<?xml version="1.0" encoding="utf-8"?>
<Filters xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="filters.xsd">

	<!-- 2023-09-22T20:49:00.000Z-1695415754 -->

<!-- ############################################################################################################### -->
<!-- Part 0000 2021-01-22T18:06:00.000Z -->
	<Image Id="{44472A2E-D28D-EE0F-8D84-B3D5CDA06634}" Path="*/prlshprint" />
    <Image Id="{094C3856-951F-DA56-40EF-2C6517BE6A9D}">
        <Process Path="*/prlshprint" />
    </Image>
    <Image Id="{C46B04CE-0751-957A-76FA-97A61612C9FA}" CmdLine="/kesl-supervisor start*" /> 
    <Image Id="{137019D0-ECB7-BCEF-A7DD-AAA7B9CE1BA4}">
        <ParentProcess CmdLine="/bin/sh -u /opt/kaspersky/kesl/libexec/kesl_launcher.sh*" />
    </Image>  
    <Image Id="{FB25986C-F830-8068-781A-FF9ADBDC9C52}">
        <Process CmdLine="/bin/sh -u /opt/kaspersky/kesl/libexec/kesl_launcher.sh*" />
    </Image>
    <Image Id="{29128EDA-C155-5DC5-C659-51ACBD9A9101}" CmdLine="*libexec/kesl_launcher.sh*" />
    <Image Id="{FD1DF3F7-6E15-CB7E-454E-CC1B41E6FE30}" CmdLine="pidof /opt/kaspersky/kesl/libexec/wdserver" />
    <Image Id="{6962E396-6D33-BE1F-8F99-41E6D99C115F}" CmdLine="sh -c ip *">
        <Process Path="/usr/sbin/hypervkvpd" />
    </Image>
	<Image Id="{9FEDDDE1-5D29-7A36-DBD4-C299371C44DD}" CmdLine="sh -c /usr/libexec/hypervkvpd/hv_get_dhcp_info*">
        <Process Path="/usr/sbin/hypervkvpd" />
    </Image>
	<Image Id="{DA7A98BB-6D51-50D3-BE4B-22ACD1B09314}" CmdLine="(pervkvpd)">
        <Process Path="*/lib/systemd/systemd" />
    </Image>
    <Image Id="{F9CD6405-CD93-AFE3-1FE4-EC94999AA99F}" CmdLine="(pervkvpd)">
        <Process Path="*/sbin/hypervkvpd" />
    </Image>
	<Image Id="{9E97557F-4805-B6BF-E6DF-7EB2077EB362}" CmdLine="sh -c /usr/libexec/hypervkvpd/hv_get_dns_info">
        <Process Path="/usr/sbin/hypervkvpd" />
    </Image>
    <Image Id="{EF456771-C05E-A07F-8A04-DF8761826389}">
        <Process Path="*/bin/bash" />
        <ParentProcess Path="*/sbin/hypervkvpd" />
    </Image>
	<Image Id="{B6ACB647-7221-1EDC-74D0-6EA1C13F15AE}" CmdLine="(lena)">
        <Process Path="/usr/lib/systemd/systemd" />
    </Image>
	<Image Id="{69F61000-4361-8B9E-D42E-DAC99D4A0246}" CmdLine="/bin/sh /opt/kaspersky/epagent/libexec/aushape-audispd-plugin">
        <Process Path="/usr/sbin/audispd" />
    </Image>
	<Image Id="{DCACFB5F-49BA-525E-75CE-B6AEADDDCDF5}" CmdLine="/sbin/audispd">
        <Process Path="/usr/sbin/auditd" />
    </Image>
	<Image Id="{7557BE1A-D0FF-3B4E-B560-5BD57DD60093}" CmdLine="/usr/libexec/postfix/master -w">
        <Process Path="/usr/lib/systemd/systemd" />
    </Image>
	<Image Id="{138240AC-E8D2-E84F-B0B6-267A5ADE22AE}" CmdLine="pickup -l -t unix -u">
        <Process Path="/usr/libexec/postfix/master" />
    </Image>
    <Image Id="{4C0C255A-9558-0289-2AA5-29D34F1435FF}">
        <Process CmdLine="/opt/kaspersky/kesl/libexec/kesl" />
        <ParentProcess Path="*/opt/kaspersky/kesl/libexec/wdserver" />
    </Image>
	<Image Id="{407DCC45-E754-3E6E-31D6-152333E9167D}" CmdLine="(mkfifo)">
        <Process Path="/usr/lib/systemd/systemd" />
    </Image>
	<Image Id="{C3E7759A-3622-9D9A-DEE2-E3DDABADB00E}" CmdLine="(genrules)">
        <Process Path="/usr/lib/systemd/systemd" />
    </Image>
	<Image Id="{CE58C780-3A54-2755-6092-4F67BF2693D0}" CmdLine="(crond)">
        <Process Path="/usr/lib/systemd/systemd" />
    </Image>
	<Image Id="{014D5E6E-E5B5-5756-E755-2630C1B23747}" CmdLine="/usr/lib/systemd/systemd --switched-root --system --deserialize 22*">
        <Process Path="/usr/lib/systemd/systemd" />
    </Image>
	<Image Id="{FC634F7E-4F5F-0108-0E12-927A84EDA828}" CmdLine="/usr/sbin/crond -n">
        <Process Path="/usr/sbin/crond" />
    </Image>
	<Image Id="{F1BEB2F5-374A-9A4C-50D9-DF2C876F5F38}" CmdLine="(rsyslogd)">
        <Process Path="/usr/lib/systemd/systemd" />
    </Image>
	<Image Id="{4F4F3AB2-9900-B398-3092-9519065FF156}" Path="*/bin/sleep" CmdLine="sleep *" />    
	<Image Id="{90A65CA6-EC45-CFF9-7FF9-4B2CAEAE4183}">
        <Process CmdLine="*/bin/gitlab-unicorn-wrapper*" />
    </Image>
	<Image Id="{2165BC0E-0CB9-19C6-0DFF-AACE7DFDC3E6}" CmdLine="*pgrep -fl ?sidekiq*" />
	<Image Id="{488358EF-7AF7-5D07-7587-CC11F30B643E}" CmdLine="*pgrep -fl ?unicorn*" />
	<Image Id="{CD46AD99-CFBA-362A-E84D-7B8061C13322}" CmdLine="*pgrep -fl*">
        <ParentProcess CmdLine="*puma*" />
    </Image>
	 <Image Id="{A24AFFE8-6975-529F-CAC4-2C7A544310DF}" CmdLine="*pgrep -fl*">
        <Process CmdLine="*puma*" />
    </Image>
