  PID:1206
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1208
- /bin/grep
  grep exe
  2⤵
  PID:1211
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1210
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1213
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1215
- /bin/grep
  grep exe
  2⤵
  PID:1216
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1218
- /bin/grep
  grep exe
  2⤵
  PID:1221
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1220
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1223
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1225
- /bin/grep
  grep exe
  2⤵
  PID:1226
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1228
- /bin/grep
  grep exe
  2⤵
  PID:1231
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1230
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1233
- /bin/grep
  grep exe
  2⤵
  PID:1236
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1235
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1238
- /bin/grep
  grep exe
  2⤵
  PID:1241
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1240
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1243
- /bin/grep
  grep exe
  2⤵
  PID:1246
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1245
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1248
- /bin/grep
  grep exe
  2⤵
  PID:1251
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1250
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1253
- /bin/grep
  grep exe
  2⤵
  PID:1256
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1255
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1258
- /bin/grep
  grep exe
  2⤵
  PID:1261
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1260
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1263
- /bin/grep
  grep exe
  2⤵
  PID:1266
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1265
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1268
- /bin/grep
  grep exe
  2⤵
  PID:1271
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1270
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1273
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1275
- /bin/grep
  grep exe
  2⤵
  PID:1276
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1278
- /bin/grep
  grep exe
  2⤵
  PID:1281
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1280
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1283
- /bin/grep
  grep exe
  2⤵
  PID:1286
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1285
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1288
- /bin/grep
  grep exe
  2⤵
  PID:1291
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1290
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1293
- /bin/grep
  grep exe
  2⤵
  PID:1296
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1295
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1298
- /bin/grep
  grep exe
  2⤵
  PID:1301
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1300
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1303
- /bin/grep
  grep exe
  2⤵
  PID:1306
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1305
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1308
- /bin/grep
  grep exe
  2⤵
  PID:1311
- /bin/ls
  ls -latrh /proc/mtd
  2⤵
  PID:1310
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1313
- /bin/grep
  grep exe
  2⤵
  PID:1316
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1315
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1318
- /bin/grep
  grep exe
  2⤵
  PID:1321
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1320
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1323
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1325
- /bin/grep
  grep exe
  2⤵
  PID:1326
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1328
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1330
- /bin/grep
  grep exe
  2⤵
  PID:1331
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1333
- /bin/grep
  grep exe
  2⤵
  PID:1336
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1335
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1338
- /bin/grep
  grep exe
  2⤵
  PID:1341
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1340
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1343
- /bin/grep
  grep exe
  2⤵
  PID:1346
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1345
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1348
- /bin/grep
  grep exe
  2⤵
  PID:1351
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1350
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1353
- /bin/grep
  grep exe
  2⤵
  PID:1356
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1355
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1358
- /bin/grep
  grep exe
  2⤵
  PID:1361
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1360
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1363
- /bin/grep
  grep exe
  2⤵
  PID:1366
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1365
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1368
- /bin/grep
  grep exe
  2⤵
  PID:1371
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1370
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1373
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1375
- /bin/grep
  grep exe
  2⤵
  PID:1376
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1378
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1380
- /bin/grep
  grep exe
  2⤵
  PID:1381
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1383
- /bin/grep
  grep exe
  2⤵
  PID:1386
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1385
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1388
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1390
- /bin/grep
  grep exe
  2⤵
  PID:1391
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1393
- /bin/grep
  grep exe
  2⤵
  PID:1396
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1395
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1398
- /bin/grep
  grep exe
  2⤵
  PID:1401
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1400
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1403
- /bin/grep
  grep exe
  2⤵
  PID:1406
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1405
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1408
- /bin/grep
  grep exe
  2⤵
  PID:1411
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1410
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1413
- /bin/grep
  grep exe
  2⤵
  PID:1416
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1415
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1418
- /bin/grep
  grep -v grep
  2⤵
  PID:1421
- /bin/grep
  grep /dot
  2⤵
  PID:1420
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1422
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1423
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads runtime system information
  PID:1427
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1432
- /bin/grep
  grep -v grep
  2⤵
  PID:1430
- /bin/grep
  grep tracepath
  2⤵
  PID:1429
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1428
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1431
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1433
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1438
- /bin/grep
  grep -v grep
  2⤵
  PID:1436
- /bin/grep
  grep ./ll1
  2⤵
  PID:1435
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1437
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1434
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1440
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1441
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1444
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1443
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1448
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1446
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1449
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1445
- /bin/grep
  grep -v grep
  2⤵
  PID:1447
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1453
- /bin/grep
  grep -v grep
  2⤵
  PID:1452
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1451
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1454
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1450
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1458
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1459
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1456
- /bin/grep
  grep -v grep
  2⤵
  PID:1457
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1455
- /bin/grep
  grep perfctl
  2⤵
  PID:1461
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1464
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1460
- /bin/grep
  grep -v grep
  2⤵
  PID:1462
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1463
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1467
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1466
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1469
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1468
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1472
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1473
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1471
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1474
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1478
- /bin/grep
  grep -v -
  2⤵
  PID:1479
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1477
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1476
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1480
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1484
- /bin/grep
  grep -v -
  2⤵
  PID:1485
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1486
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1482
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1483
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1490
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1489
