{
  "event": "exec",
  "pid": 4242,
  "ppid": 4100,
  "uid": 1000,
  "parent_comm": "bash",
  "filename": "/tmp/.payload",
  "argv": []
}