	<Image Id="{1ABD1348-AF81-E055-2A38-53B92F6015A5}" CmdLine="ps -o rss*" />
	<Image Id="{D19FE14F-C103-1942-7925-FC8AF0A93920}" Path="*/sbin/postqueue">
        <Process CmdLine="*/libexec/netdata/plugins.d/python.d.plugin*" />
    </Image>
	<Image Id="{C98F9BAD-CDE9-63DF-41C0-83352BD8CF19}" CmdLine="*/tc -s qdisc show dev *" />
	<Image Id="{48B87684-E0E5-35DB-E969-D834A3DDFF6F}">
        <Process CmdLine="*/usr/libexec/netdata/plugins.d/tc-qos-helper.sh*" />
    </Image>
	<Image Id="{1BE7D07A-15DF-51ED-ABDC-78EE0060E520}" Path="*/bin/find">
        <Process CmdLine="*sidekiq*" />
    </Image>
    <Image Id="{69CF9D9A-67AD-CD57-B6B3-0021D3839AA4}">
        <Process Path="/usr/sbin/sssd" />
        <ParentProcess Path="*/lib/systemd/systemd" />
    </Image>
    <Image Id="{89EE34A3-58A6-9E60-2438-2313E6E7C7E5}" CmdLine="sshd: root@notty">
        <Process CmdLine="sshd: root@notty" />
    </Image>
    <Image Id="{81C69BCE-B181-7284-274F-D115ACD4B331}" CmdLine="*python*robot*mdrer.listeners.Resulter:AT*MDR*" />
    <Image Id="{C86DF921-A865-941A-3CF9-9D1E52F44183}" CmdLine="/bin/sh /usr/libexec/grepconf.sh -c" />
    <Image Id="{61A83DC3-1406-A6D9-812E-658BD4A6ED15}" CmdLine="grep -qsi ^COLOR.?none /etc/GREP_COLORS" />    
    <Image Id="{F0AD6051-98A4-8508-3ED8-A055B4650A65}" CmdLine="*fuser /run/log/audit-messages*" />
    <Image Id="{D96B4AA0-BFE0-6139-77F0-DD9F99BB8794}">
        <Process CmdLine="*fuser /run/log/audit-messages*" />
    </Image>
    <Image Id="{66F03AC7-DA6E-63F9-FBA7-8DC0CCC07422}" CmdLine="*/opt/kaspersky/epagent/libexec/aushape-audispd-plugin" />
    <Image Id="{96CA73A6-851F-3072-1B09-8FE2B984F875}">
        <Process CmdLine="*/opt/kaspersky/epagent/libexec/aushape-audispd-plugin" />
    </Image>
    <Image Id="{15BA5274-6633-23BD-74B0-8F8B6C164D2B}">
        <ParentProcess Path="/opt/kaspersky/epagent/sbin/lena" />
    </Image>
    <Image Id="{DAC03130-EC3E-77F2-6F0D-2ACEE5BFAF0B}">
        <Process Path="/opt/kaspersky/epagent/sbin/lena" />
    </Image>
    <Image Id="{FDAD90E1-611A-98BA-0760-5CE990448323}" Path="*/bin/watch" CmdLine="*/var/opt/kaspersky/epagent/events/*" />
    <Image Id="{0FAA899A-FAA5-EA55-C85A-0E5C3E2B8592}" CmdLine="*ls /var/opt/kaspersky/epagent/events/*|wc -l" />
    <Image Id="{25662374-3AC3-21E7-E774-884826F9309E}" CmdLine="wc -l" />
    <Image Id="{1EC2FCF1-EC87-9991-5D0B-12095514B39A}" CmdLine="*systemctl status epagent*">
        <ParentProcess Path="*/bin/watch" />
    </Image>
    <Image Id="{89F9AEC7-01FE-A55A-4FA6-76C5E1ADBC84}" CmdLine="*systemctl status epagent*">
        <Process Path="*/bin/watch" />
    </Image>
    <Image Id="{A773D245-2CCB-A869-89B4-B801CC842315}" Path="/opt/kaspersky/klnagent64/sbin/klnagent">
        <ParentProcess Path="*/lib/systemd/systemd" />
    </Image>
    <Image Id="{995054E0-48E5-3AF9-701F-B8C3DCB0C967}" Path="/opt/kaspersky/klnagent64/sbin/klnagent">
        <Process Path="/opt/kaspersky/klnagent64/sbin/klnagent" />
    </Image>
    <Image Id="{52465C50-6D60-150B-190A-499A8A776A82}" Path="/opt/kaspersky/klnagent64/sbin/klnagent">
        <ParentProcess Path="/opt/kaspersky/klnagent64/sbin/klnagent" />
    </Image>
    <Image Id="{BE045D56-ABCD-190A-8ABF-85956B958B01}" Path="/opt/google/chrome/chrome --type=zygote" SysCall="clone" />
    <Image Id="{DE2D5B77-D90A-5EB0-AB85-10AB36A3B104}" Path="/opt/google/chrome/chrome --type=zygote" SysCall="fork" />
    <Image Id="{F039DE4E-AC2F-0001-7329-5FC3770E6785}" Path="/opt/google/chrome/chrome --type=zygote" SysCall="vfork" />
    <Image Id="{6BDD02DB-5090-49C8-401F-7FB9E4742961}" CmdLine="/bin/sh -c command -v debian-sa1 ? /dev/null ?? debian-sa1*" />
    <Image Id="{2A1ACE11-19BC-1680-96B6-44DA2D1C5477}">
        <Process CmdLine="*bin/klnagent -d -from_wd" />
    </Image>
    <Image Id="{47AD0F38-707A-288C-87CD-C593EB6F185E}">
        <Process CmdLine="*/opt/kaspersky/kesl/libexec/kesl_launcher.sh" />
    </Image>
    <Image Id="{29511A7A-9BF2-FFBB-F8CA-B50E3471E546}">
        <Process Path="*bin/klnagent" />
    </Image>
    <Image Id="{0ED80B1E-5CFC-9AD6-76C3-57031B37F92E}">
        <ParentProcess CmdLine="systemd --switched-root --system --deserialize 22*" />
    </Image>
    <Image Id="{2E3D51EF-92AF-10AB-469C-856BF212845E}">
        <ParentProcess CmdLine="*/var/opt/kaspersky/klnagent/tmp/klsc*" />
    </Image>
    <Image Id="{F4042B8F-76D2-B605-EC24-F2864588721A}" CmdLine="*svm_mock_update.sh*">
      <Process Path="/usr/sbin/crond" />
    </Image>
    <Image Id="{A4184AF9-8B0F-EA62-1CDB-E10470ABD035}">
      <Process CmdLine="*svm_mock_update.sh*" />
    </Image>
    <Image Id="{7CB41270-C4CB-5D5E-1F5F-FA5061A937BE}" CmdLine="*/usr/sbin/x2gocleansessions" />
    <Image Id="{6F6668F6-9E96-6C46-E5D1-38698AE1F30D}">
      <Process CmdLine="*/usr/sbin/x2gocleansessions" />
    </Image>
    <Image Id="{083A6944-C27A-0D1A-EDB7-EC2AE5352B03}">
      <ParentProcess CmdLine="*/usr/sbin/x2gocleansessions" />
    </Image>
    <Image Id="{A94C5B54-D56B-128C-2E45-C152462BCB56}" CmdLine="*/watchdog*" />
    <Image Id="{FB8114B2-95E4-92F0-4DBB-DACBBD3E2341}" CmdLine="airflow scheduler -- DagFileProcessorManager" />
    <Image Id="{42FB26FE-2B27-2A70-9FFC-87E7E37F1039}" CmdLine="*-c config_file=?/etc/postgresql/10/main/*" />
    <Image Id="{329E59D0-F763-76AA-9048-F05EFE82F41F}" CmdLine="*performance_sw_epagent.pl*" />
    <Image Id="{F513F6A9-8491-9023-C4DB-C488B2D44A4E}">
      <Process CmdLine="*performance_sw_epagent.pl*" />
    </Image>
    <Image Id="{06E793D1-960C-433E-AFF9-58F7FE210B99}">
      <ParentProcess CmdLine="*performance_sw_epagent.pl*" />
    </Image>
    <Image Id="{4AF26D1E-AF76-660B-109B-2DD921D247CE}" CmdLine="*kaspersky/ksmg/libexec/python*" />
    <Image Id="{961D0411-28C7-85B8-38D0-5C63000058A8}">
      <Process CmdLine="*kaspersky/ksmg/libexec/python*" />
    </Image>
    <Image Id="{34487EEF-3B3B-1591-B657-38D46F5306F1}">
      <ParentProcess CmdLine="*kaspersky/ksmg/libexec/python*" />
    </Image>
    <Image Id="{3F535422-CB0B-4975-6C62-D70230A5B4AA}" CmdLine="*/x2go*" />
    <Image Id="{6E3DDBE1-3FC2-9562-BEEE-BF7E1A509DC5}">
      <Process CmdLine="*/x2go*" />
    </Image>
    <Image Id="{3807B9D4-D222-58CE-1584-2794BA820CCD}">
      <ParentProcess CmdLine="*/x2go*" />
    </Image>
    <Image Id="{B28E8F0B-FBAE-D56F-7CEA-7A02587435CE}" Path="*/bin/make" SysCall="vfork" />
    <Image Id="{A87DCA2C-6834-66D7-D8A5-CADDDAE997AC}" Path="*/bin/make" SysCall="clone" />
    <Image Id="{2CE24034-6C8B-EBCE-4EDB-684F7222D63F}" CmdLine="*bin/makeimg*" SysCall="clone" />
    <Image Id="{679449FE-DC47-9DC8-7795-4A099A29660B}" CmdLine="*bin/makeimg*" SysCall="vfork" />
    <Image Id="{1CBD5B41-E5B2-06AE-04B5-503DBA47C2EB}" CmdLine="*bin/nk-gen-c*" SysCall="vfork" />
    <Image Id="{5C171033-A161-D76C-B632-DE6C8D77680D}" CmdLine="*bin/nk-gen-c*" SysCall="clone" />
    <Image Id="{36EAE6A8-558E-800B-6A7A-180DE26F7C8B}" CmdLine="*toolchain/bin/makekss*" SysCall="clone" />
    <Image Id="{4F61717B-9829-9EA6-96B8-B0F0B0CDF9AE}" CmdLine="*toolchain/bin/makekss*" SysCall="vfork" />
    <Image Id="{01A24D12-25FC-1399-D752-2B409F9CFD41}" CmdLine="*kaspersky/ksmg/libexec/postgresql/postgres -D*" />
    <Image Id="{D0BE65B9-0BA8-3016-148A-40DC2F94BFAB}">
      <Process CmdLine="*kaspersky/ksmg/libexec/postgresql/postgres -D*" />
    </Image>
    <Image Id="{DE968B44-CB18-88ED-B41D-8A4FD9D8B38F}">
      <ParentProcess CmdLine="*kaspersky/ksmg/libexec/postgresql/postgres -D*" />
    </Image>
    <Image Id="{46ECCF02-EBD2-B170-1245-F85B1FC6E73A}" Path="*systemd/systemd*" SysCall="clone" />
    <!-- global fork filter -->
    <Image Id="{5FDADFB0-DAC0-F582-16FE-7BCA257EE291}" SysCall="clone" />
    <Image Id="{E453BA1A-D493-88B2-F68D-C8BC92F1D0C6}" SysCall="fork" />
    <Image Id="{03EB2AF9-BDC8-891A-9270-4BAE362DA0AA}" SysCall="vfork" />
    <!-- fork filter end -->
    <Image Id="{0722CEFC-743A-FF06-A8B9-B02EDED93A38}" CmdLine="*sbin/ksmtuned*" />
    <Image Id="{3C5B3D56-BE0F-4C0A-7B59-0B96CC60AE49}">
      <Process CmdLine="*sbin/ksmtuned*" />
    </Image>
    <Image Id="{DC23CFB7-6AF6-C9C2-F3AD-50DD7C1CBD5F}">
      <ParentProcess CmdLine="*sbin/ksmtuned*" />
    </Image>
    <Image Id="{A5890212-E554-09DD-DF2F-EA3BA041F446}">
      <Process Path="*bin/bash" CmdLine="*for *done*" />
    </Image>
    <Image Id="{688851A6-8634-0DF3-5E8E-BE8A9013D00E}">
      <ParentProcess Path="*bin/bash" CmdLine="*for *done*" />
    </Image>
    <Image Id="{060F8BA3-5724-EC76-7B33-A9F51E27333F}" Path="*/update-notifier" />
    <Image Id="{E75DDAD1-979A-15C7-B910-3D83521903F8}">
      <Process Path="*/update-notifier" />
    </Image>
    <Image Id="{77BBFF8A-C7B2-119B-7A54-8F7200147CB3}">
      <ParentProcess Path="*/update-notifier" />
    </Image>
    <Image Id="{FB9804DC-8531-FDCD-5C57-19E7ACB12C9C}" CmdLine="(smbd)" />
    <Image Id="{13DD6D73-8E08-5FE6-28DE-05963D52D759}">
      <Process CmdLine="*python -m celery worker*" />
    </Image>
    <Image Id="{83786333-710E-8E2A-14EA-12B861552633}">
      <Process Path="*/bin/dockerd" />
      <ParentProcess Path="*/systemd" />
    </Image>
    <Image Id="{BEEDD634-C029-DD99-3524-1C925FA651C3}" Path="/usr/bin/opsAgent" />
    <Image Id="{92EFB8B4-F2BE-69C6-0C04-C8F2757F1323}">
      <Process Path="/usr/bin/opsAgent" />
    </Image>
    <Image Id="{BC9734C8-6B18-DAB8-BC66-DB5F571664B4}">
      <ParentProcess Path="/usr/bin/opsAgent" />
    </Image>
    <Image Id="{A8BF6666-02D8-3AF8-C688-5EB4C42C0ABC}" CmdLine="pve-firewall*" />
    <Image Id="{2F0CB6B7-A27D-E68F-FF74-BCAEB2794D6B}">
      <Process CmdLine="pve-firewall*" />
    </Image>
    <Image Id="{42EC5DD9-1F53-8E67-FE77-6D5E71064AE8}">
      <ParentProcess CmdLine="pve-firewall*" />
    </Image>
    <Image Id="{47E39848-A32B-D6E6-9D40-67F111D4E338}" CmdLine="*bin/airflow scheduler*" />
    <Image Id="{EC088848-8FE4-C31A-A80A-7FB6AC45BFC0}">
      <Process CmdLine="*bin/airflow scheduler*" />
    </Image>  
    <Image Id="{DDE612CF-C1B3-E8BA-A411-0EBFFC2ED60E}">
      <ParentProcess CmdLine="*bin/airflow scheduler*" />
    </Image>
    <Image Id="{C29D0A81-D425-190A-537F-BC297E3A3581}" CmdLine="*bin/airflow webserver*" />
    <Image Id="{3BA0508B-1541-C07A-5FB7-193977CCD8BC}">
      <Process CmdLine="*bin/airflow webserver*" />
    </Image>
    <Image Id="{F103532E-63FF-EDDB-1082-7FAFEFDC631F}">
      <ParentProcess CmdLine="*bin/airflow webserver*" />
    </Image>
    <Image Id="{8C33588C-0221-6514-D0BB-7FA2F158E8D4}">
      <Process Path="*bin/nk-gen-c" />
    </Image>
    <Image Id="{0C8D3CD8-74C7-F772-9560-00CCFBA55AF7}">
      <ParentProcess Path="*bin/nk-gen-c" />
    </Image>
    <Image Id="{C0B29AF5-60F5-BD84-08D2-28CB69BE6EC3}" CmdLine="*ls -l /proc/[0-9]*| grep socket:" />
    <Image Id="{B64D509F-9E88-0881-6183-01B58E4B5314}">
      <Process CmdLine="*ls -l /proc/[0-9]*| grep socket:" />
    </Image>
    <Image Id="{57EBD6E6-772A-D172-D73E-322A11EAA8B8}" CmdLine="*VBoxCreateUSBNode.sh*" />
    <Image Id="{556DA031-8A2C-E2FC-C2F5-1D48CE4E2217}">
      <Process CmdLine="*VBoxCreateUSBNode.sh*" />
    </Image>
    <Image Id="{781F5798-B956-D77B-BF6C-54E805D7C1CD}">
      <ParentProcess CmdLine="*VBoxCreateUSBNode.sh*" />
    </Image>
    <Image Id="{FC40A864-95DF-F152-6047-6B9341BAAE6F}" CmdLine="rm -rf /var/tmp/mkinitramfs*" />
    <Image Id="{179861B5-DA86-B293-FE41-32C2E10EA370}" CmdLine="*bin/go build *" />
    <Image Id="{33C73F86-2D87-F67F-E91B-F60788B3E2CD}">
      <Process CmdLine="*bin/go build *" />
    </Image>
    <Image Id="{7B1F1BD8-4FFE-BDB8-3EA1-0896E153946C}">
      <ParentProcess CmdLine="*bin/go build *" />
    </Image>
    <Image Id="{C80058F5-FD09-0147-7ED6-944853B368C6}" CmdLine="*dpkg --print-foreign-architectures" />
    <Image Id="{D9609B8E-33A8-671E-0842-E771C878978A}" CmdLine="*/update-motd*" />
    <Image Id="{76FC827B-0B7C-7300-DB23-BE0ADE9B418B}">
      <Process CmdLine="*/update-motd*" />
    </Image>
    <Image Id="{FED3E694-E817-DFE0-DC2A-A8DA9DEEE107}">
      <ParentProcess CmdLine="*/update-motd*" />
    </Image>
    <Image Id="{FB8F31B0-0155-8C34-E55F-8F32934829D7}" CmdLine="*php/sessionclean*" />
    <Image Id="{AC92C345-52C6-48C0-EA3D-16544E8F4BEC}">
      <Process CmdLine="*php/sessionclean*" />
    </Image>
    <Image Id="{524C79EB-33E1-6DDC-0728-89F33E2F815B}">
      <ParentProcess CmdLine="*php/sessionclean*" />
    </Image>
    <Image Id="{51D1AC87-6046-17FB-C6B4-EDE6E22E1C01}" Path="*/sbin/iptables">
      <Process Path="*/bin/dockerd" />
    </Image>
    <Image Id="{BC2B9313-E6D3-1FEC-82B2-3C3E58AC2B6F}" Path="*/bin/docker-init">
      <Process Path="*/bin/dockerd" />
    </Image>
    <Image Id="{08CC1DC4-DD03-9466-7CB3-B7FC68138DD3}" Path="*/bin/runc">
      <Process Path="*/bin/dockerd" />
    </Image>
    <Image Id="{EAE8B7D7-70B0-D5FF-B364-74C3DED532A1}" Path="*/bin/unpigz">
      <Process Path="*/bin/dockerd" />
    </Image>
    <Image Id="{35C5D08B-339E-DF68-9315-0C66FE2152AF}" CmdLine="*/ifupdown-hotplug">
      <Process Path="*bin/unpigz" />
    </Image>
    <Image Id="{CC9E1EE1-16DB-6958-AED5-5C31E8CCFE05}">
      <Process CmdLine="*/hypervkvpd -n" />
    </Image>
    <Image Id="{79F9562C-D744-DA22-192E-3708BA476C43}">
      <ParentProcess CmdLine="*/hypervkvpd -n" />
    </Image>
    <Image Id="{3A964DDC-E3AC-34DA-04B7-600136C98BE3}" CmdLine="*/vmware/nsx-netopa/*" />
    <Image Id="{8437B91B-5DEB-F8D2-E486-80021D173B0C}">
      <Process CmdLine="*/vmware/nsx-netopa/*" />
    </Image>
    <Image Id="{243C72B0-3764-62DD-B835-1D3813B91FD0}">
      <ParentProcess CmdLine="*/vmware/nsx-netopa/*" />
    </Image>
    <Image Id="{A55F7051-475D-64BE-7CE2-72B2BAF06027}" CmdLine="*buildroot/support/scripts/fix-rpath target" />
    <Image Id="{017D9DB1-7B2D-18E7-9317-683CDB245E83}">
      <Process CmdLine="*buildroot/support/scripts/fix-rpath target" />
    </Image>
    <Image Id="{6D62260D-89C4-6C01-9647-20883FF92EAA}">
      <ParentProcess CmdLine="*buildroot/support/scripts/fix-rpath target" />
    </Image>    
    <Image Id="{4EBB07C6-F007-E633-55B1-1428FBB3429B}">
      <Process Path="*/perl" CmdLine="pvestatd" />
    </Image>
    <Image Id="{9883EFB5-894B-9F2B-EA8D-8E1CBC3875B9}">
      <ParentProcess Path="*/perl" CmdLine="pvestatd" />
    </Image>
    <Image Id="{34BF7EA4-B32B-2B20-BA28-3ED32DF37D45}" CmdLine="*/perl -w /sbin/ebtables-save" />
    <Image Id="{EB34A47D-8A3B-6C29-005D-8CC7F86D2FCE}">
      <Process CmdLine="*/perl -w /sbin/ebtables-save" />
    </Image>
    <Image Id="{2ABAF924-B668-CAA8-A4DB-3CA322FA7C23}">
      <ParentProcess CmdLine="*/perl -w /sbin/ebtables-save" />
    </Image>
<!-- Part 0000 2021-01-22T18:06:00.000Z -->
<!-- ############################################################################################################### -->

<!-- ############################################################################################################### -->
<!-- Part 0001 2021-12-01T21:43:00.000Z-1638395012 -->
	<Image Id="{7E6CD287-C390-F36D-9B5192A14A004EAC}" CmdLine="/bin/bash /sbin/augenrules --load" />
	<Image Id="{FB9E1B68-397B-4429-B3DAC0C2415E46D4}" CmdLine="/bin/bash /sbin/service auditd stop" />
	<Image Id="{42BCF229-CA4E-39A3-33B8468CF48E0548}" CmdLine="systemctl --full --no-legend --no-pager --type=service --property=loadstate show auditd.service" />
	<Image Id="{06939141-8C27-0FFB-3EC10FA51B4CDACF}" CmdLine="/bin/sh /sbin/augenrules --load" />
	<Image Id="{D45B04FE-DB37-31AB-22DB8E4E82E1994B}" CmdLine="/bin/sh /sbin/service auditd stop" />
	<Image Id="{8AEF9B5A-3BFB-5BF6-0DEE1FBE4B408947}" CmdLine="/bin/sh /opt/kaspersky/epagent/libexec/aushape-audispd-plugin*" />
	<Image Id="{C67C6303-BD51-1DD1-39E230585863CA6D}" CmdLine="/usr/bin/pgrep -x -u 0 auditd" />
	<Image Id="{22AD5EBD-AF95-3ACB-0C5BB33A5CC7FEE1}" CmdLine="cat /etc/audit/rules.d/k*" />
	<Image Id="{E0E620A7-FA2C-129C-B767B02238BCD820}" CmdLine="systemctl --full --no-legend --no-pager --property=needdaemonreload show auditd.service" />
	<Image Id="{8EBF7016-465B-3DC7-14770433FA21711D}" CmdLine="grep \.rules$" />
	<Image Id="{AB93632C-60B8-EF20-52669CFAF65570F3}" CmdLine="mktemp /tmp/aurules.xxxxxxxx" />
	<Image Id="{044CE2A7-3FBE-9FEC-A48F29694FA49778}" CmdLine="/bin/ls -1v /etc/audit/rules.d" />
	<Image Id="{9A12A225-4718-6C3E-5B93BA70B37EBF34}" CmdLine="/sbin/auditctl -r /etc/audit/audit.rules" />
	<Image Id="{C8C490B2-A7BB-4BDF-A8D2CC20D9B83584}" CmdLine="awk &#10;begin   {&#10;        minus_e =" />
	<Image Id="{F828AE6B-DDFB-6F31-75FD37600E36607E}" CmdLine="/sbin/audispd" />
	<Image Id="{4D08C543-7280-EA62-BA839DC3FFE39BA0}" CmdLine="/usr/bin/perl /usr/bin/utfd" />
	<Image Id="{21C29453-97CE-9329-B4B7DD98FA608F16}" CmdLine="/sbin/auditd*" />
	<Image Id="{238CE0A8-53D2-A058-DD2B13939BBB3DCF}" CmdLine="/opt/kaspersky/kesl/libexec/kesl" />
	<Image Id="{78876258-47FC-6023-E9ED9CA4C891521F}" CmdLine="/opt/kaspersky/epagent/sbin/aushape -l json --fold=1 -o file" />
	<Image Id="{B12D6040-FE5E-AE93-7B21C3E00BE0295A}" CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" />
	<Image Id="{6C363D40-BB1E-1F18-CC6577154CB96CA6}" CmdLine="/bin/sh /tmp/utf/utf_job_*.sh" />
	<Image Id="{799FB6AD-5534-2926-B6FC8F1EDB7B3C72}" CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" >
		<ParentProcess CmdLine="systemctl --full --no-legend --no-pager --property*" />
	</Image>
	<Image Id="{1139951F-27BD-61D4-887679267C5338D2}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="systemctl --full --no-legend --no-pager --property*" />
	</Image>
	<Image Id="{130F48EC-D343-C890-EA1C8433575E929A}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="systemctl --full --no-legend --no-pager --property*" />
	</Image>
	<Image Id="{C4B6D684-FD72-9BBE-EDB886EA5F7CD9C9}" CmdLine="/bin/sh /tmp/utf/utf_job_*" >
		<ParentProcess CmdLine="systemctl --full --no-legend --no-pager --property*" />
	</Image>
	<Image Id="{C985F84F-5F6B-8393-B98A1F1E887D690C}" CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" >
		<ParentProcess CmdLine="/bin/sh /opt/kaspersky/epagent/libexec/aushape-audispd-plugin" />
	</Image>
	<Image Id="{F24CD8BE-9B12-0EBC-AF3FEFF1B71ED0DF}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/sh /opt/kaspersky/epagent/libexec/aushape-audispd-plugin" />
	</Image>
	<Image Id="{445DA314-DEE5-E81D-DFF52546F62D024E}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/sh /opt/kaspersky/epagent/libexec/aushape-audispd-plugin" />
	</Image>
	<Image Id="{FA4847E2-BAD3-EA02-AEF95EAD1F1C8BE9}" CmdLine="/bin/sh /tmp/utf/utf_job_*" >
		<ParentProcess CmdLine="/bin/sh /opt/kaspersky/epagent/libexec/aushape-audispd-plugin" />
	</Image>
	<Image Id="{A893B732-909A-671B-6F37A7E8D4116524}" CmdLine="/bin/sh -c  /root/bin/utf_*" >
		<ParentProcess CmdLine="ssh -q -o stricthostkeychecking no -o userknownhostsfile /dev/null -o serveraliveinterval*" />
	</Image>
	<Image Id="{B4F10781-89DE-D16F-0E24BB2A62353818}" CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" >
		<ParentProcess CmdLine="ssh -q -o stricthostkeychecking no -o userknownhostsfile /dev/null -o serveraliveinterval*" />
	</Image>
	<Image Id="{5A9CC0F7-1CFF-7DDE-BF76DA6E5FA2914F}" CmdLine="/bin/sh /tmp/utf/utf_job_*" >
		<ParentProcess CmdLine="ssh -q -o stricthostkeychecking no -o userknownhostsfile /dev/null -o serveraliveinterval*" />
	</Image>
	<Image Id="{A3070AF6-15F7-EF95-F92A80915C594402}" CmdLine="scp -q -o stricthostkeychecking no*" >
		<ParentProcess CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" />
	</Image>
	<Image Id="{78F3568D-1AA7-C993-A3BC0C52249FBFEC}" CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" >
		<ParentProcess CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" />
	</Image>
	<Image Id="{E476A3B5-2E84-AAB7-117672C517963136}" CmdLine="/usr/bin/ssh -x -opermitlocalcommand=no*" >
		<ParentProcess CmdLine="sh -c scp -q  -o &#39;stricthostkeychecking no*" />
	</Image>
	<Image Id="{1E6698F3-3F42-A43C-E5EF475894E99B37}" CmdLine="/usr/bin/ssh -x -opermitlocalcommand=no*" >
		<ParentProcess CmdLine="scp -q -o stricthostkeychecking no -o userknownhostsfile*" />
	</Image>
	<Image Id="{A1CBB72F-C62E-9F0C-BF59C78599B168BB}" CmdLine="bzip2 -f /var/log/unixtestingframework*" >
		<ParentProcess CmdLine="find /var/log/unixtestingframework*" />
	</Image>
	<Image Id="{98BF2E29-E5DE-55DA-7E818C95697C1892}" CmdLine="ssh -q -o stricthostkeychecking no*" >
		<ParentProcess CmdLine="/bin/sh /tmp/utf/utf_job_*.sh" />
	</Image>
	<Image Id="{4AD219BA-76E5-45CD-EAC58AB9244D9BBF}" CmdLine="ssh -q -o stricthostkeychecking no*" >
		<ParentProcess CmdLine="/usr/bin/perl /usr/bin/utfd" />
	</Image>
	<Image Id="{A4733B0C-C035-BE1A-988FBCDE7ACDD691}" CmdLine="systemctl stop --full auditd.service" >
		<ParentProcess CmdLine="/bin/bash /sbin/service auditd stop" />
	</Image>
	<Image Id="{D4DB5038-2636-FA57-2C374F2AD67909BF}" CmdLine="systemctl stop --full auditd.service" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd stop" />
	</Image>
	<Image Id="{BC0F1D49-5B03-3B8C-ECF940B75D9AE812}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/bash /sbin/augenrules --load" />
	</Image>
	<Image Id="{2B486AE1-F99C-2CDC-3ED1EB99B55CE75A}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/bash /sbin/service auditd stop" />
	</Image>
	<Image Id="{6430E386-283D-4096-33CCB9A3134F5FB1}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/opt/kaspersky/kesl/libexec/kesl" />
	</Image>
	<Image Id="{5D9C1885-59C7-9B34-9C6F50C9E3E0B1FF}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/sbin/audispd" />
	</Image>
	<Image Id="{52D914A2-C8EB-3B9D-29F6DB6FEB01EDBB}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/sbin/auditd*" />
	</Image>
	<Image Id="{D176AFAE-AA53-D0D3-BABACB5CCD9B972C}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/usr/bin/perl /usr/bin/utfd*" />
	</Image>
	<Image Id="{76050E73-18B1-2403-7EFC9E328771867B}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/usr/bin/pgrep -x -u 0 auditd" />
	</Image>
	<Image Id="{8950D235-1341-0082-97C8B33CDD13B75E}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="awk &#10;begin   {&#10;        minus_e =*" />
	</Image>
	<Image Id="{F77CABDC-85F7-21F7-5F452A1D5A962E6F}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="mktemp /tmp/aurules.xxxxxxxx" />
	</Image>
	<Image Id="{7290F5B1-3EFB-9FA0-A67AABD92726317F}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/sh /sbin/augenrules --load" />
	</Image>
	<Image Id="{90278729-4317-495A-53272B603A2FAEB5}" CmdLine="rm -f /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd stop" />
	</Image>
	<Image Id="{177801C5-39DC-A406-66DB48490DCCDE70}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/bash /sbin/augenrules --load" />
	</Image>
	<Image Id="{21FDBBA7-4A9E-396E-057A81ECEBF575B8}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/bash /sbin/service auditd stop" />
	</Image>
	<Image Id="{40FDDA44-561B-F79A-BEB21D13B5B7E50A}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/opt/kaspersky/kesl/libexec/kesl" />
	</Image>
	<Image Id="{AC520C35-731C-4113-C9CABB9B51366F0D}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/sbin/audispd" />
	</Image>
	<Image Id="{AAEB991E-B5B4-E0FD-384152807983AC0B}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/sbin/auditd*" />
	</Image>
	<Image Id="{A58C77C0-6493-D91D-A00B68E36B7FC556}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/usr/bin/perl /usr/bin/utfd*" />
	</Image>
	<Image Id="{4E4FB19A-FA73-6E16-41AC61BF36818431}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/usr/bin/pgrep -x -u 0 auditd" />
	</Image>
	<Image Id="{00FE3B7B-A8EE-DFAF-0C870A89B380B89D}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="awk &#10;begin   {&#10;        minus_e*" />
	</Image>
	<Image Id="{B0343870-65E0-E5F0-2C322A3EFCE3BA27}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="mktemp /tmp/aurules.xxxxxxxx" />
	</Image>
	<Image Id="{C0C4700E-AE84-7F66-3FBE99C8F5E8D5E6}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/bin/bash /sbin/augenrules --load" />
	</Image>
	<Image Id="{9025BB6F-2ACB-7AA2-B7C710EC006EA9CC}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/bin/bash /sbin/service auditd stop" />
	</Image>
	<Image Id="{5BB4D894-D2BD-67CC-361800E11A8DEA4A}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/opt/kaspersky/kesl/libexec/kesl" />
	</Image>
	<Image Id="{A64289D4-9CB7-6325-C95AF0465495319B}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/sbin/audispd" />
	</Image>
	<Image Id="{A1F4ECD4-A646-9969-F28789FECCA40AF0}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/sbin/auditd*" />
	</Image>
	<Image Id="{9F7D7589-BCB7-493A-FF2E9206B90A70FD}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/usr/bin/perl /usr/bin/utfd*" />
	</Image>
	<Image Id="{27AD4CA3-30A5-430E-DD248D2422163703}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/usr/bin/pgrep -x -u 0 auditd" />
	</Image>
	<Image Id="{3E7EE5DC-A117-1694-80A9C8C6374189A0}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="awk &#10;begin   {&#10;        minus_e*" />
	</Image>
	<Image Id="{239E1F11-DF1E-5A8F-FC4D03065DC38845}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="mktemp /tmp/aurules.xxxxxxxx" />
	</Image>
	<Image Id="{F0A88184-ECBF-5229-7D04B2F5837BF48C}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/bash /sbin/augenrules --load" />
	</Image>
	<Image Id="{CAD86B2F-B964-A21F-DA73E53E392EA8EC}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/bash /sbin/service auditd stop" />
	</Image>
	<Image Id="{224F7D17-8333-8686-919E79600AA17B55}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/opt/kaspersky/kesl/libexec/kesl" />
	</Image>
	<Image Id="{E40A021B-C926-A133-8461F75D501B3528}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/sbin/audispd" />
	</Image>
	<Image Id="{AE258C48-A14C-EB2F-970DA1B4C10A410D}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/sbin/auditd*" />
	</Image>
	<Image Id="{C37389B7-0E73-F3D4-898C985971B690C7}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/usr/bin/perl /usr/bin/utfd*" />
	</Image>
	<Image Id="{E93E3A1E-2563-CEF3-2A28D47394D6E700}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/usr/bin/pgrep -x -u 0 auditd" />
	</Image>
	<Image Id="{C926FF67-8A9A-74B7-4485E45249CA628B}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="awk &#10;begin   {&#10;        minus_e*" />
	</Image>
	<Image Id="{22ABDB54-3D3C-E269-4F14AC4D0E8514F1}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="mktemp /tmp/aurules.xxxxxxxx" />
	</Image>
	<Image Id="{139D3774-0FB6-3771-36DBA532250FBAFB}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/bash /sbin/augenrules --load" />
	</Image>
	<Image Id="{221EEA48-A689-A51E-BA837E2F1A89A6B1}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/bash /sbin/service auditd stop" />
	</Image>
	<Image Id="{F0E65B21-BA92-BB2C-E69E67BB74860A39}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/opt/kaspersky/kesl/libexec/kesl" />
	</Image>
	<Image Id="{F5223664-C185-F105-147635E5A9127F2A}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/sbin/audispd" />
	</Image>
	<Image Id="{8D03FB3B-F0E3-A464-F71AFE16ADC06DD5}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/sbin/auditd*" />
	</Image>
	<Image Id="{C4D4A355-F050-94D6-F34515E8B098823C}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/usr/bin/perl /usr/bin/utfd*" />
	</Image>
	<Image Id="{EC2AD5A9-AED1-0D47-75C9A534FB989377}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/usr/bin/pgrep -x -u 0 auditd" />
	</Image>
	<Image Id="{8083E08C-9888-49A1-5AFCE9534E252D82}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="awk &#10;begin   {&#10;        minus_e*" />
	</Image>
	<Image Id="{9E87B51F-38EA-D56F-9EC84CF5B73AA21B}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="mktemp /tmp/aurules.xxxxxxxx" />
	</Image>
	<Image Id="{BAA018E0-6E0A-401F-AB28D35561B88A90}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/sh /sbin/augenrules --load" />
	</Image>
	<Image Id="{8CC8F801-6D4E-C468-21502E0504CB6904}" CmdLine="cmp -s /tmp/aurules.*" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd stop" />
	</Image>
	<Image Id="{4EB5E119-DEDC-28F3-BF5A64BA5C1C6FE9}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/bin/sh /sbin/augenrules --load" />
	</Image>
	<Image Id="{E9779E0D-E58B-F308-C285132E80A5B5A6}" CmdLine="systemctl stop auditd.service" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd stop" />
	</Image>
	<Image Id="{76C00C51-94C6-24E2-D4267A5E6626931C}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/sh /sbin/augenrules --load" />
	</Image>
	<Image Id="{48887F3B-F720-C892-95D24D178CC4F65A}" CmdLine="/bin/sh /sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd stop" />
	</Image>
	<Image Id="{07659BF7-E0CD-1957-DE01977C18C6A055}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/sh /sbin/augenrules --load" />
	</Image>
	<Image Id="{CCA18BF2-87E9-2A35-33A7295B3CB3F988}" CmdLine="/bin/sh /usr/sbin/service auditd*" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd stop" />
	</Image>
	<Image Id="{6307916F-2514-DAB8-35C8AFA6D3970932}" CmdLine="systemctl -p triggers show *" >
		<ParentProcess CmdLine="/bin/sh /usr/sbin/service auditd*" />
	</Image>
	<Image Id="{34A31F4E-BB20-65C7-171E3102C9609658}" CmdLine="/bin/sh /usr/sbin/service auditd stop*" >
		<ParentProcess CmdLine="/bin/sh /usr/sbin/service auditd*" />
	</Image>
	<Image Id="{EE12474D-114F-E600-A61F6BDFB39692BE}" CmdLine="/bin/sh /usr/sbin/service auditd stop*" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd*" />
	</Image>
	<Image Id="{D6B289D5-8C31-F308-E5A9DE79CD267617}" CmdLine="systemctl --quiet is-active multi-user.target" >
		<ParentProcess CmdLine="/bin/sh /usr/sbin/service auditd*" />
	</Image>
	<Image Id="{1A21152F-E638-292C-5A60F525037469A5}" CmdLine="systemctl --quiet is-active multi-user.target" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd*" />
	</Image>
	<Image Id="{195CC829-DBC9-B4F6-7DDC9F0A46E537C6}" CmdLine="systemctl list-unit-files --full --type=socket" >
		<ParentProcess CmdLine="/bin/sh /usr/sbin/service auditd*" />
	</Image>
	<Image Id="{C67126AC-CC6B-44F4-103C7151CC4F51F2}" CmdLine="systemctl list-unit-files --full --type=socket" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd*" />
	</Image>
	<Image Id="{C8D712F5-6D9D-95A0-5D41192A19217985}" CmdLine="sed -ne s/\.socket\s*" >
		<ParentProcess CmdLine="/bin/sh /usr/sbin/service auditd*" />
	</Image>
	<Image Id="{19E935F6-703B-6EA3-62C5BC252F38A262}" CmdLine="sed -ne s/\.socket\s*" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd*" />
	</Image>
	<Image Id="{54BB78DB-50E6-5557-711897FBA880CBAE}" CmdLine="basename /usr/sbin/service" >
		<ParentProcess CmdLine="/bin/sh /usr/sbin/service auditd*" />
	</Image>
	<Image Id="{EB887690-1229-4314-667BBCABB8499731}" CmdLine="basename /usr/sbin/service" >
		<ParentProcess CmdLine="/bin/sh /sbin/service auditd*" />
	</Image>
<!-- Part 0001 2021-12-01T21:43:00.000Z-1638395012 -->
<!-- ############################################################################################################### -->

<!-- ############################################################################################################### -->
<!-- Part 0002 2023-08-24T18:39:00.000Z-1692902394 -->
  <Image Id="{6C5316B2-956F-0E20-C047EBBFE2A20C56}" CmdLine="/bin/ps -e -opid= -oruid= -ocommand=" >
    <ParentProcess CmdLine="/opt/managesoft/libexec/mgsusageag" />
  </Image>
<!-- Part 0002 2023-08-24T18:39:00.000Z-1692902394 -->
<!-- ############################################################################################################### -->

<!-- ############################################################################################################### -->
<!-- Part 0003 2023-09-22T20:49:00.000Z-1695415754 -->
	<Image Id="{7EC060FB-DB7C-B389-9582364879F6108D}" CmdLine="pgpool: wait for connection request          *" />
<!-- Part 0003 2023-09-22T20:49:00.000Z-1695415754 -->
<!-- ############################################################################################################### -->

</Filters>