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1492
- /bin/grep
  grep -v -
  2⤵
  PID:1491
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1488
- /bin/grep
  grep -v -
  2⤵
  PID:1497
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1496
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1498
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1494
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1495
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  PID:1499
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1503
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1504
- /bin/grep
  grep -v grep
  2⤵
  PID:1502
- /bin/grep
  grep agetty
  2⤵
  PID:1501
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1500
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  PID:1505
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1507
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1506
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1508
- /bin/sed
  sed /base64/d
  2⤵
  PID:1510
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1511
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1509
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1514
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1512
- /bin/sed
  sed /python/d
  2⤵
  PID:1513
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1517
- /bin/sed
  sed /shm/d
  2⤵
  PID:1516
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1515
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1520
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1519
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1518
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1523
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1522
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1521
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1526
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1525
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1524
- /bin/sed
  sed /linux/d
  2⤵
  PID:1528
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1529
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1527
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1532
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1531
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1530
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1535
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1534
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1533
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1538
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1537
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1536
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1540
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1541
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1539
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1544
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1542
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1543
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads runtime system information
  PID:1545
- /usr/bin/pkill
  pkill -f htop
  2⤵
  PID:1546
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1548
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads CPU attributes
  PID:1549
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  PID:1550
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  PID:1551
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  PID:1552
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  PID:1553
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1556
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1559
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1557
- /bin/grep
  grep -v -
  2⤵
  PID:1558
- /bin/grep
  grep :1414
  2⤵
  PID:1555
- /bin/grep
  grep -v -
  2⤵
  PID:1564
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1562
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1565
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1563
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1561
- /bin/grep
  grep -v -
  2⤵
  PID:1570
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1568
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1571
- /bin/grep
  grep :143
  2⤵
  PID:1567
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1569
- /bin/grep
  grep -v -
  2⤵
  PID:1576
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1575
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1577
- /bin/grep
  grep :2222
  2⤵
  PID:1573
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1574
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1580
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1581
- /bin/grep
  grep :3333
  2⤵
  PID:1579
- /bin/grep
  grep -v -
  2⤵
  PID:1582
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1583
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1587
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1586
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1589
- /bin/grep
  grep :3389
  2⤵
  PID:1585
- /bin/grep
  grep -v -
  2⤵
  PID:1588
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1592
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1593
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1595
- /bin/grep
  grep :4444
  2⤵
  PID:1591
- /bin/grep
  grep -v -
  2⤵
  PID:1594
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1599
- /bin/grep
  grep -v -
  2⤵
  PID:1600
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1598
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1601
- /bin/grep
  grep :5555
  2⤵
  PID:1597
- /bin/grep
  grep -v -
  2⤵
  PID:1606
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1604
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1605
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1607
- /bin/grep
  grep :6666
  2⤵
  PID:1603
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1610
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1613
- /bin/grep
  grep :6665
  2⤵
  PID:1609
- /bin/grep
  grep -v -
  2⤵
  PID:1612
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1611
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1617
- /bin/grep
  grep -v -
  2⤵
  PID:1618
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1619
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1616
- /bin/grep
  grep :6667
  2⤵
  PID:1615
- /bin/grep
  grep :7777
  2⤵
  PID:1621
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1625
- /bin/grep
  grep -v -
  2⤵
  PID:1624
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1623
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1622
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1628
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1629
- /bin/grep
  grep :8444
  2⤵
  PID:1627
- /bin/grep
  grep -v -
  2⤵
  PID:1630
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1631
- /bin/grep
  grep -v -
  2⤵
  PID:1636
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1634
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1635
- /bin/grep
  grep :3347
  2⤵
  PID:1633
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1637
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1641
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1640
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1643
- /bin/grep
  grep :14444
  2⤵
  PID:1639
- /bin/grep
  grep -v -
  2⤵
  PID:1642
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1647
- /bin/grep
  grep -v -
  2⤵
  PID:1648
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1649
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1646
- /bin/grep
  grep :14433
  2⤵
  PID:1645
- /bin/grep
  grep -v -
  2⤵
  PID:1654
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1652
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1655
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1653
- /bin/grep
  grep :13531
  2⤵
  PID:1651
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1656
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1658
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1657
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1659
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1661
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1660
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  PID:1662
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1664
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1663
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1665
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1667
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1666
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  - Attempts to change immutable files
  PID:1668
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1670
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1669
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  PID:1671
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1673
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1672
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1674
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1675
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1676
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  PID:1677
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1678
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1679
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  PID:1680
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1683
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1682
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1684
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1687
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1686
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  - Attempts to change immutable files
  PID:1688
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1690
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1689
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  - Attempts to change immutable files
  PID:1691
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1693
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1692
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  PID:1694
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1695
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads runtime system information
  PID:1696
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  PID:1697
- /usr/bin/pkill
  pkill -f monero
  2⤵
  PID:1698
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  PID:1699
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  PID:1700
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads runtime system information
  PID:1701
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  PID:1702
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  PID:1703
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  PID:1704
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1705
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  PID:1706
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  PID:1707
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1708
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  PID:1709
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  PID:1710
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1711
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads runtime system information
  PID:1712
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1713
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  PID:1714
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads CPU attributes
  PID:1715
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  PID:1716
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1717
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  PID:1718
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  PID:1719
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  PID:1720
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads runtime system information
  PID:1721
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  PID:1722
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1723
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1724
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1725
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  PID:1726
- /bin/grep
  grep -v grep
  2⤵
  PID:1729
- /bin/grep
  grep ./udp
  2⤵
  PID:1728
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1731
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1727
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1730
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1736
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1735
- /bin/grep
  grep ./oka
  2⤵
  PID:1733
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1732
- /bin/grep
  grep -v grep
  2⤵
  PID:1734
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1740
- /bin/grep
  grep -v grep
  2⤵
  PID:1739
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1738
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1741
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1737
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1745
- /bin/grep
  grep -v bin
  2⤵
  PID:1744
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1747
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1748
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1743
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads runtime system information
  PID:1742
- /bin/grep
  grep -v "("
  2⤵
  PID:1746
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1750
- /bin/grep
  grep -v postgres
  2⤵
  PID:1749
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1751
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1753
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1752
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1757
- /bin/grep
  grep -v bin
  2⤵
  PID:1756
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1759
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1755
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1760
- /bin/grep
  grep -v "("
  2⤵
  PID:1758
- /bin/grep
  grep -v postgres
  2⤵
  PID:1761
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1754
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1762
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1763
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1764
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1768
- /bin/grep
  grep -v bin
  2⤵
  PID:1767
- /bin/grep
  grep -v "("
  2⤵
  PID:1769
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1771
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  PID:1765
- /bin/grep
  grep -v postgres
  2⤵
  PID:1772
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1770
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1773
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1774
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1775
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1766
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1778
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1780
- /bin/grep
  grep -v grep
  2⤵
  PID:1777
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1779
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1776
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1784
- /bin/grep
  grep -v grep
  2⤵
  PID:1783
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1782
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1781
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1785
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1789
- /bin/grep
  grep -v grep
  2⤵
  PID:1788
- /bin/grep
  grep ./crun
  2⤵
  PID:1787
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1790
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1786
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1795
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1794
- /bin/grep
  grep -v grep
  2⤵
  PID:1793
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1792
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1791
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1801
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1800
- /bin/grep
  grep :3333
  2⤵
  PID:1799
- /bin/grep
  grep -v grep
  2⤵
  PID:1798
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1797
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1806
- /bin/grep
  grep :5555
  2⤵
  PID:1804
- /bin/grep
  grep -v grep
  2⤵
  PID:1803
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1802
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1805
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1809
- /bin/grep
  grep -v grep
  2⤵
  PID:1808
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1811
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1810
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1807
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1816
- /bin/grep
  grep log_
  2⤵
  PID:1814
- /bin/grep
  grep -v grep
  2⤵
  PID:1813
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1815
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1812
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1820
- /bin/grep
  grep systemten
  2⤵
  PID:1819
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1821
- /bin/grep
  grep -v grep
  2⤵
  PID:1818
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1817
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1825
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1826
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:1827
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:1827
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:1827
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:1827
- - /sbin/kill
    kill -9 14
    3⤵
    PID:1827
- - /bin/kill
    kill -9 14
    3⤵
    PID:1827
- /bin/grep
  grep -v grep
  2⤵
  PID:1823
- /bin/grep
  grep netns
  2⤵
  PID:1824
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1822
- /bin/grep
  grep voltuned
  2⤵
  PID:1830
- /bin/grep
  grep -v grep
  2⤵
  PID:1829
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1831
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1832
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1828
- /bin/grep
  grep -v grep
  2⤵
  PID:1834
- /bin/grep
  grep darwin
  2⤵
  PID:1835
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1836
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1837
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1833
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1842
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1843
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1839
- /bin/grep
  grep -v grep
  2⤵
  PID:1840
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1849
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1847
- /bin/grep
  grep -v grep
  2⤵
  PID:1846
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1848
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1845
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1854
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1853
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1852
- /bin/grep
  grep -v grep
  2⤵
  PID:1851
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1850
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1859
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1857
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1858
- /bin/grep
  grep -v grep
  2⤵
  PID:1856
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1855
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1863
- /bin/grep
  grep -v grep
  2⤵
  PID:1861
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1864
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1862
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1860
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1869
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1867
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1868
- /bin/grep
  grep -v grep
  2⤵
  PID:1866
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1865
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1874
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1873
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1872
- /bin/grep
  grep -v grep
  2⤵
  PID:1871
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1870
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1879
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1877
- /bin/grep
  grep -v grep
  2⤵
  PID:1876
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1875
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1878
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1883
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1882
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1884
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1880
- /bin/grep
  grep -v grep
  2⤵
  PID:1881
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1888
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1889
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1887
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1885
- /bin/grep
  grep -v grep
  2⤵
  PID:1886
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1894
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1893
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1892
- /bin/grep
  grep -v grep
  2⤵
  PID:1891
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1890
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1897
- /bin/grep
  grep -v grep
  2⤵
  PID:1896
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1899
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1898
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1895
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1904
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1903
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1902
- /bin/grep
  grep -v grep
  2⤵
  PID:1901
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1900
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1909
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1908
- /bin/grep
  grep -v grep
  2⤵
  PID:1906
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1907
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1905
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1913
- /bin/grep
  grep -v grep
  2⤵
  PID:1911
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1912
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1914
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1910
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1917
- /bin/grep
  grep -v grep
  2⤵
  PID:1916
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1919
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1918
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1915
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1923
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1922
- /bin/grep
  grep -v grep
  2⤵
  PID:1921
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1924
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1920
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1927
- /bin/grep
  grep -v grep
  2⤵
  PID:1926
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1929
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  PID:1925
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1928
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1933
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1932
- /bin/grep
  grep -v grep
  2⤵
  PID:1931
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1934
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1930
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1938
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1937
- /bin/grep
  grep -v grep
  2⤵
  PID:1936
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1939
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1935
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1944
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1942
- /bin/grep
  grep -v grep
  2⤵
  PID:1941
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1943
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1940
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1948
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1949
- /bin/grep
  grep -v grep
  2⤵
  PID:1946
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1947
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1945
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1954
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1952
- /bin/grep
  grep -v grep
  2⤵
  PID:1951
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1953
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1950
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1959
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1957
- /bin/grep
  grep -v grep
  2⤵
  PID:1956
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1955
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1958
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1964
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1963
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1962
- /bin/grep
  grep -v grep
  2⤵
  PID:1961
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1960
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1967
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1968
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1969
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1965
- /bin/grep
  grep -v grep
  2⤵
  PID:1966
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1973
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1974
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1970
- /bin/grep
  grep -v grep
  2⤵
  PID:1971
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:1972
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1979
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:1977
- /bin/grep
  grep -v grep
  2⤵
  PID:1976
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1978
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1975
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1984
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1983
- /bin/grep
  grep -v grep
  2⤵
  PID:1981
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1980
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:1982
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1989
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:1987
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1985
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1988
- /bin/grep
  grep -v grep
  2⤵
  PID:1986
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1994
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:1992
- /bin/grep
  grep -v grep
  2⤵
  PID:1991
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1990
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1993
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1999
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:1997
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1998
- /bin/grep
  grep -v grep
  2⤵
  PID:1996
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1995
- /bin/grep
  grep -v grep
  2⤵
  PID:2001
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2003
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2002
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2004
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2000
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2008
- /bin/grep
  grep -v grep
  2⤵
  PID:2006
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2009
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2005
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2007
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2015
- /bin/grep
  grep -v grep
  2⤵
  PID:2013
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2014
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2012
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2019
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2018
- /bin/grep
  grep -v grep
  2⤵
  PID:2017
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2020
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2016
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2025
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2023
- /bin/grep
  grep -v grep
  2⤵
  PID:2022
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2024
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2021
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2029
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2030
- /bin/grep
  grep -v grep
  2⤵
  PID:2027
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2028
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2026
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2035
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2033
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2034
- /bin/grep
  grep -v grep
  2⤵
  PID:2032
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2031
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2039
- /bin/grep
  grep -v grep
  2⤵
  PID:2037
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2038
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2040
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2036
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2044
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2043
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2045
- /bin/grep
  grep -v grep
  2⤵
  PID:2042
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2041

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
ce4ad0aceabb397eaec130e94f7206ba

SHA1
3c5287f1535094b6dfc0f15fa3ab2950a7a09c4c

SHA256
733b699bcd51fa988059edfe56bbbdc6c99a4041a3db59170cd484ddd0b5343d

SHA512
2597e2ae57e76f0f267ff5b45f208de0c5ce783fb5905c4e22135f8d587801c3c2ecf5aa97444d7c296f393857b28a89f9c497b5ee2b2231b71603ae3de0134d

Download Submit
/var/mail/user

Filesize
1KB

MD5
a0fc7eaf1fade1051b6013f05d633321

SHA1
a40e87a18ec4719ae9c88f243a5b58f8de15e63a

SHA256
9be5f53d30201224f132c609bf489448d4edeee49e326d5c1a33755a82b24bb0

SHA512
8dcec21a49db597649eedcf475233a9f4432bffd3e5dcbd9c8e3770f8d070886e185cab2983387e9d80f37b78189d33d44f26b265c6bdfd22e36e3d70fcb45c0

Download Submit
/var/spool/cron/crontabs/tmp.PRlChb

Filesize
175B

MD5
c4fab7fa6e83671067e6c31c1388810d

SHA1
df0960bde8c7661f200d63b2ae6250a9064c0a69

SHA256
599c877b30efffbc8eb5cf41bc7f8a5d706f61fa609b7194e9bf9baeda325e52

SHA512
0373a340457990675cb67d015a6fa6e3f2a73a51dc2d4739e4a6520f545456e33fe88140da97dedb920747bfdcf8f05905fc7834d44682f1b4fb65c1099ab37d

Download Submit
/var/spool/cron/crontabs/tmp.TNnW18

Filesize
175B

MD5
62a71e7bd434aafe94eb59e06327a781

SHA1
63a068c71d75c718d6dd0613e8093bd6af3708cd

SHA256
559e1366a36de26e7f7b07750263e2f2c103a1a802632dd1710de0535ce7c1f8

SHA512
e79c3b6a730e2cffef3b09bb791543cbe3272340f86b41c5cc8352a95258dc37cf12bf5e1202fb0702fdda9303c023dc84168dd55020bb5e832bdba562bfaeb7

Download Submit
/var/spool/cron/crontabs/tmp.uo2Mfc

Filesize
175B

MD5
3d0705232189d39538cbf17a1dba8c59

SHA1
11a4ea253d2766fc53468f0f6e11b13c2a1f1ddb

SHA256
d0392ca58b37dd495929a06e1c037a21d81b424c551a19f30186c44b4d42a92d

SHA512
a92c88a04c8d9e33565a72f26e27d2e2ce529b5a605235107eace021c3a2fedeaae2b187e93eedcda7f07a0892964bdd95e82d9f48829dbc3256f125b3c9255d

Download Submit
/var/spool/exim4/input/1tmOIR-0000B3-Vq-D

Filesize
128B

MD5
e1a0828aa8dd35b8ac30980f37298312

SHA1
3a295b1975bc88fe3f1259b757ea864aab7c08f7

SHA256
eb29469e94a3006179e7355fd9a4e95cbc3b626f3732f13a11362de1fd2242d7

SHA512
5e787d005b3046a541ff7fcd8bb232dcc864beb80946687a3b329d6d863156f4065129ec3d4577cd8c018e12a19ba2144f98e9176457cbe8db6d7956f5151425

Download Submit
/var/spool/exim4/input/1tmOIR-0000B3-Vq-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmOIS-0000B6-1f-D

Filesize
146B

MD5
66722e2c148971ccfad1f18ac79546aa

SHA1
2e683cb890316cad47f2808a45155c877841037a

SHA256
cad4ec7201836dfa9683c837cd7169000216561ba68a76aa5c0a812a69a5746d

SHA512
0f9060f8b8366d1274484ebc112d2c3df76940256fc57fd2a15e1e3357492d64f1f666b74790f26639da362ac7c7d3fa9dbf5f82102641f7444aa4657f25a5da

Download Submit
/var/spool/exim4/input/hdr.685

Filesize
915B

MD5
07bb5f727421a14d434d071e5437c848

SHA1
19dc73c1265df4c451a15185a6e7ff47b146240e

SHA256
b48afd6e73e2da5b4b151d2886b88fb2b0cc86dc5a6effd87fa81245454c251f

SHA512
845e264b6526d6270f1f25f1cdf7fb1301b72fd6c6dafa7c2d8f483ba48a1cd85ed518fd33e245011a1b141b32cd057706bd18fccfd69bbc75058b48243bd053

Download Submit
/var/spool/exim4/input/hdr.688

Filesize
915B

MD5
67d159329a3a524d11f6c89d2fb44fdf

SHA1
218136ab2fb73b4cce8642bfb21d48d43595ce04

SHA256
0ce1c5b45a42617f7a60264a5f5920637a43707074774afc935bffccd9f3207c

SHA512
90e8f0be07b7cff02bdbbd970476365487f535bfb1f8cc147cd7be6a2c88bc9cca1f7c8ab8340c8a9a3ed7381ae47b27d0d912c44a1cddbf4e5aecbda569426c

Download Submit
/var/spool/exim4/msglog/1tmOIR-0000B3-Vq

Filesize
288B

MD5
b4831ca705ff7990a8299102161c0b23

SHA1
f414e6ea536e3adfe199e62048a5df2430014142

SHA256
06c8f0d56ed5e0999b50a058ac516ed7cc036b6e5262d68330e4bfe9dde3a465

SHA512
816d10aa71bae19e6894353949d7daa4881f71290328cc3ebec30363a28ce69eca6384f22998bfea96cdb3ef3cabd9f12a83a77eb980c3dc402c47234b519e7d

Download Submit
/var/spool/exim4/msglog/1tmOIR-0000B3-Vq

Filesize
89B

MD5
d77c639f66bbb16f2067ab0328192ee0

SHA1
b3133d40ba941bf72bf0a8341c25e7be55d6cd30

SHA256
ef618fbc7e4557f923962add5c9d608816b2b926576ce97d459050e56b05eea7

SHA512
55e7621783e81ab0e52075793db04c0404a98066abf5754fc7b0d97c885b66dd7893635b5bfc1223e8877b4dd1d29cfb1c30fd244c9630bf7af2477b62e53a9e

Download Submit
/var/spool/exim4/msglog/1tmOIS-0000B6-1f

Filesize
89B

MD5
2f356c03275e53230846ef6d182aeba4

SHA1
ac971a5c6b4a8a638a0df7d9768b105342b7441e

SHA256
93f6ccdb93ccebe0a890b53e21c5b6dabe375fed5db1de568431248d2e99c1e3

SHA512
fd529c8929b04a851f72ba541d03ead6cbc47e1ff1c1af9234a4e10f72ed5cb1d21a2a5841cfc7069ad2c9875bc6b788fdc7f864beee8ea9a6135fc23bd1c3f4

Download Submit
/var/spool/exim4/msglog/1tmOIS-0000B6-1f

Filesize
288B

MD5
833fa3f9ff1022d7da52023916f77c61

SHA1
319efdc416b7ccfc45a06715e6c3773457dd4144

SHA256
a93755ceffa2c8126f09f49316895be5941657cb577f63fbcb745c70d7ffc54b

SHA512
2b7c14a91c7fabd32688ec901e56779b8b01b0e1f56b237cce34d9b89e0bbe0140b9cbb87ef35933b1254ac2d95a7e8c84c655e8e3afa33f839ca33a4950bfbf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads