7e3ff687063d2a52607b68f60f46ff7cd918ca21af2df36da7d2f91e9324b970

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/sys_vendor	systemd-detect-virt
File opened for reading	/sys/devices/virtual/dmi/id/product_name	neofetch

Checks mountinfo of local process 1 TTPs 2 IoCs

Checks mountinfo of running processes which indicate if it is running in chroot jail.

antivm

System Checks

description	ioc	Process
File opened for reading	/proc/1/mountinfo	ischroot
File opened for reading	/proc/1/mountinfo	ischroot

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt

Enumerates running processes
Discovers information about currently running processes on the system

Reads hardware information 1 TTPs 1 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_version	neofetch

Write file to user bin folder 16 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/cacaplay.dpkg-new	dpkg
File opened for modification	/usr/bin/cacaclock.dpkg-new	dpkg
File opened for modification	/usr/bin/cacaserver.dpkg-new	dpkg
File opened for modification	/usr/bin/img2txt.dpkg-new	dpkg
File opened for modification	/usr/bin/w3m.dpkg-new	dpkg
File opened for modification	/usr/bin/libsixel-config.dpkg-new	dpkg
File opened for modification	/usr/bin/chafa.dpkg-new	dpkg
File opened for modification	/usr/bin/jp2a.dpkg-new	dpkg
File opened for modification	/usr/bin/toilet.dpkg-new	dpkg
File opened for modification	/usr/bin/w3mman.dpkg-new	dpkg
File opened for modification	/usr/bin/img2sixel.dpkg-new	dpkg
File opened for modification	/usr/bin/cacademo.dpkg-new	dpkg
File opened for modification	/usr/bin/cacafire.dpkg-new	dpkg
File opened for modification	/usr/bin/cacaview.dpkg-new	dpkg
File opened for modification	/usr/bin/neofetch.dpkg-new	dpkg
File opened for modification	/usr/bin/sixel2png.dpkg-new	dpkg

Reads process memory 1 TTPs 21 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/898/maps	needrestart
File opened for reading	/proc/389/maps	needrestart
File opened for reading	/proc/591/maps	needrestart
File opened for reading	/proc/756/maps	needrestart
File opened for reading	/proc/760/maps	needrestart
File opened for reading	/proc/781/maps	needrestart
File opened for reading	/proc/843/maps	needrestart
File opened for reading	/proc/771/maps	needrestart
File opened for reading	/proc/792/maps	needrestart
File opened for reading	/proc/793/maps	needrestart
File opened for reading	/proc/1/maps	needrestart
File opened for reading	/proc/583/maps	needrestart
File opened for reading	/proc/824/maps	needrestart
File opened for reading	/proc/852/maps	needrestart
File opened for reading	/proc/795/maps	needrestart
File opened for reading	/proc/357/maps	needrestart
File opened for reading	/proc/418/maps	needrestart
File opened for reading	/proc/435/maps	needrestart
File opened for reading	/proc/589/maps	needrestart
File opened for reading	/proc/779/maps	needrestart
File opened for reading	/proc/787/maps	needrestart

Changes its process name 33 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	2481	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	2482	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	2483	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3319	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3324	sshx
Changes the process name, possibly in an attempt to hide itself	pool-spawner	3548	gdbus
Changes the process name, possibly in an attempt to hide itself	gmain	3549	gdbus
Changes the process name, possibly in an attempt to hide itself	gdbus	3550	gdbus
Changes the process name, possibly in an attempt to hide itself	pool-spawner	3709	gsettings
Changes the process name, possibly in an attempt to hide itself	gmain	3710	gsettings
Changes the process name, possibly in an attempt to hide itself	dconf worker	3711	gsettings
Changes the process name, possibly in an attempt to hide itself	pool-spawner	3718	gsettings
Changes the process name, possibly in an attempt to hide itself	gmain	3719	gsettings
Changes the process name, possibly in an attempt to hide itself	dconf worker	3720	gsettings
Changes the process name, possibly in an attempt to hide itself	pool-spawner	3730	gsettings
Changes the process name, possibly in an attempt to hide itself	gmain	3731	gsettings
Changes the process name, possibly in an attempt to hide itself	dconf worker	3732	gsettings
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3823	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3931	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3935	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3937	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3980	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3981	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3986	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	3987	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	4406	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	5562	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	5563	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	5568	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	5569	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	5570	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	5584	sshx
Changes the process name, possibly in an attempt to hide itself	tokio-runtime-w	5586	sshx

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

description	ioc	Process
File opened for reading	/proc/cpuinfo	systemd-detect-virt
File opened for reading	/proc/cpuinfo	awk
File opened for reading	/proc/cpuinfo	awk
File opened for reading	/proc/cpuinfo	grep

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	ps

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/revision	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/config	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/subsystem_vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/subsystem_vendor	lspci
File opened for reading	/sys/bus/pci/devices	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/revision	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/revision	lspci
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/devices/system/node	ps
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/config	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/subsystem_vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/subsystem_vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/config	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/revision	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/config	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	lspci
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/subsystem_vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/subsystem_vendor	lspci
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/subsystem_vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	lspci
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	sshx
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/subsystem_vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	lspci
File opened for reading	/sys/fs/cgroup/system.slice/cpu.max	sshx
File opened for reading	/sys/class/hwmon	neofetch
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/config	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	lspci
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/revision	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/subsystem_device	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/config	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/revision	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/config	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	lspci
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/revision	lspci

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1053/root/usr/lib/python3.12/fnmatch.py	needrestart
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/192/environ	ps
File opened for reading	/proc/771/status	ps
File opened for reading	/proc/1807/stat	ps
File opened for reading	/proc/2292/status	needrestart
File opened for reading	/proc/2487/cmdline	needrestart
File opened for reading	/proc/2245/cmdline	ps
File opened for reading	/proc/1996/cmdline	ps
File opened for reading	/proc/1996/ctty	ps
File opened for reading	/proc/1994/cmdline	needrestart
File opened for reading	/proc/3318/status	needrestart
File opened for reading	/proc/202/ctty	ps
File opened for reading	/proc/1956/environ	ps
File opened for reading	/proc/12/status	needrestart
File opened for reading	/proc/21/cmdline	needrestart
File opened for reading	/proc/124/ctty	ps
File opened for reading	/proc/1084/cmdline	ps
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/71/ctty	ps
File opened for reading	/proc/199/environ	needrestart
File opened for reading	/proc/1947/cmdline	needrestart
File opened for reading	/proc/2147/environ	needrestart
File opened for reading	/proc/3329/status	ps
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/34/environ	needrestart
File opened for reading	/proc/64/stat	needrestart
File opened for reading	/proc/1991/environ	needrestart
File opened for reading	/proc/16/environ	ps
File opened for reading	/proc/1130/cmdline	ps
File opened for reading	/proc/1962/stat	ps
File opened for reading	/proc/1/limits	su
File opened for reading	/proc/18/status	needrestart
File opened for reading	/proc/30/status	ps
File opened for reading	/proc/1053/root/usr/lib/python3.12/functools.py	needrestart
File opened for reading	/proc/2200/maps	needrestart
File opened for reading	/proc/version	neofetch
File opened for reading	/proc/787/cmdline	ps
File opened for reading	/proc/12/environ	needrestart
File opened for reading	/proc/1124/stat	needrestart
File opened for reading	/proc/18/cmdline	needrestart
File opened for reading	/proc/45/status	needrestart
File opened for reading	/proc/1053/cmdline	needrestart
File opened for reading	/proc/2487/status	needrestart
File opened for reading	/proc/1053/root/usr/lib/python3.12/email/policy.py	needrestart
File opened for reading	/proc/591/ctty	ps
File opened for reading	/proc/13/status	needrestart
File opened for reading	/proc/16/stat	needrestart
File opened for reading	/proc/42/environ	ps
File opened for reading	/proc/2188/status	ps
File opened for reading	/proc/2236/ctty	ps
File opened for reading	/proc/435/status	needrestart
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/1398/environ	ps
File opened for reading	/proc/583/environ	needrestart
File opened for reading	/proc/1053/root/usr/lib/python3.12/os.py	needrestart
File opened for reading	/proc/2028/environ	ps
File opened for reading	/proc/3318/environ	ps
File opened for reading	/proc/199/cmdline	needrestart
File opened for reading	/proc/193/ctty	ps
File opened for reading	/proc/202/cmdline	ps

System Information Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the system, such as OS, hostname, and hardware details.

System Information Discovery

pid	Process
3625	lsb_release
3626	getopt

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
3626	getopt
3768	awk

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
3524	dpkg
3674	dpkg-query

/tmp/sshx
/tmp/sshx
1⤵
- Changes its process name
- Enumerates kernel/hardware configuration
PID:2479
- /bin/bash
  /bin/bash
  2⤵
  PID:3318
- - /usr/bin/groups
    groups
    3⤵
    PID:3320
- - /usr/bin/dircolors
    dircolors -b
    3⤵
    PID:3321
- - /usr/bin/apt
    apt
    3⤵
    PID:3326
- - /usr/bin/sudo
    sudo su
    3⤵
    - OS Credential Dumping
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    - Reads runtime system information
    PID:3327
  - - /usr/bin/su
      su
      4⤵
      OS Credential Dumping
      Reads runtime system information
      PID:3329
    - - /bin/bash
        
        bash
        5⤵
        
        PID:3331
      - /usr/bin/groups
        
        groups
        6⤵
        
        PID:3332
      - /usr/bin/dircolors
        
        dircolors -b
        6⤵
        
        PID:3333
      - /usr/bin/apt
        
        apt install neofetch
        6⤵
        Deletes log files
        
        PID:3338
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:3339
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:3340
        
        /bin/sh
        
        /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
        7⤵
        
        PID:3341
        
        /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        8⤵
        Enumerates kernel/hardware configuration
        
        PID:3342
        
        /usr/lib/apt/methods/http
        
        /usr/lib/apt/methods/http
        7⤵
        
        PID:3346
        
        /bin/sh
        
        /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
        7⤵
        
        PID:3347
        
        /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        8⤵
        Enumerates kernel/hardware configuration
        
        PID:3348
        
        /bin/sh
        
        /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
        7⤵
        
        PID:3353
        
        /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        8⤵
        Enumerates kernel/hardware configuration
        
        PID:3354
        
        /usr/bin/ischroot
        
        /usr/bin/ischroot -t
        7⤵
        Checks mountinfo of local process
        
        PID:3358
        
        /usr/lib/apt/methods/http
        
        /usr/lib/apt/methods/http
        7⤵
        
        PID:3359
        
        /bin/sh
        
        /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
        7⤵
        
        PID:3360
        
        /usr/sbin/dpkg-preconfigure
        
        /usr/sbin/dpkg-preconfigure --apt
        8⤵
        OS Credential Dumping
        
        PID:3361
        
        /usr/local/sbin/locale
        
        locale charmap
        9⤵
        
        PID:3362
        
        /usr/local/bin/locale
        
        locale charmap
        9⤵
        
        PID:3362
        
        /usr/sbin/locale
        
        locale charmap
        9⤵
        
        PID:3362
        
        /usr/bin/locale
        
        locale charmap
        9⤵
        
        PID:3362
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --assert-multi-arch
        7⤵
        
        PID:3363
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --assert-protected-field
        7⤵
        
        PID:3364
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --status-fd 32 --no-triggers --unpack --auto-deconfigure --recursive /tmp/apt-dpkg-install-U3F3jd
        7⤵
        Write file to user bin folder
        
        PID:3365
        
        /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        8⤵
        
        PID:3366
        
        /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        8⤵
        
        PID:3366
        
        /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        9⤵
        
        PID:3368
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        10⤵
        
        PID:3369
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        10⤵
        
        PID:3378
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/00-libid3tag0_0.15.1b-14build1_amd64.deb
        8⤵
        
        PID:3370
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/00-libid3tag0_0.15.1b-14build1_amd64.deb
        8⤵
        
        PID:3370
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/00-libid3tag0_0.15.1b-14build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3371
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/00-libid3tag0_0.15.1b-14build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3371
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3374
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3374
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/00-libid3tag0_0.15.1b-14build1_amd64.deb
        8⤵
        
        PID:3375
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/00-libid3tag0_0.15.1b-14build1_amd64.deb
        8⤵
        
        PID:3375
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3379
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3379
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/01-libimlib2t64_1.12.1-1.1build2_amd64.deb
        8⤵
        
        PID:3380
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/01-libimlib2t64_1.12.1-1.1build2_amd64.deb
        8⤵
        
        PID:3380
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/01-libimlib2t64_1.12.1-1.1build2_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3381
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/01-libimlib2t64_1.12.1-1.1build2_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3381
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3384
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3384
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/01-libimlib2t64_1.12.1-1.1build2_amd64.deb
        8⤵
        
        PID:3385
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/01-libimlib2t64_1.12.1-1.1build2_amd64.deb
        8⤵
        
        PID:3385
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3388
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3388
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/02-caca-utils_0.99.beta20-4build2_amd64.deb
        8⤵
        
        PID:3389
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/02-caca-utils_0.99.beta20-4build2_amd64.deb
        8⤵
        
        PID:3389
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/02-caca-utils_0.99.beta20-4build2_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3390
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/02-caca-utils_0.99.beta20-4build2_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3390
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3393
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3393
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/02-caca-utils_0.99.beta20-4build2_amd64.deb
        8⤵
        
        PID:3394
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/02-caca-utils_0.99.beta20-4build2_amd64.deb
        8⤵
        
        PID:3394
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3397
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3397
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/03-libchafa0t64_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3398
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/03-libchafa0t64_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3398
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/03-libchafa0t64_1.14.0-1.1build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3399
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/03-libchafa0t64_1.14.0-1.1build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3399
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3402
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3402
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/03-libchafa0t64_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3403
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/03-libchafa0t64_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3403
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3406
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3406
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/04-libgav1-1_0.18.0-1build3_amd64.deb
        8⤵
        
        PID:3407
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/04-libgav1-1_0.18.0-1build3_amd64.deb
        8⤵
        
        PID:3407
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/04-libgav1-1_0.18.0-1build3_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3408
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/04-libgav1-1_0.18.0-1build3_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3408
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3411
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3411
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/04-libgav1-1_0.18.0-1build3_amd64.deb
        8⤵
        
        PID:3412
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/04-libgav1-1_0.18.0-1build3_amd64.deb
        8⤵
        
        PID:3412
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3415
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3415
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-U3F3jd/05-libyuv0_0.0~git202401110.af6ac82-1_amd64.deb"
        8⤵
        
        PID:3416
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-U3F3jd/05-libyuv0_0.0~git202401110.af6ac82-1_amd64.deb"
        8⤵
        
        PID:3416
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-U3F3jd/05-libyuv0_0.0~git202401110.af6ac82-1_amd64.deb" /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3417
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-U3F3jd/05-libyuv0_0.0~git202401110.af6ac82-1_amd64.deb" /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3417
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3420
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3420
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-U3F3jd/05-libyuv0_0.0~git202401110.af6ac82-1_amd64.deb"
        8⤵
        
        PID:3421
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-U3F3jd/05-libyuv0_0.0~git202401110.af6ac82-1_amd64.deb"
        8⤵
        
        PID:3421
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3424
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3424
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/06-libavif16_1.0.4-1ubuntu3_amd64.deb
        8⤵
        
        PID:3425
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/06-libavif16_1.0.4-1ubuntu3_amd64.deb
        8⤵
        
        PID:3425
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/06-libavif16_1.0.4-1ubuntu3_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3426
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/06-libavif16_1.0.4-1ubuntu3_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3426
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3429
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3429
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/06-libavif16_1.0.4-1ubuntu3_amd64.deb
        8⤵
        
        PID:3430
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/06-libavif16_1.0.4-1ubuntu3_amd64.deb
        8⤵
        
        PID:3430
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3433
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3433
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/07-chafa_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3434
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/07-chafa_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3434
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/07-chafa_1.14.0-1.1build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3435
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/07-chafa_1.14.0-1.1build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3435
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3438
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3438
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/07-chafa_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3439
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/07-chafa_1.14.0-1.1build1_amd64.deb
        8⤵
        
        PID:3439
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3442
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3442
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/08-jp2a_1.1.1-2ubuntu2_amd64.deb
        8⤵
        
        PID:3443
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/08-jp2a_1.1.1-2ubuntu2_amd64.deb
        8⤵
        
        PID:3443
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/08-jp2a_1.1.1-2ubuntu2_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3444
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/08-jp2a_1.1.1-2ubuntu2_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3444
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3447
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3447
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/08-jp2a_1.1.1-2ubuntu2_amd64.deb
        8⤵
        
        PID:3448
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/08-jp2a_1.1.1-2ubuntu2_amd64.deb
        8⤵
        
        PID:3448
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3451
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3451
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-U3F3jd/09-libgc1_1%3a8.2.6-1build1_amd64.deb"
        8⤵
        
        PID:3452
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-U3F3jd/09-libgc1_1%3a8.2.6-1build1_amd64.deb"
        8⤵
        
        PID:3452
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-U3F3jd/09-libgc1_1%3a8.2.6-1build1_amd64.deb" /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3453
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-U3F3jd/09-libgc1_1%3a8.2.6-1build1_amd64.deb" /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3453
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3456
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3456
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-U3F3jd/09-libgc1_1%3a8.2.6-1build1_amd64.deb"
        8⤵
        
        PID:3457
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-U3F3jd/09-libgc1_1%3a8.2.6-1build1_amd64.deb"
        8⤵
        
        PID:3457
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3460
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3460
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/10-neofetch_7.1.0-4_all.deb
        8⤵
        
        PID:3461
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/10-neofetch_7.1.0-4_all.deb
        8⤵
        
        PID:3461
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/10-neofetch_7.1.0-4_all.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3462
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/10-neofetch_7.1.0-4_all.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3462
        
        /usr/sbin/tar
        
        tar -x -f
        9⤵
        
        PID:3465
        
        /usr/bin/tar
        
        tar -x -f
        9⤵
        
        PID:3465
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/10-neofetch_7.1.0-4_all.deb
        8⤵
        
        PID:3466
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/10-neofetch_7.1.0-4_all.deb
        8⤵
        
        PID:3466
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3469
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3469
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/11-toilet-fonts_0.3-1.4build1_all.deb
        8⤵
        
        PID:3470
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/11-toilet-fonts_0.3-1.4build1_all.deb
        8⤵
        
        PID:3470
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/11-toilet-fonts_0.3-1.4build1_all.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3471
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/11-toilet-fonts_0.3-1.4build1_all.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3471
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3474
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3474
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/11-toilet-fonts_0.3-1.4build1_all.deb
        8⤵
        
        PID:3475
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/11-toilet-fonts_0.3-1.4build1_all.deb
        8⤵
        
        PID:3475
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3478
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3478
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/12-toilet_0.3-1.4build1_amd64.deb
        8⤵
        
        PID:3479
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/12-toilet_0.3-1.4build1_amd64.deb
        8⤵
        
        PID:3479
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/12-toilet_0.3-1.4build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3480
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/12-toilet_0.3-1.4build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3480
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3483
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3483
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/12-toilet_0.3-1.4build1_amd64.deb
        8⤵
        
        PID:3484
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/12-toilet_0.3-1.4build1_amd64.deb
        8⤵
        
        PID:3484
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3487
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3487
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/13-w3m_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3488
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/13-w3m_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3488
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/13-w3m_0.5.3+git20230121-2ubuntu5_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3489
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/13-w3m_0.5.3+git20230121-2ubuntu5_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3489
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3492
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3492
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/13-w3m_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3493
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/13-w3m_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3493
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3496
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3496
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/14-w3m-img_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3497
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/14-w3m-img_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3497
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/14-w3m-img_0.5.3+git20230121-2ubuntu5_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3498
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/14-w3m-img_0.5.3+git20230121-2ubuntu5_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3498
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3501
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        Reads runtime system information
        
        PID:3501
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/14-w3m-img_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3502
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/14-w3m-img_0.5.3+git20230121-2ubuntu5_amd64.deb
        8⤵
        
        PID:3502
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3505
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3505
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/15-libsixel1_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3506
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/15-libsixel1_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3506
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/15-libsixel1_1.10.3-3build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3507
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/15-libsixel1_1.10.3-3build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3507
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3510
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3510
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/15-libsixel1_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3511
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/15-libsixel1_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3511
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3514
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3514
        
        /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/16-libsixel-bin_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3515
        
        /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-U3F3jd/16-libsixel-bin_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3515
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/16-libsixel-bin_1.10.3-3build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3516
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-U3F3jd/16-libsixel-bin_1.10.3-3build1_amd64.deb /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3516
        
        /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3519
        
        /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        9⤵
        
        PID:3519
        
        /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/16-libsixel-bin_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3520
        
        /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-U3F3jd/16-libsixel-bin_1.10.3-3build1_amd64.deb
        8⤵
        
        PID:3520
        
        /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3523
        
        /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        8⤵
        
        PID:3523
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --status-fd 32 --configure --pending
        7⤵
        Software Deployment Tools
        
        PID:3524
        
        /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        8⤵
        
        PID:3525
        
        /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        8⤵
        
        PID:3525
        
        /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        9⤵
        
        PID:3527
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        10⤵
        
        PID:3528
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        10⤵
        
        PID:3529
        
        /var/lib/dpkg/info/toilet.postinst
        
        /var/lib/dpkg/info/toilet.postinst configure
        8⤵
        Executes dropped EXE
        
        PID:3530
        
        /usr/bin/update-alternatives
        
        update-alternatives --install /usr/bin/figlet figlet /usr/bin/figlet-toilet 20
        9⤵
        
        PID:3531
        
        /var/lib/dpkg/info/w3m.postinst
        
        /var/lib/dpkg/info/w3m.postinst configure
        8⤵
        Executes dropped EXE
        
        PID:3532
        
        /usr/bin/update-alternatives
        
        update-alternatives --quiet --install /usr/bin/pager pager /usr/bin/w3m 25 --slave /usr/share/man/man1/pager.1.gz pager.1.gz /usr/share/man/man1/w3m.1.gz
        9⤵
        
        PID:3533
        
        /usr/bin/update-alternatives
        
        update-alternatives --quiet --install /usr/bin/www-browser www-browser /usr/bin/w3m 25 --slave /usr/share/man/man1/www-browser.1.gz www-browser.1.gz /usr/share/man/man1/w3m.1.gz
        9⤵
        
        PID:3534
        
        /var/lib/dpkg/info/man-db.postinst
        
        /var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
        8⤵
        
        PID:3536
        
        /usr/bin/setpriv
        
        setpriv --reuid man --regid man --init-groups -- /usr/bin/mandb -pq
        9⤵
        
        PID:3537
        
        /usr/bin/mandb
        
        /usr/bin/mandb -pq
        9⤵
        
        PID:3537
        
        /var/lib/dpkg/info/libc-bin.postinst
        
        /var/lib/dpkg/info/libc-bin.postinst triggered ldconfig
        8⤵
        
        PID:3538
        
        /usr/sbin/ldconfig
        
        ldconfig -r /
        9⤵
        
        PID:3539
        
        /sbin/ldconfig.real
        
        /sbin/ldconfig.real -r /
        9⤵
        
        PID:3539
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:3540
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:3541
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:3542
        
        /usr/bin/test
        
        /usr/bin/test -e /usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service
        7⤵
        
        PID:3545
        
        /usr/bin/test
        
        /usr/bin/test -S /var/run/dbus/system_bus_socket
        7⤵
        
        PID:3546
        
        /usr/bin/gdbus
        
        /usr/bin/gdbus call --system --dest org.freedesktop.PackageKit --object-path /org/freedesktop/PackageKit --timeout 4 --method org.freedesktop.PackageKit.StateHasChanged cache-update
        7⤵
        Changes its process name
        
        PID:3547
        
        /bin/echo
        
        /bin/echo
        7⤵
        
        PID:3551
        
        /bin/sh
        
        sh -c -- "test -x /usr/lib/needrestart/apt-pinvoke && /usr/lib/needrestart/apt-pinvoke -m u || true"
        7⤵
        
        PID:3552
        
        /usr/lib/needrestart/apt-pinvoke
        
        /usr/lib/needrestart/apt-pinvoke -m u
        8⤵
        
        PID:3553
        
        /usr/bin/dbus-send
        
        dbus-send --system "--dest=org.freedesktop.login1" --print-reply /org/freedesktop/login1 org.freedesktop.DBus.Properties.Get string:org.freedesktop.login1.Manager string:PreparingForShutdown
        9⤵
        
        PID:3554
        
        /usr/bin/rm
        
        rm -f /run/needrestart/unpacked
        9⤵
        
        PID:3555
        
        /usr/sbin/needrestart
        
        /usr/sbin/needrestart -m u
        8⤵
        Reads process memory
        Reads runtime system information
        
        PID:3553
        
        /usr/bin/systemd-detect-virt
        
        /usr/bin/systemd-detect-virt --vm --quiet
        9⤵
        Checks hardware identifiers (DMI)
        Checks CPU configuration
        
        PID:3556
        
        /usr/bin/systemd-detect-virt
        
        /usr/bin/systemd-detect-virt --container --quiet
        9⤵
        
        PID:3557
        
        /usr/local/sbin/who
        
        who -r
        9⤵
        
        PID:3558
        
        /usr/local/bin/who
        
        who -r
        9⤵
        
        PID:3558
        
        /usr/sbin/who
        
        who -r
        9⤵
        
        PID:3558
        
        /usr/bin/who
        
        who -r
        9⤵
        
        PID:3558
        
        /usr/bin/python3.12
        
        /usr/bin/python3.12 -
        9⤵
        
        PID:3559
        
        /bin/sh
        
        sh -c -- "if [ -d /var/lib/update-notifier ]; then touch /var/lib/update-notifier/dpkg-run-stamp; fi; /usr/lib/update-notifier/update-motd-updates-available 2>/dev/null || true"
        7⤵
        
        PID:3560
        
        /usr/bin/touch
        
        touch /var/lib/update-notifier/dpkg-run-stamp
        8⤵
        
        PID:3561
        
        /usr/lib/update-notifier/update-motd-updates-available
        
        /usr/lib/update-notifier/update-motd-updates-available
        8⤵
        
        PID:3562
        
        /usr/bin/apt-config
        
        apt-config shell StateDir Dir::State
        9⤵
        
        PID:3563
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3564
        
        /usr/bin/apt-config
        
        apt-config shell ListDir Dir::State::Lists
        9⤵
        
        PID:3565
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3566
        
        /usr/bin/apt-config
        
        apt-config shell DpkgStatus Dir::State::status
        9⤵
        
        PID:3567
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        Reads runtime system information
        
        PID:3568
        
        /usr/bin/apt-config
        
        apt-config shell EtcDir Dir::Etc
        9⤵
        
        PID:3569
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3570
        
        /usr/bin/apt-config
        
        apt-config shell SourceList Dir::Etc::sourcelist
        9⤵
        
        PID:3571
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3572
        
        /usr/bin/find
        
        find /var/lib/apt/lists/ /etc/apt/sources.list //var/lib/dpkg/status -type f -newer /var/lib/update-notifier/updates-available -print -quit
        9⤵
        
        PID:3573
        
        /usr/bin/dirname
        
        dirname /var/lib/update-notifier/updates-available
        9⤵
        
        PID:3575
        
        /usr/bin/mktemp
        
        mktemp -p /var/lib/update-notifier
        9⤵
        
        PID:3574
        
        /usr/lib/update-notifier/apt-check
        
        /usr/lib/update-notifier/apt-check --human-readable
        9⤵
        
        PID:3576
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3577
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3578
        
        /usr/bin/ischroot
        
        /usr/bin/ischroot -t
        10⤵
        Checks mountinfo of local process
        
        PID:3579
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3580
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3581
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        10⤵
        
        PID:3582
        
        /usr/bin/mv
        
        mv /var/lib/update-notifier/tmp.yPQR5Mi0Dr /var/lib/update-notifier/updates-available
        9⤵
        
        PID:3583
        
        /usr/bin/chmod
        
        chmod +r /var/lib/update-notifier/updates-available
        9⤵
        
        PID:3584
        
        /usr/bin/rm
        
        rm -f /var/lib/update-notifier/tmp.yPQR5Mi0Dr
        9⤵
        
        PID:3585
        
        /bin/sh
        
        /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
        7⤵
        
        PID:3586
        
        /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        8⤵
        Enumerates kernel/hardware configuration
        
        PID:3587
      - /tmp/https:/sshx.io/s/Hkpby788Ot#TfEStkEgYhTHvA
        
        "https://sshx.io/s/Hkpby788Ot#TfEStkEgYhTHvA"
        6⤵
        
        PID:3618
      - /usr/bin/clear
        
        clear
        6⤵
        
        PID:3619
      - /usr/bin/neofetch
        
        neofetch
        6⤵
        Checks hardware identifiers (DMI)
        Reads hardware information
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:3622
        
        /usr/bin/uname
        
        uname -srm
        7⤵
        
        PID:3623
        
        /usr/bin/mkdir
        
        mkdir -p /root/.config/neofetch/
        7⤵
        
        PID:3624
        
        /usr/bin/lsb_release
        
        lsb_release -sd
        7⤵
        System Information Discovery
        
        PID:3625
        
        /usr/bin/getopt
        
        getopt --name lsb_release -o hvidrcas -l "help,version,id,description,release,codename,all,short" -- -sd
        8⤵
        System Information Discovery
        System Network Configuration Discovery
        
        PID:3626
        
        /usr/bin/cut
        
        cut -c1
        8⤵
        
        PID:3629
        
        /usr/bin/tr
        
        tr "[:lower:]" "[:upper:]"
        8⤵
        
        PID:3630
        
        /usr/bin/cut
        
        cut -c2-
        8⤵
        
        PID:3633
        
        /usr/bin/tr
        
        tr "[:upper:]" "[:lower:]"
        8⤵
        
        PID:3636
        
        /usr/bin/tr
        
        tr "[:upper:]" "[:lower:]"
        8⤵
        
        PID:3639
        
        /usr/bin/dpkg-query
        
        dpkg-query -f ".\\n" -W
        7⤵
        Software Deployment Tools
        
        PID:3674
        
        /usr/bin/ps
        
        ps -e
        7⤵
        Reads CPU attributes
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:3675
        
        /usr/bin/grep
        
        grep -qFm 1 snapd
        7⤵
        
        PID:3676
        
        /usr/bin/snap
        
        snap list
        7⤵
        Enumerates kernel/hardware configuration
        
        PID:3677
        
        /usr/bin/xrandr
        
        xrandr --nograb --current
        7⤵
        
        PID:3690
        
        /usr/bin/awk
        
        awk -F "connected |\\\\+|\\\\(" "/ connected.*[0-9]+x[0-9]+\\+/ && \$2 {printf \$2 \", \"}"
        7⤵
        
        PID:3691
        
        /usr/bin/xprop
        
        xprop -root -notype _NET_SUPPORTING_WM_CHECK
        7⤵
        
        PID:3696
        
        /usr/bin/xprop
        
        xprop -id 0x400001 -notype -len 100 -f _NET_WM_NAME 8t
        7⤵
        
        PID:3697
        
        /usr/bin/xprop
        
        xprop -root
        7⤵
        
        PID:3699
        
        /usr/bin/awk
        
        awk "/KDE_SESSION_VERSION|^_MUFFIN|xfce4|xfce5/"
        7⤵
        
        PID:3700
        
        /usr/bin/gsettings
        
        gsettings get org.gnome.shell.extensions.user-theme name
        7⤵
        
        PID:3707
        
        /usr/bin/gsettings
        
        gsettings get org.gnome.desktop.wm.preferences theme
        7⤵
        Changes its process name
        
        PID:3708
        
        /usr/bin/gsettings
        
        gsettings get org.gnome.desktop.interface gtk-theme
        7⤵
        Changes its process name
        
        PID:3717
        
        /usr/bin/gsettings
        
        gsettings get org.gnome.desktop.interface icon-theme
        7⤵
        Changes its process name
        
        PID:3729
        
        /usr/bin/grep
        
        grep -i -F PPid: /proc/3331/status
        7⤵
        
        PID:3742
        
        /usr/bin/grep
        
        grep -i -F PPid: /proc/3329/status
        7⤵
        
        PID:3746
        
        /usr/bin/grep
        
        grep -i -F PPid: /proc/3328/status
        7⤵
        
        PID:3750
        
        /usr/bin/grep
        
        grep -i -F PPid: /proc/3327/status
        7⤵
        
        PID:3754
        
        /usr/bin/grep
        
        grep -i -F PPid: /proc/3318/status
        7⤵
        
        PID:3758
        
        /usr/bin/realpath
        
        realpath /proc/2479/exe
        7⤵
        
        PID:3761
        
        /usr/bin/awk
        
        awk -F "\\\\s*: | @" "/model name|Hardware|Processor|^cpu model|chip type|^cpu type/ { cpu=\$2; if (\$1 == \"Hardware\") exit } END { print cpu }" /proc/cpuinfo
        7⤵
        Checks CPU configuration
        System Network Configuration Discovery
        
        PID:3768
        
        /usr/bin/awk
        
        awk -F ": |\\\\." "/cpu MHz|^clock/ {printf \$2; exit}" /proc/cpuinfo
        7⤵
        Checks CPU configuration
        
        PID:3769
        
        /usr/bin/grep
        
        grep -c "^processor" /proc/cpuinfo
        7⤵
        Checks CPU configuration
        
        PID:3770
        
        /usr/bin/lspci
        
        lspci -mm
        7⤵
        Enumerates kernel/hardware configuration
        
        PID:3776
        
        /usr/bin/awk
        
        awk -F "\\\"|\\\" \\\"|\\\\(" "/\"Display|\"3D|\"VGA/ {a[\$0] = \$1 \" \" \$3 \" \" \$4} END {for(i in a) {if(!seen[a[i]]++) print a[i]}}"
        7⤵
        
        PID:3777

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Proc Filesystem

T1003.007

Discovery

System Information Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks